Ruankao Software Evaluator (Intermediate) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Two's complement negation

Invert all bits of a binary number and add 1. An n-bit signed integer ranges from -2^(n-1) to 2^(n-1)-1, so 8 bits covers -128 to 127.

Coupling and cohesion

Cohesion measures how strongly a module's internal elements belong together; coupling measures interdependence between modules. Good design maximizes cohesion and minimizes coupling.

V-model pairing

Each development phase maps to a test level: detailed design to unit test, architectural design to integration test, requirements analysis to system test, user requirements to acceptance test.

Verification versus validation

Verification checks conformance to specification (building the product right). Validation checks that user needs are met (building the right product). Both are needed and neither replaces the other.

Error, defect, failure chain

A human error introduces a defect (fault) in code or documents. Executing that defect under the right conditions produces an observable failure, which testing detects.

Boundary value analysis

For an input range a to b, test a-1, a, a+1, b-1, b, and b+1. Defects cluster at boundaries, so edges are more likely to reveal them than interior values.

Decision table testing

A table lists conditions and actions; each column is a rule for one combination of condition values. Rule count equals the product of condition value counts, reduced by collapsing impossible rules.

MC/DC coverage

Modified condition/decision coverage requires each Boolean condition to independently affect the decision outcome. It is stronger than decision coverage and weaker than multiple-condition coverage.

Statement versus decision coverage

Statement coverage requires every executable statement to run; decision coverage requires every decision outcome to be taken. Full decision coverage implies full statement coverage, but not the reverse.

Regression versus retest

Retest (confirmation) re-executes the specific case that failed to verify a fix. Regression testing re-runs a broader suite to detect side effects of the change elsewhere.

Top-down integration testing

Integration proceeds from top-level modules downward, replacing missing lower modules with stubs. Bottom-up integration instead uses drivers for missing upper modules.

Smoke versus sanity testing

Smoke testing is a shallow health check confirming the build is stable enough for deeper testing. Sanity testing is a narrow, deep check of a specific fix or area.

Severity versus priority

Severity is the technical impact of a defect on the system. Priority is how urgently it should be fixed. They are independent: a cosmetic high-visibility defect can be high priority but low severity.

Defect removal efficiency

DRE equals defects found before release divided by total defects found. It measures how effectively testing and reviews remove defects before they reach users.

Risk-based testing

Test effort is allocated by risk, where risk equals likelihood multiplied by impact. Higher-risk items receive more depth and earlier execution than low-risk items.

Test automation pyramid

Many fast unit tests form the base, fewer API or service tests the middle, and few slow brittle UI tests the top. This ordering maximizes speed and stability of feedback.

Data-driven test framework

Test logic is separated from test data, which is stored externally in files or databases. The same script runs many times with different input and expected-result sets.

Flaky test

A test that produces different results on repeated runs with unchanged code. Flaky tests erode trust in automation and should be quarantined and fixed rather than ignored.

Test environment fidelity

The test environment should mirror production in hardware, OS, network, database, and interfaces closely enough that results predict production behavior. Environment drift causes false failures.

Static analysis tool

A tool that examines source code without executing it to find code smells, high complexity, dead code, and potential null or resource leaks. It complements, not replaces, reviews.

Little's Law

Concurrency equals throughput multiplied by response time (L = lambda x W). Use it to reconcile the number of virtual users with observed transaction rate and latency.

Stess versus load testing

Load testing applies expected peak load to verify requirements. Stress testing pushes beyond limits to find the breaking point and observe how the system degrades.

Endurance (soak) testing

Sustained load applied over hours or days to reveal memory leaks, resource exhaustion, and performance degradation that short tests cannot expose. Monitor heap and connection pools over time.

Availability formula

Availability equals MTBF divided by (MTBF + MTTR). Raising mean time between failures or reducing mean time to repair both increase availability.

SQL injection defense

Parameterized queries and strict input validation prevent injection. Test with payloads such as quote-or-one-equals-one to confirm the application rejects or safely handles them.

CIA triad

Confidentiality, integrity, and availability are the core security properties. Security testing also covers authentication, authorization, non-repudiation, and auditability.

ISO/IEC 25010 characteristics

The product quality model defines functional suitability, performance efficiency, compatibility, usability, reliability, security, maintainability, and portability, each with sub-characteristics used to structure quality requirements.

Quality assurance versus control

Quality assurance is process-oriented and aims to prevent defects through defined processes. Quality control is product-oriented and detects defects through testing and inspection.

Cost of quality categories

Prevention and appraisal costs are investments; internal failure costs occur before release; external failure costs occur after release and are typically the most expensive.

Test oracle

The source of expected results used to judge whether an observed test outcome is a pass or fail. It may be a specification, a reference implementation, or a human expert.

Triage in defect management

Triage is the review meeting that prioritizes and assigns newly reported defects. Participants decide severity, priority, and whether to fix, defer, or reject each defect.

Shall, should, may

In standards and specifications, 'shall' states a mandatory requirement, 'should' a recommendation, and 'may' a permitted option. Misreading these changes the meaning of a test criterion.