ISTQB Risk-Based Testing Strategies 4 — Questions and Answers
Question 1: In risk-based testing, which group of stakeholders should be MOST involved in risk assessment?
- Only the test team, since they understand testing best
- A cross-functional group including business analysts, developers, testers, and business owners (Correct answer)
- Only senior management, since they own the business risks
- Only the customer, since they define requirements
Correct answer: A cross-functional group including business analysts, developers, testers, and business owners
Risk assessment benefits from diverse perspectives; business owners understand impact, developers know complexity, and testers know testability — all contribute to accurate risk ratings.
Question 2: A safety-critical embedded system and a low-volume internal reporting tool both have a 'medium' likelihood score for a defect. Why might the safety-critical system still receive far more testing effort?
- Because embedded systems always require more tests by regulation
- Because the impact of failure in the safety-critical system is catastrophically higher (Correct answer)
- Because medium-likelihood risks must always be tested exhaustively
- Because reporting tools are fully covered by unit tests and need no further testing
Correct answer: Because the impact of failure in the safety-critical system is catastrophically higher
Risk exposure accounts for both likelihood and impact; catastrophic safety consequences dramatically increase the overall risk level even with equal likelihood scores.
Question 3: What is 'risk-based exit criteria' in software testing?
- The criteria used to exit only when all test cases have been executed
- Conditions that define when acceptable risk levels have been achieved, allowing testing to stop (Correct answer)
- The criteria used to determine when to escalate defects to high severity
- A checklist that developers use to exit the coding phase
Correct answer: Conditions that define when acceptable risk levels have been achieved, allowing testing to stop
Risk-based exit criteria define the acceptable residual risk threshold; testing continues until the remaining risks are at or below the agreed level.
Question 4: Which of the following is an example of a 'project risk' rather than a 'product risk'?
- A payment module may calculate tax incorrectly
- The login feature may fail under high concurrent load
- Key developers leaving the project mid-sprint could delay delivery (Correct answer)
- A data migration script may corrupt customer records
Correct answer: Key developers leaving the project mid-sprint could delay delivery
Project risks threaten the project's ability to achieve its objectives (schedule, budget, resources), while product risks relate to potential failures in the software itself.
Question 5: How does risk-based testing differ from coverage-based testing in terms of effort allocation?
- Coverage-based testing allocates more effort to complex code; risk-based testing ignores complexity
- Risk-based testing allocates effort proportional to risk level; coverage-based testing aims for uniform code coverage (Correct answer)
- Both approaches allocate testing effort in exactly the same way
- Risk-based testing only applies to acceptance testing; coverage-based applies only to unit testing
Correct answer: Risk-based testing allocates effort proportional to risk level; coverage-based testing aims for uniform code coverage
Risk-based testing intentionally concentrates effort on high-risk areas, whereas coverage-based testing aims to achieve a defined level of coverage across all code or requirements uniformly.
Question 6: When should risk assessments be updated during a project lifecycle?
- Only at the very beginning of the project during planning
- Only when a critical defect is found during testing
- Continuously throughout the project as new information becomes available (Correct answer)
- Only at the end of testing to document what risks were realized
Correct answer: Continuously throughout the project as new information becomes available
Risk assessments should be treated as living documents and updated whenever project changes, new defects, scope changes, or other new information alter the risk landscape.
Question 7: Which scenario BEST illustrates the concept of 'risk-based test design'?
- Writing one test case per requirement regardless of the requirement's criticality
- Creating more test cases and using more rigorous techniques for high-risk functionality (Correct answer)
- Designing tests alphabetically by feature name for consistency
- Using the same test design technique for all features to ensure standardization
Correct answer: Creating more test cases and using more rigorous techniques for high-risk functionality
Risk-based test design applies more intensive techniques (e.g., combinatorial testing, boundary analysis) and creates more test cases for high-risk features than for low-risk ones.
ISTQB Risk-Based Testing Strategies 4
In risk-based testing, which group of stakeholders should be MOST involved in risk assessment?