A bank is testing a new online banking system. The risk assessment team has identified the following risks: (1) a new regulatory requirement for transaction reporting, (2) a known issue with the payment processing engine that causes occasional failures, and (3) a planned integration with a third-party credit scoring service. The bank has limited testing resources and must prioritize. The regulatory requirement has a high likelihood of defects and a high impact if not met. The payment engine issue has a medium likelihood and a high impact. The third-party integration has a low likelihood but a medium impact. Which risk should be addressed first in the test plan?

All three equally, because they all have some level of risk.

The third-party integration, because it is new and untested.

The regulatory requirement, because it has the highest risk score (likelihood × impact).

The payment engine issue, because it is a known issue that could cause immediate failures.

What is the purpose of risk monitoring during the testing lifecycle?

To ensure that all test cases are executed exactly as planned

To document all defects found during testing

To report the status of testing to management

To track changes in risk levels and adjust testing accordingly

A financial institution is subject to the Payment Card Industry Data Security Standard (PCI DSS). The risk assessment shows that the cardholder data storage module has a high likelihood of defects and a high impact on compliance. The payment gateway module has a medium likelihood and a high impact. The customer portal module has a low likelihood and a low impact. The institution has limited testing resources. How should the test team prioritize testing to support PCI DSS compliance?

Test the customer portal first, as it is easiest to test.

Test the cardholder data storage module first, then the payment gateway, then the customer portal.

Test all modules equally to ensure full compliance.

Test the payment gateway first, as it is the most visible to customers.

How does risk-based testing support regulatory compliance in financial systems?

By testing all regulatory requirements with the same level of detail

By ensuring that all defects are fixed before release

By automating all compliance tests

By focusing testing on areas with the highest risk of non-compliance

In risk-based testing, what does 'prioritizing by risk' mean?

Testing features with the highest risk level first

Testing features that are most frequently used by users first

Testing features that are easiest to test first

Testing features in the order they were developed

Certified Tester Finance Testing

Domain 3Objective 2

Principles of Risk-Based Testing in Financial Systems CT-FT Practice Questions (Page 3)

Part of the Risk-Based Testing domain, which makes up ~11% of our current practice bank. ISTQB does not publish an official question count, but from its 60-minute exam (~25–40 total, ~3–4 in this domain), expect 1–1 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

8concepts

Questions 11–15

11expert · hard
A bank is testing a new online banking system. The risk assessment team has identified the following risks: (1) a new regulatory requirement for transaction reporting, (2) a known issue with the payment processing engine that causes occasional failures, and (3) a planned integration with a third-party credit scoring service. The bank has limited testing resources and must prioritize. The regulatory requirement has a high likelihood of defects and a high impact if not met. The payment engine issue has a medium likelihood and a high impact. The third-party integration has a low likelihood but a medium impact. Which risk should be addressed first in the test plan?
Select an answer first
12foundation · easy
What is the purpose of risk monitoring during the testing lifecycle?
Select an answer first
13expert · hard
A financial institution is subject to the Payment Card Industry Data Security Standard (PCI DSS). The risk assessment shows that the cardholder data storage module has a high likelihood of defects and a high impact on compliance. The payment gateway module has a medium likelihood and a high impact. The customer portal module has a low likelihood and a low impact. The institution has limited testing resources. How should the test team prioritize testing to support PCI DSS compliance?
Select an answer first
14foundation · easy
How does risk-based testing support regulatory compliance in financial systems?
Select an answer first
15foundation · easy
In risk-based testing, what does 'prioritizing by risk' mean?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-FT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-FT” is a trademark of its owner, used for identification only.

Principles of Risk-Based Testing in Financial Systems CT-FT Practice Questions (Page 3)

Questions 11–15

What is the purpose of risk monitoring during the testing lifecycle?

How does risk-based testing support regulatory compliance in financial systems?

In risk-based testing, what does 'prioritizing by risk' mean?

Keep studying — Risk-Based Testing