Exam prep

What is software quality according to ISO/IEC 25010? The degree to which software satisfies stated and implied needs under specified conditions.

What four activities make up quality management? Quality planning, quality assurance, quality control, and quality improvement.

What is constructive quality management? Preventive measures applied before an artefact is created, such as standards, templates, tools, methods, and training.

What is analytical quality management? Measures applied after an artefact exists to detect defects, such as reviews, metrics, static analysis, and testing.

Constructive QA versus analytical QA: what is the key distinction? Constructive QA prevents errors before creation; analytical QA detects errors after creation.

What is a static QA procedure? A procedure that examines an artefact without executing it, such as a review, metric, or static code analysis.

What is a dynamic QA procedure? A procedure that executes software using specific input data to observe its behaviour.

A project requires 40% of usability tests to be completed in the first phase. Which QA principle applies? Quantitative quality assurance, because a measurable target value and deadline are specified.

What is quantitative quality assurance? Managing quality through measurable indicators, target values, thresholds, and deadlines.

What is early error detection and correction? Finding and correcting defects as early as possible because later correction is more expensive and errors can propagate.

How does early error detection differ from quantitative QA? Early error detection concerns when defects are found; quantitative QA concerns measurable targets and key figures.

What is maximum constructive quality assurance? Prioritising preventive measures because strong process quality increases the likelihood of strong product quality.

What is development-accompanying integrated QA? QA activities run in parallel with all development activities instead of being postponed until the end.

Why should QA be independent? Independent assessment improves objectivity, although a hybrid model is often used so developers retain responsibility for quality.

What does the testing principle “testing shows the presence of errors” mean? Testing can reveal defects but can never prove that no defects remain.

Why is complete testing impossible? The number of possible inputs, states, paths, and environments is too large, so testing must sample.

What is error accumulation or defect clustering? A small number of components usually contain most defects; when one defect is found, test the surrounding area more deeply.

Scenario: checkout repeatedly produces defects. How should defect clustering guide the next tests? Prioritise additional and varied tests around checkout and related components because defects are likely to cluster there.

What is the pesticide paradox? Repeating the same tests with the same data eventually stops revealing new defects, so tests must be reviewed and varied.

What does environment-dependent testing mean? Test design must reflect the system’s purpose, risks, technology, users, and operating environment.

What does the “absence-of-errors fallacy” mean? Even software with few technical defects is poor quality if it does not meet user needs or business requirements.

At the cost-optimised quality level, how do prevention and correction costs compare? They are approximately balanced; pursuing perfect prevention would cost more than the benefit achieved.

What is quality planning? Defining who performs QA, what is quality-assured, when it happens, and which methods are used; its output is the QA plan.

What is quality assurance? Executing the quality measures defined in the quality plan.

What is quality control in this course? Monitoring and controlling whether planned QA activities are performed effectively; it operates at a meta-level.

What is quality improvement? Reworking and improving text, models, code, or processes based on detected findings.

Product-oriented versus process-oriented quality management? Product-oriented QM assesses artefacts; process-oriented QM assesses whether activities and processes are performed consistently and correctly.

What is the primary role of measurement in process-oriented QM? To monitor process implementation, identify deviations, and support continuous process improvement.

Scenario: maintainability improves but critical customer requirements are still unmet. What does this mean? Internal product metrics improved, but business fitness did not; metrics must be complemented by requirements validation, user feedback, and acceptance testing.

Why can metrics not prove that a system fulfils customer needs? Metrics measure selected attributes, not the business consequences, usefulness, or completeness of requirements.

What four questions must a quality plan answer? Who assures quality? What is quality-assured? When is it assured? How is it assured?

What is a quality gate? A defined checkpoint that an artefact or system must pass before development progresses to the next stage.

What does SMART stand for in quality objectives? Specific, Measurable, Acceptable, Realistic, and Time-bound.

Name the six ISO 9126 quality characteristics. Functionality, reliability, usability, efficiency, maintainability, and portability.

What are the six principles of Total Quality Management? Customer orientation; quality priority; responsibility of all employees; continuous improvement; internal customer-supplier relationships; process orientation.

What are the three categories of constructive QA measures? Organisational, technical, and interpersonal measures.

Give examples of organisational constructive measures. Standards, templates, guidelines, and checklists.

Give examples of technical constructive measures. Programming languages, frameworks, tools, version control, and structured methods.

Give examples of interpersonal constructive measures. Training, team-development activities, communication practices, and suitable workspace design.

What is the final step of the 5 Whys improvement process? Evaluate the introduced QA measures to confirm that they prevent recurrence.

What is timeboxing? Assigning a fixed, non-extendable duration to an activity or meeting to maintain focus and prevent uncontrolled discussion.

What makes a good checklist item? It tests one objective only and uses clear, simple, unambiguous wording.

Can a checklist replace detailed technical documentation? No. It supports consistent checking but cannot replace comprehensive documentation.

Compare an informal individual review, walkthrough, and inspection. Individual review is quick and informal; a walkthrough is an author-led group discussion; an inspection is formal, role-based, and follows a defined process.

Which review type includes a minute-taker? A formal inspection only.

Who normally leads a walkthrough? The author, who presents the artefact and guides the discussion.

Who leads and controls a formal inspection? The moderator.

What are the six formal review steps? Planning, preliminary discussion, individual preparation, review session, rework, and evaluation.

Who performs rework after a review? The author implements the agreed corrections.

Who evaluates whether review corrections were implemented properly? The moderator verifies completion and finalises the review outcome.

Scenario: you incorporated every suggestion into your test-case document. What is your role? Author, because the author performs the rework.

What is the feedback-burger structure? Positive opening, specific observation-perception-wish feedback, and a positive closing.

What does LOC measure? The size of source code in lines, although the exact counting rules must be defined.

What does NCLOC measure? Non-commented lines of code, normally excluding blank lines and comments.

What do Halstead metrics analyse? Textual complexity based on the number and occurrence of operators and operands.

What does a high Halstead value suggest? Potentially greater complexity, effort, and defect risk, but it does not prove poor quality.

Why must Halstead results be interpreted cautiously? They show correlations and measurable code properties, not guaranteed readability, correctness, or business value.

What is fan-in? The number of other components that call or depend on a component.

What is fan-out? The number of other components that a component calls or depends on.

Why is high fan-out risky? It indicates strong coupling, making the component harder to understand, test, change, and isolate.

What does McCabe cyclomatic complexity measure? The number of linearly independent execution paths through code.

What does DIT measure? Depth of inheritance tree in an object-oriented system.

Why is a metric value meaningless on its own? It needs context, a threshold, baseline, trend, benchmark, or quality objective for interpretation.

How can software metrics be gamed? Developers may optimise the measured number rather than genuine quality, such as adding unnecessary comments or splitting code artificially.

What is the central limitation of software metrics? They measure selected attributes and indicate possible problems, but they cannot independently prove overall quality or business fitness.

What does Checkstyle analyse? Java source code for compliance with coding-style and convention rules.

How is Checkstyle configured? Using a rules file, often based on a standard configuration such as Google or Sun rules and customised for the project.

Where can Checkstyle be integrated? Build tools such as Maven or Gradle, continuous-integration pipelines, and IDEs.

Name three advantages of Checkstyle. Consistent team style, easier code comprehension, and fewer formatting-only differences in version control.

What is Checkstyle’s major limitation? Style compliance does not guarantee correct logic, good design, or an error-free system.

What does PMD analyse? Source code for suspicious patterns such as unused variables, empty blocks, duplicated code, and other maintainability concerns.

What does SpotBugs analyse? Compiled Java bytecode for known bug patterns, correctness issues, bad practices, and dodgy code.

Checkstyle, PMD, or SpotBugs: which one examines bytecode? SpotBugs.

Can static-analysis findings be accepted automatically as definite defects? No. They are indicators that require manual review because false positives and context-dependent findings are possible.

Can syntactically correct code still be bad code? Yes. It may contain poor design, duplication, unclear structure, or logical defects despite compiling successfully.

What is a key limitation of static analysis? It does not execute software and therefore cannot fully reveal runtime behaviour, user outcomes, or environment-dependent failures.

What six elements should a complete test case contain? Test-case ID or name, preconditions, input data, steps or actions, expected result, and actual result recorded during execution.

What is black-box testing based on? Specifications and externally visible behaviour without using knowledge of internal source-code structure.

What is white-box testing based on? Internal code structure, including statements, branches, conditions, and execution paths.

At which levels is black-box testing commonly used? Integration, system, and acceptance testing.

At which levels is white-box testing commonly used? Unit testing and some integration testing.

What is equivalence partitioning? Dividing the input domain into classes expected to produce equivalent behaviour and testing representatives from each class.

How should valid equivalence classes be combined? Combine as many valid classes as practical in one test case when the combination remains meaningful.

How should invalid equivalence classes be tested? Test one invalid class per test case so the source of failure can be isolated.

What is boundary-value analysis? Testing valid and invalid values immediately around the edges of an input range, where defects frequently occur.

Scenario: valid age is 18–65. Give four boundary test values. 17, 18, 65, and 66.

When is state-based testing appropriate? When system behaviour depends on its current internal state and events cause transitions between states.

What are the four steps of state-based test generation? Create a state diagram, build a transition table, identify error states, and derive test cases.

What are the risk-based use-case selection criteria? Value contribution, usage frequency, damage potential, and typical errors in comparable functions.

What does value contribution mean in risk-based selection? How strongly the function contributes to the organisation’s value chain or business outcome.

What does usage frequency mean in risk-based selection? How many users use the function and how often they use it.

What does damage potential mean in risk-based selection? The severity of harm if an undetected defect occurs in the function.

What does typical errors mean in risk-based selection? Whether similar functions or systems commonly contain defects in that area.

Which risk criterion most directly represents severity? Damage potential.

How should a random-data generator be configured for employee records? Define valid domains and constraints for gender, names, and birthdays, including realistic formats, age/date ranges, and relationships between fields; then generate values within those rules.

Why should random generation be combined with equivalence partitioning? Equivalence classes constrain generation to meaningful valid and invalid ranges and improve coverage.

Name three advantages of random test-data generation. Many datasets with little repeated effort; scalable generation once configured; reduced manual data-entry errors.

Name three disadvantages of random test-data generation. It may create unrealistic combinations; detailed upfront rules are expensive to specify; and it cannot replace structured test-design techniques.

Why is unrestricted random test data dangerous? It may produce meaningless records that do not represent real users or business rules, reducing the relevance of test results.

What are the four test levels from lowest to highest? Unit, integration, system, and acceptance testing.

What is the primary focus of a unit test? An isolated component or module, usually using white-box techniques and executed by developers.

What does reproducibility mean for unit tests? The same test under the same conditions should produce the same result, using controlled data and dependencies.

What does independence mean for unit tests? Each test resets or controls its state and does not depend on execution order or another test’s result.

What does regressability mean? Tests can be rerun after changes to detect whether previously working behaviour has broken.

What is the TDD sequence? Write a test first, observe it fail, implement the minimum code, make the test pass, and then refactor.

What is the purpose of integration testing? To verify that components exchange data and interact correctly through their interfaces.

What does bottom-up integration use? Drivers only; base components are integrated first.

What does top-down integration use? Dummies or stubs only; higher-level or UI components are integrated first.

What does by-value integration use? Both drivers and dummies, integrating the components with the greatest business value first.

What is the major advantage of by-value integration? It is flexible and exposes high-value business functionality early.

What is the major disadvantage of by-value integration? It requires more effort to create and maintain both drivers and dummies.

What does a system test examine? The complete integrated system in a production-like environment.

What is latency? The delay between initiating an action and receiving the corresponding response or confirmation.

What is throughput? The amount of work, data, or transactions processed per unit of time.

What do load and stress tests examine? System behaviour under extreme demand or reduced resources, including whether the system recovers after overload.

Scenario: which critical defect is most likely during a mobile-banking load test? Failure to restore normal functionality or recover correctly after the extreme load ends.

What is a regression test? A rerun of previously passed tests after a change to detect unintended side effects.

Who executes acceptance testing? The customer or authorised business representatives.

What is the outcome of acceptance testing? A contractual decision to accept or reject the system, often followed by negotiation about outstanding findings.

Why do requirements use static QA only? Requirements documents cannot be executed, so they must be reviewed, analysed, modelled, and validated without runtime testing.

What are the four steps in QA of requirements? Determine examination criteria; select principles and techniques; conduct and document the examination; coordinate requirements and resolve conflicts.

What are the three quality perspectives for requirements? Content, documentation, and coordination.

Name the six quality criteria for an individual requirement. Complete, verifiable, unambiguous, consistent, realistic, and comprehensible.

What does “complete” mean for a requirement? All necessary information and conditions are present.

What does “verifiable” mean for a requirement? Compliance can be objectively tested or confirmed.

What does “unambiguous” mean for a requirement? It permits only one reasonable interpretation.

What does “consistent” mean for a requirement? It does not contradict other requirements or constraints.

What does “realistic” mean for a requirement? It is achievable within technical, financial, legal, and time constraints.

What does “comprehensible” mean for a requirement? Stakeholders can read and understand it clearly.

What is the difference between ex-ante and ex-post architecture QA? Ex-ante evaluates architecture before implementation; ex-post checks the implemented system against the planned architecture.

What is ATAM used for? Evaluating architecture alternatives against quality-attribute scenarios and identifying risks, sensitivities, and trade-offs before implementation.

What is an ATAM utility tree? A prioritised hierarchy of quality attributes and concrete scenarios used to evaluate the architecture.

What are the four ATAM phases? Preparation and presentation; investigation and analysis; testing; reporting.

Scenario: ATAM reveals an unaddressed data-integrity risk. What should happen? Record and acknowledge the risk, analyse its impact, define mitigation or an architectural decision, and schedule follow-up review.

What is an architecture compliance check? An ex-post comparison of the implemented architecture with the planned architecture to identify deviations.

What are the five CMMI maturity levels? Initial, Managed, Defined, Quantitatively Managed, and Optimizing.

Describe CMMI Level 1: Initial. Processes are ad hoc, chaotic, and not reliably repeatable.

Describe CMMI Level 2: Managed. Work is managed and repeatable, with scope understood, although processes are not yet fully standardised.

Describe CMMI Level 3: Defined. Processes, roles, activities, and outputs are documented and standardised across the organisation.

Describe CMMI Level 4: Quantitatively Managed. Processes are measured and controlled using quantitative indicators and KPIs.

Describe CMMI Level 5: Optimizing. The organisation continuously improves processes using measurement, learning, and innovation.

Staged versus continuous CMMI? Staged CMMI assigns one maturity level to the organisation; continuous CMMI allows different capability levels for different process areas.

Is process improvement ever completely finished? No. It is a repeating cycle of identification, prioritisation, planning, training, adaptation, evaluation, and further improvement.

What mnemonic orders the CMMI levels? I Made Definite Quantitative Progress: Initial, Managed, Defined, Quantitatively Managed, Optimizing.

How should you structure an 8–10 mark scenario answer? Name the concept; define it; apply it to the scenario; present every requested item as numbered points; and state the expected QA result.

If a question asks for three drawbacks, how should the answer be presented? Give three separately numbered and clearly named drawbacks, each briefly connected to the scenario.

What is the fastest way to check whether a long answer is complete? Underline the command words and quantities in the question, then confirm that each requested component has a visibly separate answer.