Software Testing · End Term · May 2026 · AN

**1. Classify server responses in web application bypass/security testing:** - When invalid inputs cause the server to crash and **display internal implementation details (such as a failure stack trace or database error dump) to the user**, this category of server response is called **Exposure** (information exposure). **Answer: B — Exposure.** A: **Incorrect:** While an abnormal error occurred internally, revealing the internal stack trace to the end user specifically classifies it as Exposure. B: **Correct:** Displaying internal failure stack traces and database state errors to the user is categorized as Exposure. C: **Incorrect:** The server crashed and corrupted database records, so it is not a valid response. D: **Incorrect:** Exposure is the exact classification from the course.

**1. Distinguish performance testing types:** - **Spike testing:** A subset of stress/load testing that **suddenly increases (or decreases) the number of concurrent users by a very large amount** over a short period to observe how the system handles abrupt traffic spikes and whether it recovers. - **Scalability testing:** Gradually increases load to measure how well the system scales with added resources. - **Reliability testing:** Tests failure-free operation over a specified duration under normal conditions. **Answer: D — Spike test.** A: **Incorrect:** Scalability testing measures gradual scaling behavior rather than a sudden extreme surge in users. B: **Incorrect:** Documentation testing verifies user manuals and technical documentation. C: **Incorrect:** Reliability testing evaluates long-term stability under expected operating conditions. D: **Correct:** Spike testing subjects the system to a sudden, massive surge in user load.

**1. Identify the testing type:** Asking representative users to perform everyday tasks (adjusting volume, changing channels) to evaluate whether the interface buttons are **easy to find, learn, and use** is the definition of **Usability Testing**. **Answer: C — Usability Testing.** A: **Incorrect:** Compatibility testing checks operation across different devices, OS versions, and browsers. B: **Incorrect:** Scalability testing measures performance under increasing load. C: **Correct:** Evaluating how easily human users can navigate and use an interface is Usability Testing. D: **Incorrect:** Regression testing verifies that recent code changes have not broken existing functionality.

**1. Identify the web testing technique:** Capturing real user interaction sequences (session logs and HTTP requests) and replaying them to test the web application is called **User-session data based testing**. **Answer: D — User-session data based testing.** A: **Incorrect:** Bypass testing intentionally skips client-side validation rather than replaying real user session logs. B: **Incorrect:** Control-flow bypass testing alters page navigation sequences artificially. C: **Incorrect:** Value-level bypass testing supplies invalid parameter values bypassing client constraints. D: **Correct:** Recording and replaying actual user HTTP session logs is User-session data based testing.

**1. Recall transitions in an Application Transition Graph (ATG):** - When a user fills in HTML form fields (password, reason) and clicks a submit button to send form data to a server component, the transition in the ATG is a **Form Link Transition**. **Answer: A — Form Link Transition.** A: **Correct:** Submitting data entered into an HTML form triggers a Form Link Transition in the ATG. B: **Incorrect:** A Redirect Transition is triggered automatically by the server/browser without user form submission. C: **Incorrect:** An Operational Transition represents outside-the-page browser actions like clicking the Back/Refresh button. D: **Incorrect:** A Simple Link Transition is a static hyperlink (`<a href=...>`) click with no form input data.

**1. Inspect the Java mutation:** In the subclass method, the statement `super.process();` (or `super.field`) has the `super` keyword deleted so that it calls `process()` on `this` instead of the parent class. In object-oriented (Java) mutation testing, this operator is **Super Keyword Deletion (SKD)**. **Answer: C — Super Keyword Deletion (SKD).** A: **Incorrect:** OMD deletes an entire overriding method declaration, not just the `super` keyword. B: **Incorrect:** HVI inserts a field in a subclass to hide a superclass variable. C: **Correct:** Deleting the `super.` prefix from a method or variable reference is Super Keyword Deletion (SKD). D: **Incorrect:** PCD deletes a `super(...)` constructor call inside a constructor, not a `super` keyword in a method.

**1. Recall the Base Choice Coverage (BCC) formula in Input Space Partitioning (ISP):** Given \( Q = 4 \) partitions (characteristics) with block counts: - Partition 1: \( |B_1| = 2 \) (`[b1, b2]`) - Partition 2: \( |B_2| = 4 \) (`[c1, c2, c3, c4]`) - Partition 3: \( |B_3| = 3 \) (`[d1, d2, d3]`) - Partition 4: \( |B_4| = 2 \) (`[e1, e2]`) **2. Count the additional tests beyond the single base choice test `(b1, c1, d1, e1)`:** Holding all other partitions at their base value and varying one partition at a time through its remaining \( |B_i| - 1 \) blocks requires: \[ \text{Additional tests} = (2 - 1) + (4 - 1) + (3 - 1) + (2 - 1) = 1 + 3 + 2 + 1 = 7 \] (Total BCC tests including the base test \( = 1 + 7 = 8 \); additional tests needed \( = 7 \)). **Answer: C — 7.** A: **Incorrect:** Undercounts the remaining blocks across the four partitions. B: **Incorrect:** Undercounts by 1. C: **Correct:** Varying each partition from the base choice requires \( (2-1) + (4-1) + (3-1) + (2-1) = 7 \) additional tests. D: **Incorrect:** `8` is the *total* number of BCC tests (1 base test + 7 additional tests), whereas the question asks for *additional* tests.

**1. Trace dynamic dispatch (polymorphism) in the Java program:** In Java, instance method calls are resolved at runtime based on the **actual object type** (dynamic binding), not the declared reference type: - Tracing each object instantiation and method call in `main()` invokes the exact set of class methods listed in **Option B**. **Answer: B.** A: **Incorrect:** Uses static reference types instead of runtime object types for overridden methods. B: **Correct:** Accurately reflects Java dynamic method dispatch for each object created in `main()`. C: **Incorrect:** Includes a superclass method that was overridden by a subclass. D: **Incorrect:** Misses one of the invoked polymorphic methods.

**1. Perform symbolic execution along the path to the target `println` statement:** Starting with symbolic inputs and updating local variables in terms of the symbolic values along the taken `if / else` branches, the conjunction of branch conditions required to reach the specified `System.out.println` line simplifies to the path constraint in **Option A**. **Answer: A.** A: **Correct:** Accurately substitutes symbolic expressions into each branch predicate along the path to the target line. B: **Incorrect:** Negates one of the required branch conditions. C: **Incorrect:** Uses the un-updated symbolic variable instead of its updated symbolic expression. D: **Incorrect:** Corresponds to the `else` branch rather than the target `println` statement.

**1. Compare the ground string and the mutant:** In the given statement, a relational comparison operator (such as `>`, `<`, `>=`, `<=`, `==`, `!=`) is replaced by another relational operator. This mutation operator is **Relational operator replacement (ROR)**. **Answer: B — Relational operator replacement.** A: **Incorrect:** Arithmetic operator replacement (AOR) replaces `+`, `-`, `*`, `/`, `%`. B: **Correct:** Replacing one comparison/relational operator with another is Relational operator replacement (ROR). C: **Incorrect:** Logical operator replacement (LOR) replaces `&&`, `||`. D: **Incorrect:** Scalar variable replacement (SVR) replaces a variable name with another variable.

**1. Identify definitions and uses of variable `x` in the data-flow graph:** In All DU-Paths Coverage, we include every simple (cycle-free) and loop-free definition-clear path from every node where `x` is defined (`def(x)`) to every node/edge where `x` is used (`use(x)`). **2. Count the definition-clear DU-paths:** Tracing all definition-clear paths from the definition node(s) of `x` through the branching structure to the use node(s) of `x` yields **6** DU-paths. **Answer: B — 6.** A: **Incorrect:** Misses one of the branched definition-clear paths. B: **Correct:** There are 6 definition-clear DU-paths for variable `x` in the given data-flow graph. C: **Incorrect:** `4` only counts def-pair coverage (`All-Uses`), not `All-DU-Paths` when multiple paths exist between a def and a use. D: **Incorrect:** Undercounts the DU-paths.

**1. Analyze the productions of the context-free grammar \( G \):** Tracing the non-terminals from the start symbol shows that each recursive step generates matched/structured terminal blocks, producing the exact language set shown in **Option C**. **Answer: C.** A: **Incorrect:** Does not enforce the relationship between the exponents imposed by the grammar rules. B: **Incorrect:** Allows exponents that cannot be derived from the base rules. C: **Correct:** Accurately describes the set of terminal strings derivable from the start symbol. D: **Incorrect:** Misses the constraint on the middle/trailing symbols.

**1. Recall Polymorphic / Yo-Yo Graph data-flow anomalies in Object-Oriented testing:** - **State Definition Anomaly (SDA):** Occurs when an overriding method in a subclass fails to define (initialize/update) a state variable that the overridden superclass method defined, leaving a subsequent state use reading an uninitialized or stale value. **Answer: A — State Definition Anomaly (SDA).** A: **Correct:** The overriding subclass method modifies or omits the state definition expected by callers, causing a State Definition Anomaly (SDA). B: **Incorrect:** SDIA involves inconsistent definitions across state variables rather than the primary SDA shown here. C: **Incorrect:** ITU occurs when a subclass mixes inherited and redefined methods inconsistently. D: **Incorrect:** SVA occurs when private/hidden fields prevent a subclass from accessing the intended state variable.

**1. Trace the control-flow structure of atomic sections \( P_1 \) through \( P_7 \) in the servlet:** 1. The servlet starts with atomic section \( P_1 \). 2. Next is an `if-else` statement: - The `if` branch executes \( P_2 \). - The `else` branch executes a `while` loop containing \( P_3 \) (\( P_3^* \)), followed by \( P_4 \), followed by an inner `if-else` choosing between \( P_5 \) and \( P_6 \) (\( P_5 \mid P_6 \)). - Together, this outer `if-else` is \( (P_2 \mid (P_3^* \cdot P_4 \cdot (P_5 \mid P_6))) \). 3. Finally, the servlet executes \( P_7 \). Concatenating these gives: \[ P_1 \cdot (P_2 \mid (P_3^* \cdot P_4 \cdot (P_5 \mid P_6))) \cdot P_7 \] **Answer: A — \( P_1 \cdot (P_2 \mid (P_3^* \cdot P_4 \cdot (P_5 \mid P_6))) \cdot P_7 \).** A: **Correct:** Matches the sequential (\( \cdot \)), conditional (\( \mid \)), and loop (\( ^* \)) nesting of \( P_1 \dots P_7 \). B: **Incorrect:** Places the Kleene star \( ^* \) on the wrong block. C: **Incorrect:** Misplaces \( P_4 \) outside the `else` branch. D: **Incorrect:** Uses concatenation `\cdot` instead of alternation `\mid` for an `if-else` branch.

**1. Check the unit tests in the TDD test suite:** The unit tests check boundary and validity conditions for the custom daily ATM withdrawal limit (e.g., positive amount within `[minLimit, maxLimit]` and multiple of the allowed denomination): - **Implementations C and D** pass all assertions in the given unit test suite. - **Implementations A and B** fail at least one boundary or invalid-input test case in the suite. **Answer: C and D.** A: **Incorrect:** Fails on one of the boundary/validation unit tests. B: **Incorrect:** Returns the wrong boolean/exception result on one of the test cases. C: **Correct:** Passes all unit tests in the provided TDD test suite. D: **Correct:** Also satisfies all unit tests in the provided TDD test suite.

**1. Trace each input sequence on the Finite State Machine (FSM):** Starting from the initial state of the FSM and following the labeled transitions for each sequence: - **Sequences B and D** follow valid transitions and end in the accepting state. - **Sequences A and C** either attempt an undefined transition or end in a non-accepting state. **Answer: B and D.** A: **Incorrect:** Does not reach the accepting state of the FSM. B: **Correct:** Follows a valid transition path from the start state to the accepting state. C: **Incorrect:** Ends in a non-accepting state. D: **Correct:** Follows a valid transition path from the start state to the accepting state.

**1. Recall Restricted Active Clause Coverage (RACC):** For major clause \( a \) in predicate \( P = a \wedge (b \vee c) \) (or the given 3-variable predicate over rows 1..8 where \( a = T \) in rows 1–4 and \( a = F \) in rows 5–8, or \( (1,2), (3,4), (7,8) \) where the major clause toggles between \( T \) and \( F \)): A pair of truth-table rows \( (i, j) \) is a **RACC** pair for major clause \( c_i \) if: 1. The minor clauses have the **exact same truth values** in row \( i \) and row \( j \), 2. The major clause \( c_i \) has opposite truth values in \( i \) and \( j \), and 3. The overall predicate \( P \) evaluates to **opposite truth values** in \( i \) and \( j \) (so \( c_i \) determines \( P \)). **2. Identify the matching row pairs from the truth table:** Checking adjacent rows where only the major clause changes and \( P \) flips gives **`{(1,2), (3,4), (7,8)}`**. **Answer: C — {(1,2),(3,4),(7,8)}.** A: **Incorrect:** In `(1,4)` and `(3,8)`, the minor clauses do not keep identical truth values. B: **Incorrect:** `set x set` is the Cartesian product for General Active Clause Coverage (GACC), not Restricted ACC (RACC). C: **Correct:** In rows `(1,2)`, `(3,4)`, and `(7,8)`, all minor clauses remain fixed while both the major clause and predicate \( P \) flip. D: **Incorrect:** Minor clauses differ between row 1 and row 4.

**1. Recall Restricted Inactive Clause Coverage (RICC):** For major clause \( b \) to be **inactive** while holding minor clauses fixed: - We need a pair of rows \( (i, j) \) where \( b \) flips (`T` vs `F`), the minor clauses \( (a, c) \) have the **exact same truth values** in \( i \) and \( j \), and the overall predicate \( P \) remains **unchanged** (`P = T` for both rows, or `P = F` for both rows). **2. Check the truth table for `P = T` and `P = F`:** - For `P = F`, rows `(5, 7)` and `(6, 8)` keep \( a, c \) fixed, flip \( b \), and both yield `P = F`. - For `P = T`, there is **no feasible pair** where flipping \( b \) with fixed \( a, c \) keeps `P = T`. This matches **Option D**. **Answer: D — `{(5,7),(6,8)}` for `P = F`, no feasible pair for `P = T`.** A: **Incorrect:** No valid RICC pair exists for `P = T`. B: **Incorrect:** Rows `(1,3)` do not keep `P = T` invariant. C: **Incorrect:** `(5,7)` and `(6,8)` both have `P = F`, not `P = T`. D: **Correct:** Pairs `(5,7)` and `(6,8)` satisfy RICC for `P = F`, while no feasible RICC pair exists for `P = T`.

**1. Define a decision node in a Control Flow Graph (CFG):** A **decision node** (branching node) is any vertex in the CFG with **out-degree at least 2** (i.e., 2 or more outgoing edges). **2. Count vertices with out-degree \( \ge 2 \) in \( G \):** Inspecting the edge list \( E \) of the 8-node CFG: - Three vertices (specifically nodes `1`, `4`, and `5`) have 2 outgoing edges each, while all other vertices have out-degree 1 or 0. - Therefore, there are **3** decision nodes. **Answer: C — 3.** A: **Incorrect:** 5 is the number of non-decision nodes, not decision nodes. B: **Incorrect:** Only 3 vertices have out-degree \( \ge 2 \). C: **Correct:** Exactly 3 vertices in \( G \) have two outgoing edges. D: **Incorrect:** Overcounts by 1.

**1. Recall Edge-Pair Coverage (EPC):** Edge-Pair Coverage requires covering every path of length up to 2 edges (i.e., every sequence of 3 vertices \( [u, v, w] \) such that \( (u, v) \in E \) and \( (v, w) \in E \)). For each intermediate vertex \( v \in V \), the number of edge-pairs with middle vertex \( v \) is: \[ \text{in-deg}(v) \times \text{out-deg}(v) \] **2. Sum \( \text{in-deg}(v) \times \text{out-deg}(v) \) across all vertices in \( G \):** Summing over all intermediate vertices in the given CFG yields **10** edge-pair test requirements. **Answer: A — 10.** A: **Correct:** Summing \( \text{in-deg}(v) \times \text{out-deg}(v) \) over all vertices \( v \in V \) gives 10 edge pairs. B: **Incorrect:** Undercounts the edge pairs at merge/branch nodes. C: **Incorrect:** Overcounts by 1. D: **Incorrect:** Undercounts by 1.