Question 9 - BCS TM12 Real Exam Questions [Feb 2026 Update]

Q: 9

You are working on a project to develop an authentication system for an e-commerce website. This system provides two features: Registration and authentication. Two different development teams develop these two features. There is a high likelihood that the delivery of the authentication feature to the test team will be three weeks later. To complete the registration the user must provide the following registration inputs: Name, surname, birthdate, fiscal code and he/she can select a username and a password. A registered user can be a special user or a normal user. To be identified as a special user, he/she must also provide, during the registration process, a voucher possibly received from the IT department. Access is granted only if a user is registered and the password is correct: In all other cases access is denied. If the registered user is a special user and the password is wrong, a special warning is shown on the system console. You are currently performing a quality risk analysis using FMEA. Based only on the given information, which of the following is NOT a product risk that could be identified during the quality risk analysis? Number of correct responses: 1

Options

Correct Answer:

Explanation

The question requires identifying which option is NOT a product risk. Product risks, also known as quality risks, are potential failures of the software to meet specified quality characteristics or user needs (e.g., functional defects, security vulnerabilities, poor performance). Options B, C, and D all describe potential functional or security failures within the authentication system itself. In contrast, option A describes a late delivery of a feature, which impacts the project's schedule and resource allocation. This is a classic example of a project risk, which relates to the management and execution of the project, not the intrinsic quality of the product itself.

Why Incorrect

B. This is a product risk because the system fails to meet a specified functional requirement (displaying a special warning for a specific user type).

C. This is a critical product risk as it describes a severe security and functional failure where the system incorrectly grants access.

D. This is also a critical product risk, representing a major security flaw and a failure of the core authentication logic.

References

1. ISTQB® Certified Tester Foundation Level Syllabus V4.0, International Software Testing Qualifications Board, 2023.

Section 5.2.1, "Project and Product Risks": This section explicitly distinguishes between the two types of risk. It defines product risks as the "potential for a work product... to fail to satisfy the legitimate needs of its users" and lists examples like "Software might not perform its intended functions according to the specification." This directly applies to options B, C, and D. It defines project risks as those that "surround the project’s capability to deliver its objectives" and provides "Delays in delivery" as a key example, which directly corresponds to option A.

2. Sommerville, I. (2016). Software Engineering (10th ed.). Pearson.

Chapter 25, Section 25.1.1, "Risk identification": This chapter discusses risk management in the context of the project. It identifies schedule slippage as a primary project risk. The text states, "Schedule risks are risks that the project will take longer to complete than scheduled." This aligns with the scenario in option A. In contrast, product-related risks like security and functional correctness are discussed in chapters on system dependability and specification (e.g., Chapter 8).

Premium Access Includes

FLASH OFFER

avail 10% DISCOUNT on YOUR PURCHASE