Free iSQI CTFL-AcT Practice Exam with Questions & Answers | Set: 3

When stakeholders provide conflicting acceptance criteria, resolving the conflict effectively requires focusing on the underlying business goals rather than getting stuck in technical or solution-level disagreements.

Option D is correct because it aligns with the core role of a business analyst and an acceptance tester: to understand and validate business needs. By exploring the root business objectives, you can help stakeholders reframe the problem and reach a compromise based on what delivers the most value.

Other options:

A may lead to confrontation and unproductive discussion without proper facilitation.

B is risky — prioritizing stakeholders may escalate conflict or appear biased.

C assumes you can objectively resolve the conflict based only on pros and cons, but without understanding the business context, the decision may not meet stakeholder needs.

Answer: D. Instead of discussing conflicting technical solutions, you try to understand the underlying business needs

UX context analysis evaluates the environment and conditions in which users interact with a product. This includes:

External conditions: lighting, noise, device constraints

Psychological conditions: cognitive load, stress, motivation

These factors influence usability, accessibility, and overall experience.

Option A is correct as it reflects the essence of UX context analysis — understanding the broader user environment to inform design and testing.

Other options:

B describes personas, which are user archetypes used for behavior modeling — more aligned with user profiling.

C focuses on competitor analysis — useful for inspiration, not context analysis.

D involves use cases and workflows — useful for behavior modeling, but not specifically context analysis.

Answer: A. External conditions and psychological conditions are analyzed to derive design decisions

==================

Security testing ensures the system protects data and maintains intended behavior under potential attacks. Different techniques address specific security goals.

Option A is correct: Static vulnerability analysis inspects code or architecture without executing it, identifying weaknesses in mechanisms such as authentication (e.g., login controls) and authorization (e.g., access permissions). These mechanisms are foundational security requirements.

Other options:

B is misleading — penetration testing simulates attacks, but input validation is more often verified with fuzzing or code review.

C is incorrect — fuzzing tests input handling, not the performance of cryptographic algorithms.

D is incorrect — threat modeling is a design-time activity to identify risks; it’s not used to test policies directly.

Answer: A. Static vulnerability analysis to test authentication and authorization mechanisms

Comprehensive Detailed Explanation (Approx. 200–220 words):

This question focuses on the coverage criterion “execute all possible process tasks” from the BPMN model of a $100 withdrawal.

Let’s analyze the process:

The process starts when the user selects “Withdraw $100.”

A decision gateway checks if the balance is ≥ $100.

If NO: the card is removed and withdrawal is rejected.

If YES: the user is prompted to select whether they want a receipt.

Depending on the user’s choice:

If YES: the receipt is printed → then $100 is withdrawn → card is removed.

If NO: $100 is withdrawn → card is removed (no receipt printed).

To meet the criterion “execute all possible process tasks,” we must cover:

Rejected withdrawal path (balance < 100)

Withdrawal without receipt

Withdrawal with receipt

Receipt printing

Card removal in both success and failure

Test case coverage:

Test 1 (balance = $100, receipt = YES): covers successful withdrawal + receipt printed.

Test 3 (balance = $85): covers withdrawal rejected + card removed.

Together, these two tests execute all possible process tasks:

Withdraw with receipt

Reject due to insufficient balance

Receipt printed

Withdraw funds

Remove card

Other test combinations are redundant or do not add new path coverage.