ISTQB-ATM practice question 9 of 15

You are working on a project to develop an authentication system for an e-commerce website. This system provides two features: Registration and…

You are working on a project to develop an authentication system for an e-commerce website. This system provides two features: Registration and authentication. Two different development teams develop these two features. There is a high likelihood that the delivery of the authentication feature to the test team will be three weeks later. To complete the registration the user must provide the following registration inputs: Name, surname, birth date, fiscal code and he/she can select a username and a password. A registered user can be a special user or a normal user. To be identified as a special user, he/she must also provide, during the registration process, a voucher possibly received from the IT department. Access is granted only if a user is registered and the password is correct: In all other cases access is denied. If the registered user is a special user and the password is wrong, a special warning is shown on the system console. You are currently performing a quality risk analysis using FMEA . Based only on the given information, which of the following is NOT a product risk that could be identified during the quality risk analysis? K4 3 credits

Answer options

A: The late delivery of the authentication feature to the test team causes delays in the start of test execution and this could result in a shorter test period Correct answer

B: The authentication system denies access for a special user with a wrong password, but doesn’t display a special warning on the system console

C: The authentication system grants access to a normal user with a wrong password

D: The authentication system grants access to a special user with a wrong password

Correct Answer:

A. The late delivery of the authentication feature to the test team causes delays in the start of test execution and this could result in a shorter test period

Explanation

The question requires identifying the option that is NOT a product risk. Product risks, also known as quality risks, are potential failures of the software to meet specified requirements or user expectations. Options B, C, and D all describe functional defects or security vulnerabilities where the system behaves incorrectly, thus representing clear product risks.
Option A describes the late delivery of a feature, which impacts the project timeline and the ability to conduct testing as planned. This is a classic example of a project risk, which pertains to the management and execution of the project (e.g., schedule, budget, resources), rather than a defect in the product itself.

Why Incorrect

B. This is a product risk because the system fails to meet a specific functional requirement—displaying a special warning for a special user.
C. This is a critical product risk as it describes a severe security vulnerability and a failure of the core authentication functionality.
D. This is also a critical product risk, representing a major security flaw and a failure of the system's primary authentication logic.

References

1. ISTQB Advanced Level Syllabus, Test Manager, Version 2012: Section 2.3.1, "Introduction to Risk Management," page 14, distinguishes between the two risk types. It defines project risks as those surrounding the project's ability to deliver its objectives, citing "supplier issues" (such as late delivery) as an example. It defines product risks as the possibility that the system might fail to satisfy user expectations, such as "software that does not perform its intended functions."

2. ISTQB Glossary of Testing Terms, Version 4.2:

Product Risk: Defined as "A risk directly related to the test object," which is "the possibility that a work product...may fail to satisfy the legitimate needs of its users and/or stakeholders." Options B, C, and D fall under this definition.

Project Risk: Defined as "A risk related to the management and control of a (test) project," with examples including "lack of staffing, strict deadlines, changing requirements." The scenario in option A, a delay impacting the test schedule, is a project risk.

Keep practicing

Take the free ISTQB-ATM practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test