ISQI ISTQB Certified Tester Advanced Level - Test Automation Engineering CTAL-TAE (Syllabus v2.0) Sample Questions:

1. Which of the following is the BEST example of how static analysis tools can help improve the test automation code quality in terms of security?

A) Static analysis tools can help detect hard-coded credentials that expose sensitive information within test automation code
B) Static analysis tools can help detect the presence of repeated instances of code within test automation code
C) Static analysis tools can ensure there are no security vulnerabilities within test automation code
D) Static analysis tools do not generate false positives when attempting to detect security vulnerabilities within test automation code

2. An automated test script makes a well-formed request to a REST API in the backend of a web app to add a single item for a product (with ID = 710) to the cart and expects a response confirming that the product is successfully added. The status line of the API response is HTTP/1.1 200 OK, while the response body indicates that the product is out of stock. The API response is correct, the test script fails but completes, and the message to log is: The product with ID = 710 is out of stock. Cart not updated. When this occurs, you are already aware that both the failed test and the API are behaving correctly and that the problem is in the test data. The TAS supports the following test logging levels: FATAL, ERROR, WARN, INFO, DEBUG. Which of the following is the MOST appropriate test logging level to use to log the specified message?

A) WARN
B) INFO
C) DEBUG
D) FATAL

3. In a first possible implementation, the automated test scripts within a suite locate and interact with elements of a web UI indirectly through the browsers using browser-specific drivers and APIs, provided by an automated test tool used as part of the TAS. In an alternative implementation, these test scripts locate and interact with elements of the same web UI directly at the HTML level by accessing the DOM (Document Object Model) and internal JavaScript code. The first possible implementation:

A) Has a lower level of intrusion than the alternative implementation, and therefore its test scripts are less likely to produce false positives
B) Has a higher level of intrusion than the alternative implementation, and therefore its test scripts are less likely to produce false positives
C) Has a lower level of intrusion than the alternative implementation, and therefore its test scripts are more likely to produce false positives
D) Has the same level of intrusion as the alternative implementation, and therefore the risk of test scripts producing false positives is the same in both cases

4. Some automated regression test scripts run by a TAS in a given test environment make calls to private APIs that require authentication for all requests (the authentication method is the same for all APIs). The SUT is a business-critical system. The following two changes are planned: a change in the authentication method of all APIs and a minor upgrade of the OS (Operating System) in the test environment. You have updated the test scripts to cope with the change in the API authentication method. Which of the following sequences of activities is BEST to ensure that the test scripts are not adversely affected by these changes?

A) First implement the change in the API authentication method, then upgrade the OS, and finally run all the updated test scripts
B) Implement one change at a time and run a subset of the updated test scripts after each change
C) First upgrade the OS, then implement the change in the API authentication method, and finally run all the updated test scripts
D) Implement one change at a time and run a subset of the updated test scripts after each change, and finally run all the updated test scripts

5. A new TAS allows the implementation of automated data-driven test scripts. All the tasks planned for the initial deployment of this TAS, aimed at installing and configuring the TAS components and provisioning the infrastructure, will be performed manually by a dedicated, specialized team. This TAS is expected to be deployed in the future in other similar environments. As a TAE, you see a risk that the correct and reproducible deployment of the TAS cannot be guaranteed. Which of the following options is BEST suited for mitigating this risk?

A) Review data-driven test scripts to better organize test libraries by adding test functions containing identical sequences of actions commonly implemented in a relevant number of scripts
B) Partition the data tables containing test data used by data-driven test scripts into smaller data tables, using an appropriate logical criterion, to make them more manageable
C) Nothing needs to be done, because the team that will manually perform the specified tasks, as they are specialized, will not make mistakes and will therefore be able to ensure a correct and reproducible deployment
D) Try to automate most of the tasks related to the installation and configuration of the TAS components and those related to the provisioning of the infrastructure

Solutions: