CTFL-AcT Exam Dumps : ISTQB Certified Tester - Acceptance Testing (CT-AcT)

This question is about combining Business Process Model and Notation (BPMN) and Decision Model and Notation (DMN) to design test cases for acceptance testing. The BPMN diagram outlines the customer checkout flow with a decision on whether a loyalty card is used, followed by a card scan that may trigger a discount check. The DMN decision table defines the logic for determining the discount percentage based on the number of loyalty points.

From the DMN:

<1000 points ⇒ 0% discount

1000–3000 points ⇒ 5% discount

3000 points ⇒ 5% discount

Option D correctly states that a customer with more than 500 points could be eligible for a 5% discount — but only if the number of points exceeds 1000. Since 500 does not meet the 1000 threshold, it appears this statement could be problematic at first glance. However, interpreting the spirit of the question, Option D is the only one matching the correct maximum discount scenario.

Let’s clarify each option:

A is incorrect: >1000 points qualifies for 5%, not 0%.

B is incorrect: 3% is not defined anywhere — DMN has 0% or 5%.

C is incorrect: again, 3% does not exist in the table.

D is acceptable in principle, assuming a typo (i.e., it should be “more than 1000” instead of 500); however, if taken literally, it would be incorrect.

However, given the options, D is the only one aligning with actual DMN output for >1000 loyalty points, despite the inaccurate lower limit.

Answer: D. These models can be used to generate a test case for a 5% reduction if the customer has more than 500 loyalty points

(If the literal error in Option D is to be treated strictly, the correct answer would be “none of the above,” but in context of typical ISTQB-style questions, D is the best fit.)

Security requirements specify how a system should handle access control, data protection, confidentiality, integrity, and authentication. In acceptance testing, validating that users cannot access data or functions they are not authorized for is a critical test objective when dealing with security.

Option D is correct because it directly relates to access control — a fundamental aspect of security. Ensuring that “normal users shall have restricted access to private data” reflects both a security requirement and a condition that must be tested for compliance.

Other options:

A relates to performance (response time).

B refers to architecture or platform (web-based system).

C is about UI design and usability (style compliance).

Only D addresses security specifically.

Answer: D. Normal users shall have restricted access to private data.

Acceptance Test-Driven Development (ATDD) involves early collaboration between stakeholders to define acceptance criteria and tests before development begins. Using business process models in ATDD helps visualize user behavior, align test cases with real workflows, and serve as living documentation.

Option C is the least meaningful argument because:

Business process models abstractly describe workflows and decisions at a business level. While they help clarify requirements and detect requirement-related defects, they do not directly support detecting defects in the application code, which is typically the focus of unit and integration testing, not acceptance testing.

Let’s validate the other options:

A is a strong argument — process models clarify use cases for testers.

B is valid — graphical models help visualize test coverage directly.

D is true — as business process models evolve, they remain valuable artifacts aligned with current system behavior and requirements.

Answer: C. Business process models will make it easier to detect defects in the application code.