Instructor only · Unlisted

Test lead answer key

All planted bugs across the 10 test lead practice pages.

← Test Lead hub · Learning

Practice 01 · Test strategy (open)

  1. Happy path only — no negative/boundary tests
  2. Testing in dev local env — not a shared test env
  3. Real production data used
  4. Entry criteria: 'developer says ready' — subjective
  5. Exit criteria: 'all test cases pass' — insufficient
  6. Risk section: 'None identified' — skipped

Practice 02 · Risk prioritisation (open)

  1. BUG-101 (2px misalignment) rated P1 — should be P4
  2. BUG-102 (Visa payment fails) rated P3 — should be P1
  3. BUG-103 (password reset broken) rated P3 — should be P1/P2
  4. BUG-105 (PII in logs) rated P3 — should be P1
  5. Correct 3 fixes: BUG-102, 103, 105

Practice 03 · Security surface (open)

  1. Reset token in URL — browser history exposure
  2. Plaintext password in failed login log — Critical
  3. Reset token in activity log
  4. Internal IP exposed in user-facing log
  5. Email uses type=text not type=email
  6. No rate limiting signal on reset form

Practice 04 · Data integrity (open)

  1. Scarf line total wrong: 2×$45=$90, shown $85
  2. Subtotal wrong (based on wrong line total)
  3. Discount $30 doesn't match 10% of any shown subtotal
  4. Total $244.35 not derivable from shown figures
  5. No GST line item for NZ order

Practice 05 · Performance (open)

  1. Checkout avg 4,200ms — unacceptable
  2. Checkout P95 12s — high abandonment risk
  3. Export P95 45s + 3.2% error rate
  4. Search P95 88ms < avg 95ms — impossible, data corrupt
  5. Conclusion says 'all within thresholds' — false

Practice 06 · API contract (open)

  1. 'id' renamed to 'user_id'
  2. 'name' renamed to 'full_name'
  3. Role case: 'editor' → 'EDITOR'
  4. Date field renamed + format changed to DD/MM/YYYY
  5. password_hash exposed in response — Critical
  6. active: boolean → integer

Practice 07 · Coverage gaps (open)

  1. REQ-5 (no login before confirmation) — no test case
  2. REQ-6 (lockout after 5 fails) — no test case
  3. REQ-4 (confirmation email sent) — no test case
  4. REQ-3 no negative case (7-char password)
  5. No edge cases: empty, invalid format, injection

Practice 08 · Defect triage (open)

  1. Title 'The app is broken' — not actionable
  2. Environment 'My computer' — not reproducible
  3. Steps not steps — no numbered specifics
  4. Critical severity unjustified with no evidence
  5. Assigned without triage — developer can't act

Practice 09 · Coaching (open)

  1. BUG-B (case-sensitive search) rated Low — should be High
  2. BUG-C (wrong page title) rated Critical — should be Low
  3. BUG-A no response time measurement
  4. Empty search assumed fine — not verified
  5. No edge cases: special chars, injection, long names

Practice 10 · Full audit (open)

  1. Email not required — High
  2. Experience max=10 blocks senior candidates — Medium
  3. 'Store indefinitely' — Privacy Act risk — High
  4. No file type restriction on CV upload — Medium
  5. Labels not associated to inputs — Medium a11y
  6. Submit outline:none no focus-visible — Medium a11y
  7. Phone uses type=text not type=tel — Low
  8. No submission confirmation or success state — High