A team wants to automate tests for a REST API that frequently changes its response schema. The team uses a test framework that requires updating assertions manually whenever the schema changes. Which approach reduces maintenance effort?

Use schema validation against the OpenAPI specification instead of hardcoded field assertions.

Disable tests that fail due to schema changes until the API stabilizes.

Use a record-and-replay tool to capture responses and compare them exactly.

Write assertions for every field in the response to ensure full coverage.

What is the purpose of negative testing in API testing?

To test the API's security against attacks

To verify that the API returns correct data for valid inputs

To ensure that the API handles invalid inputs and error conditions gracefully

To measure the performance of the API under load

A QA team automates tests for a microservice API. They need to run a suite of 500 test cases in a CI pipeline, with tests that depend on data created by previous tests. Which automation approach best supports maintainability and reliable execution?

Use a data-driven framework where test data is externalized, and tests are grouped by feature with setup/teardown hooks.

Record and replay all API calls using a proxy tool without any assertions.

Run tests in parallel without any shared state management.

Create a single monolithic test script that runs all 500 tests sequentially in one file.

A security tester is reviewing an API that uses JWT for authentication. The tester finds that the API accepts tokens with 'alg' set to 'none'. What is the most significant risk?

An attacker can decrypt the token and read the payload.

An attacker can steal the token and replay it.

An attacker can modify the token's expiration time.

An attacker can forge a token without knowing the secret.

What is the primary focus of API integration testing?

Testing the API in isolation from other components

Testing the performance of the API under load

Testing the interactions between the API and other systems or components

Testing the user interface of the application

Certified Tester Advanced Level Technical Test Analyst

Domain 2Objective 7

API Testing CTAL-TTA Practice Questions (Page 2)

Part of the Domain 2: White-Box Test Techniques domain, which makes up ~19% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 1–2 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

8concepts

Questions 6–10

6application · medium
A team wants to automate tests for a REST API that frequently changes its response schema. The team uses a test framework that requires updating assertions manually whenever the schema changes. Which approach reduces maintenance effort?
Select an answer first
7foundation · easy
What is the purpose of negative testing in API testing?
Select an answer first
8application · medium
A QA team automates tests for a microservice API. They need to run a suite of 500 test cases in a CI pipeline, with tests that depend on data created by previous tests. Which automation approach best supports maintainability and reliable execution?
Select an answer first
9expert · hard
A security tester is reviewing an API that uses JWT for authentication. The tester finds that the API accepts tokens with 'alg' set to 'none'. What is the most significant risk?
Select an answer first
10foundation · easy
What is the primary focus of API integration testing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTAL-TTA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CTAL-TTA” is a trademark of its owner, used for identification only.