- What it is: the ISTQB Advanced Level Technical Test Analyst (CTAL-TTA) certification shows you master the technical side of testing: white-box techniques, static and dynamic analysis, non-functional characteristics, code and architecture reviews, and automation.
- Current version: v4.0 (released in 2021), also available in Spanish.
- Mandatory prerequisite: the ISTQB Foundation Level (CTFL) certification. The syllabus assumes general programming and system architecture knowledge.
- Exam: 45 multiple-choice questions, 78 possible points, pass mark 51 (65%), 120 minutes (150 in a non-native language).
- Content: 6 chapters and at least 20 hours of training; the biggest blocks are technical quality characteristics (345 min) and white-box techniques (300 min).
- Who it's for: technical testers, automation engineers, developers who test, performance or security engineers and QA in safety-critical systems.
If you're more comfortable reading code, digging through logs or setting up a load testing tool than writing business test cases, Technical Test Analyst is your Advanced Level certification. This guide covers every chapter of v4.0, the exam, how to prepare and the doors it opens.
The technical content is based on the official CTAL-TTA v4.0 syllabus and what ISTQB.org publishes. For the whole portfolio, prices in your currency and how the exam works, see our main ISTQB certification guide.
What CTAL-TTA is and where it sits in the ISTQB portfolio
The Certified Tester Advanced Level Technical Test Analyst (CTAL-TTA) is one of ISTQB's core Advanced Level certifications. It complements Test Analyst (CTAL-TA), which covers the functional and business side, and Test Management (CTAL-TM), which covers management.
A simple way to see it, straight from the syllabus: in risk analysis, the Technical Test Analyst contributes the likelihood of each technical product risk, while the Test Analyst contributes the business impact if the problem happens. One looks at the system from the inside; the other, from the user's side.
The current version: v4.0
v4.0 was released in 2021 and is still the current version on ISTQB.org. Compared with the 2019 version, the main changes are:
- Basis path testing was removed, along with call graphs.
- Data flow analysis was rewritten and raised to K3 (apply).
- The reliability and performance sections were rewritten.
- A section on operational profiles was added.
- The sections on selecting white-box techniques and MC/DC were rewritten, and control flow analysis now includes cyclomatic complexity.
Who it's for and prerequisites
CTAL-TTA is for you if you work, or want to work, in one of these roles:
- Technical tester or QA engineer testing APIs, services and components.
- Automation engineer who wants to understand the architecture decisions behind a framework.
- Developer doing unit and integration testing who wants to measure coverage wisely.
- Performance, security or reliability specialist who needs common ground with the rest of the team.
- QA in safety-critical systems (automotive, aerospace, healthcare, industrial) where standards mandate code coverage levels.
Official requirements
- Mandatory: the ISTQB Certified Tester Foundation Level certification.
- Practical experience: ISTQB.org asks for "sufficient practical experience" and refers you to the Member Board or exam provider for the specific criteria.
- Expected knowledge: the syllabus assumes basic experience with general programming concepts and system architectures. You don't need to be a developer, but you should read pseudocode comfortably.
- Accredited course: recommended, not required.
Don't have Foundation yet? Start with our ISTQB Foundation 4.0 course.
What you'll be able to do
The official CTAL-TTA overview document defines eight business outcomes. A certified Technical Test Analyst can:
| Code | Business outcome |
|---|---|
| TTA1 | Recognize and classify typical risks related to software performance, security, reliability, portability and maintainability. |
| TTA2 | Provide the technical detail to plan, design and run tests that mitigate those risks. |
| TTA3 | Select and apply suitable white-box techniques to reach the required confidence based on design coverage. |
| TTA4 | Take part in technical reviews with developers and architects, using knowledge of typical code and architecture defects. |
| TTA5 | Improve code and architecture quality using various analysis techniques. |
| TTA6 | Describe the costs and benefits of introducing specific types of test automation. |
| TTA7 | Select the right tools to automate technical testing tasks. |
| TTA8 | Understand the technical issues and concepts of applying test automation. |
The syllabus chapter by chapter
The syllabus has six examinable chapters. Accredited courses must provide at least 20 hours (1,200 minutes) of instruction:
| Chapter | Minimum time | Key topics |
|---|---|---|
| 1. The TTA's tasks in risk-based testing | 30 min | Identifying, assessing and mitigating technical risks |
| 2. White-box test techniques | 300 min | Statement, decision, MC/DC and multiple condition testing; API testing; selecting a technique (safety-related and non-safety-related systems) |
| 3. Static and dynamic analysis | 180 min | Control flow, cyclomatic complexity, data flow, maintainability, memory leaks, wild pointers, performance |
| 4. Quality characteristics for technical testing | 345 min | Non-functional planning, security, reliability, performance, maintainability, portability, compatibility, operational profiles |
| 5. Reviews | 165 min | Review preparation, architecture and code checklists |
| 6. Test tools and automation | 180 min | Automation projects, data-driven and keyword-driven approaches, fault seeding and fault injection, performance, web, MBT, build and mobile tools |
Chapter 1. The TTA's tasks in risk-based testing (30 min)
The shortest chapter, but it frames everything else. The TTA takes part in risk identification (expert interviews, brainstorming with developers, architects and operations), risk assessment (proposing the initial likelihood following the test manager's guidelines) and risk mitigation (designing and running tests for high-risk areas and evaluating residual risk).
The syllabus lists generic factors to consider. Product risks: technology and code complexity, amount of source code change, history of technical defects and interface or integration issues. Project risks: conflicts over technical requirements, distributed teams, tools and skills, time pressure and high change rates of technical requirements.
Chapter 2. White-box test techniques (300 min)
This is the most "mathematical" part of the exam. You need to design test cases (K3) to reach a defined coverage level with each technique:
- Statement testing: execute every executable statement. The syllabus treats full statement coverage as a desirable minimum for all tested code.
- Decision testing: exercise every outcome of every decision (true/false for an IF, each case of a CASE, entering and skipping a loop).
- MC/DC (Modified Condition/Decision Coverage): show that each atomic condition independently affects the decision outcome. With N independent conditions, N+1 executions are usually enough. For example, for
if (balance > 0 && active && !locked)you need at least 4 test cases, not all 8 combinations. - Multiple condition testing: test every combination of atomic condition values. The most thorough and the most expensive.
- API testing (K2): the syllabus treats it as a test type rather than a technique. It stresses negative testing, parameter combinations and testing recovery and retry mechanisms, because APIs are often loosely coupled and can lose transactions.
The chapter's K4 objective is selecting the right white-box technique for a situation. Two key ideas:
- White-box coverage should be specified at 100%: asking for 80% often leaves exactly the most complex, defect-prone code untested.
- In safety-related systems, the standard rules. The syllabus shows the IEC 61508 table: for SIL 1, statement, branch and MC/DC coverage are recommended; for SIL 4, all three are highly recommended. It also mentions ISO 26262 (automotive) and DO-178C (airborne software), each with different requirements.
If you work in automotive, also check Automotive Software Tester (CT-AuT).
Chapter 3. Static and dynamic analysis (180 min)
Static analysis (without running the code), with three K3 objectives:
- Control flow analysis: detect anomalies (badly designed loops, unreachable code, uncalled functions) and calculate cyclomatic complexity, an indicator of how many independent paths a component has. The higher it is, the stronger the case for refactoring.
- Data flow analysis: follow each variable's lifecycle (define, use, kill) and spot anomalous sequences: defining twice without use, using before defining, using after killing, or defining without releasing (a possible memory leak).
- Improving maintainability: check coding standards, find duplicated code, measure coupling (lower is better) and cohesion (higher is better), and review website structure.
Dynamic analysis (during execution), with one K3 objective: apply it for a specific goal, such as detecting memory leaks (which often surface only after hours in production), wild pointers (which may do nothing, corrupt data or crash the program) and analyzing performance efficiency.
Chapter 4. Quality characteristics for technical testing (345 min)
The longest chapter. It opens with non-functional test planning, home of another important K4: analyze the non-functional requirements of a scenario and write the corresponding test plan sections. You consider stakeholder requirements, test environments, tool acquisition and training, organizational issues and data protection.
Then it walks through the ISO 25010 characteristics, explaining why to include each test type and how to plan and specify it:
- Security: confidentiality, integrity, non-repudiation, accountability, authenticity.
- Reliability: maturity, availability, fault tolerance and recoverability, including reliability growth models.
- Performance: time behavior, resource utilization and capacity; load, stress and scalability testing.
- Maintainability: analyzability, modifiability, modularity, reusability and testability.
- Portability: installability, adaptability and replaceability.
- Compatibility: coexistence with other systems in the same environment.
- Operational profiles: usage patterns (how many users, which operations, how often) to generate realistic loads for reliability and performance testing.
Example: for a payments app about to launch a promotion, the operational profile defines 70% balance checks, 25% payments and 5% new card sign-ups; you use it to set up a load test at the expected volume and a stress test at three times that. To go deeper, see Performance Testing (CT-PT), Security Tester (CT-SEC) and our JMeter performance course.
Chapter 5. Reviews (165 min)
The TTA must take an active part in technical reviews and needs preparation time; without it, a review turns into copy editing. The two K4 objectives ask you to analyze an architectural design and a piece of code or pseudocode using a checklist from the syllabus:
- Architecture checklist (example for website time behavior): connection pooling, load balancing, distributed processing, caching, lazy instantiation, transaction concurrency, OLTP/OLAP process isolation and data replication.
- Code checklist: structure, documentation, variables, arithmetic operations, loops and branches, and defensive programming.
On the exam, this means questions where you read pseudocode and point out which checklist issues are present.
Chapter 6. Test tools and automation (180 min)
The syllabus insists that a test automation project is a software development project: it needs architecture, design, reviews and its own testing. Main topics:
- The TTA's tasks when defining an automation project: choosing the tool, defining interfaces with test management, defect management and CI tools, building adapters, choosing the approach, estimating with the test manager and planning maintenance.
- Data-driven vs. keyword-driven, and automating through the GUI, API or command line.
- Technical issues that kill ROI: not handling software failures during execution, or not returning the system to a known state after each test.
- Constructing keywords from a business process (K3): for example "Login", "Select_Order", "Cancel_Order", balancing detail against maintenance.
- Specific tools: fault seeding (inserting defects to gauge your tests), fault injection (forcing error conditions), performance, web testing, model-based testing, component testing and build, and simulators and emulators for mobile.
To put this into practice, check our Playwright, API Automation with Postman and mobile automation with Appium courses.
Download the official syllabus
Download the official CTAL-TTA v4.0 syllabus, the source of every exam question. A Spanish version is also available:
ISTQB.org also has the sample exam questions, release notes and the overview document with the business outcomes.
The CTAL-TTA v4.0 exam
| Feature | Details |
|---|---|
| Number of questions | 45, multiple choice |
| Possible points | 78 |
| Pass mark | 51 points (65%) |
| Duration | 120 minutes; 150 minutes (+25%) in a non-native language |
| Prerequisite | ISTQB Foundation Level certification |
| Validity | ISTQB certifications don't expire |
Source: the official CTAL-TTA page and the ISTQB exam structure tables.
The whole syllabus is examinable except the introduction and appendices. Questions can combine material from several sections. You don't need an accredited course to sit the exam.
Exam options
- Online with remote proctoring (iSQI FLEX): 24/7. For Advanced Level, book at least 48 hours ahead. You'll need a webcam, microphone, a second camera using your phone and a government-issued ID.
- Pearson VUE: at a test center or online with OnVUE.
- On-site at your company: for groups of 6 or more, Cool Testers brings a proctor.
Paper exams are no longer offered. The certification is equally valid in any language.
Where to buy it
- Directly at iSQI.org, our partner and official exam provider. If you enroll in one of our courses, we send you a 20% coupon off their list price for your first attempt.
- Through Cool Testers, with 1 or 2 attempts, if your company pays or you need an invoice. You have 1 year to take it.
See prices in your currency in our ISTQB certification guide.
How to prepare
- Review Foundation's white-box basics, then practice MC/DC until you can build the test pairs without hesitation. It's heavily tested and easy to train with exercises.
- Read pseudocode every day. Chapters 2, 3 and 5 ask you to calculate coverage and cyclomatic complexity, detect data flow anomalies and apply code checklists.
- Build summary tables for Chapter 4: for each characteristic (security, reliability, performance, maintainability, portability, compatibility), note sub-characteristics, why to test it, which defects it finds and when in the lifecycle.
- Practice the planning K4: take a real non-functional requirement from your project and write that section of the test plan.
- Take the official sample exam against the clock and study every rationale.
- Connect it to your job: measure your suite's coverage, run a static analysis or review a pull request with the syllabus checklist.
Benefits and career paths
- A bridge between QA and development: you speak the same language as developers and architects in code and design reviews.
- A base to specialize: performance, security, automation and safety-critical systems all build on what you learn here.
- Target roles: senior QA engineer, SDET, automation engineer, performance engineer, technical test analyst, QA for embedded or regulated systems.
- Automation judgment: you understand why automation projects fail and how to design them to pay off.
- International recognition, with no expiration.
Related certifications and next steps
| If you're interested in… | Next certification |
|---|---|
| Designing and maintaining automation solutions | Test Automation Engineering (CTAL-TAE) and Test Automation Strategy (CT-TAS) |
| The functional and business side | Test Analyst (CTAL-TA) |
| Leading and managing testing | Test Management (CTAL-TM) |
| Technical Agile (TDD, BDD, CI) | Agile Technical Tester (CTAL-ATT) |
| DevOps | Quality in DevOps (CT-QDO) |
| Performance | Performance Testing (CT-PT) |
| Security | Security Tester (CT-SEC) and Security Test Engineer (CT-STE) |
| Model-based testing | Model-Based Testing (CT-MBT) |
| AI | AI Testing (CT-AI) |
Frequently asked questions
Do I need to know how to code for Technical Test Analyst?
You don't need to be a developer, but the syllabus assumes general programming and system architecture knowledge. On the exam you'll read pseudocode, calculate coverage and spot problems in code snippets.
How many questions are on the CTAL-TTA exam and what's the pass mark?
It has 45 multiple-choice questions worth 78 points. You pass with 51 points (65%). It lasts 120 minutes, or 150 in a non-native language.
What do I need to take CTAL-TTA?
The ISTQB Certified Tester Foundation Level certification. ISTQB.org also mentions sufficient practical experience, with the specific criteria set by the Member Board or exam provider. An accredited course isn't required.
Should I choose Test Analyst or Technical Test Analyst?
It depends on your profile. If you work with the business, requirements and functional testing, choose Test Analyst. If you work with code, APIs, performance, security or automation, choose Technical Test Analyst. Many people end up doing both.
Is CTAL-TTA useful for test automation?
Yes. Chapter 6 covers defining an automation project, data-driven vs. keyword-driven approaches, technical causes of failure and specific tools. If automation is your main focus, add Test Automation Engineering (CTAL-TAE).
Does v4.0 include basis path testing?
No. Basis path testing was removed in v4.0. The examined white-box techniques are statement, decision, MC/DC and multiple condition testing, plus API testing.
Does the certification expire?
No. ISTQB Foundation and Advanced Level certifications don't expire.