CTFL-AcT Exam Dumps : ISTQB Certified Tester - Acceptance Testing (CT-AcT)

Security requirements specify how a system should handle access control, data protection, confidentiality, integrity, and authentication. In acceptance testing, validating that users cannot access data or functions they are not authorized for is a critical test objective when dealing with security.

Option D is correct because it directly relates to access control — a fundamental aspect of security. Ensuring that “normal users shall have restricted access to private data” reflects both a security requirement and a condition that must be tested for compliance.

Other options:

A relates to performance (response time).

B refers to architecture or platform (web-based system).

C is about UI design and usability (style compliance).

Only D addresses security specifically.

Answer: D. Normal users shall have restricted access to private data.

The goal here is to achieve full decision coverage (also known as branch coverage), which means each decision point in the process must evaluate to both TRUE and FALSE at least once during testing.

From the BPMN ATM withdrawal model, we identify two key decisions:

Is the balance ≥ $100?

If yes, is receipt = YES?

To achieve full decision coverage:

One test must evaluate decision 1 as TRUE and another as FALSE.

If decision 1 is TRUE, then decision 2 must be exercised both ways (receipt = YES and NO), but for minimal decision coverage, one path through decision 2 is enough.

Analyzing test cases:

Test 1 (balance = $100, receipt = YES): decision 1 = TRUE, decision 2 = TRUE

Test 2 (balance = $99): decision 1 = FALSE

These two tests ensure:

Decision 1 evaluated TRUE (Test 1) and FALSE (Test 2)

Decision 2 evaluated at least once (receipt = YES in Test 1)

Thus, Test 1 and Test 2 form the minimal set for full decision coverage.

Other options:

C and D are redundant for the minimal set.

A includes an extra test not needed for minimal decision coverage.

Answer: B. Test 1, Test 2

Effective test reporting should be tailored to the audience’s role and needs. Project managers are typically concerned with high-level progress, schedules, risks, and milestones. Progress trend charts (e.g., test execution over time, defect trends) provide insights into how the project is advancing and help identify delays or bottlenecks.

Option B is correct as it fits the informational needs of a project manager.

Other options:

A: Defect reports are too detailed for steering groups, which prefer strategic summaries or risk reports.

C: Pie charts may provide high-level summaries, but development teams usually need detailed defect or test result data.

D: System users (e.g., customers) are not responsible for project risks and would not benefit from test risk rankings.

Answer: B. Progress trend charts for the project manager