- CTFL (Certified Tester Foundation Level) is ISTQB's core certification and the most widely taken software testing certification in the world. The current version is 4.0.
- There are no prerequisites: you don't need experience, a degree or programming skills.
- The syllabus has 6 chapters and requires at least 1,135 minutes (18 h 55 min) of accredited training; the heaviest chapter is test techniques.
- The exam has 40 multiple-choice questions, lasts 60 minutes (75 if it is not your native language) and the pass mark is 26 correct answers (65%).
- The certification never expires and is required for almost every Advanced and Specialist certification.
- You can take it from home (iSQI FLEX or Pearson VUE OnVUE) or at a Pearson VUE test center.
- Prepare with our ISTQB Foundation Level 4.0 course: 40 live hours on Teams, a pre-recorded course, an Express review course and 4 practice exams.
If you are thinking about getting certified in software testing, someone has probably already told you to start with ISTQB Foundation. They are right. The ISTQB Certified Tester Foundation Level (CTFL) is the industry's common language: QA job postings in the US, Mexico, Latin America and Spain ask for it, consulting firms and banks use it as a filter, and it is the base of the entire ISTQB portfolio.
I have spent more than 17 years in testing and 10 years teaching ISTQB, and this is the guide I wish I had read before getting certified: what CTFL 4.0 is, who it is for, what the syllabus covers chapter by chapter (with examples), what the exam looks like, how to prepare and what comes next.
What CTFL is and where it sits in the ISTQB portfolio
ISTQB (International Software Testing Qualifications Board) is the non-profit organization behind the world's most widely used tester certification scheme. Its national member boards, such as ASTQB (United States), HASTQB (Hispanic America) and SSTQB (Spain), translate the syllabi and accredit training providers like Cool Testers.
The ISTQB portfolio is organized into three streams:
- Core: Foundation Level (CTFL) and the Advanced Level modules: Test Analyst, Technical Test Analyst, Test Management and Test Automation Engineering. Expert Level comes after that.
- Agile: certifications for agile teams, such as the Advanced Level Agile Tester (CTAL-AT) and Agile Test Leadership at Scale.
- Specialist: deep dives into a specific topic (AI, performance, security, mobile, DevOps, automotive, games and more).
CTFL sits at the base of everything. Version 4.0 was released in 2023 and replaced the 2018 version (3.1.1). It was a big change: it added agile and DevOps practices, the whole-team approach, shift-left, the test pyramid and testing quadrants, and collaborative approaches like ATDD. In English there is a minor revision, 4.0.1, that fixes details without changing learning objectives or scope.
For the full portfolio map and costs in your currency, see our ISTQB certification guide.
Who it is for and prerequisites
According to the syllabus, CTFL is aimed at anyone involved in software testing: testers, test analysts, test engineers, test consultants, test managers, user acceptance testers and software developers. It is also a good fit for anyone who needs a basic understanding of testing: project managers, quality managers, product owners, development managers, business analysts, IT directors and management consultants.
The profiles we see most in our groups are:
- People who want to break into QA from another career or from tech support.
- Experienced testers who never formalized what they do and need the certificate for a job or a promotion.
- Developers and business analysts who want to speak the same language as the QA team.
- Entire company teams (banks, consulting firms, software factories) standardizing their testing practice.
Prerequisites: none. There is no experience, degree or programming requirement. It does help to have seen a software project from the inside, even as a user.
What you will be able to do: business outcomes
The syllabus defines 14 business outcomes: what a Foundation-certified person can bring to their organization.
| Code | A CTFL-certified tester can... |
|---|---|
| FL-BO1 | Understand what testing is and why it is beneficial |
| FL-BO2 | Understand fundamental concepts of software testing |
| FL-BO3 | Identify the test approach and activities to implement depending on the context |
| FL-BO4 | Assess and improve the quality of documentation |
| FL-BO5 | Increase the effectiveness and efficiency of testing |
| FL-BO6 | Align the test process with the software development lifecycle |
| FL-BO7 | Understand test management principles |
| FL-BO8 | Write and communicate clear and understandable defect reports |
| FL-BO9 | Understand the factors that influence testing priorities and effort |
| FL-BO10 | Work as part of a cross-functional team |
| FL-BO11 | Know the risks and benefits of test automation |
| FL-BO12 | Identify essential skills required for testing |
| FL-BO13 | Understand the impact of risk on testing |
| FL-BO14 | Effectively report on test progress and quality |
Learning objectives are classified into three cognitive levels: K1 (remember), K2 (understand) and K3 (apply). In addition, every keyword listed at the start of a chapter is examinable at K1, even if no learning objective mentions it. Keep the ISTQB glossary handy while you study.
Syllabus content chapter by chapter
These are the six examinable chapters with the minimum training time the syllabus sets for an accredited course:
| Chapter | Minimum time | Key topics |
|---|---|---|
| 1. Fundamentals of Testing | 180 min | Test objectives, testing vs. debugging, error/defect/failure/root cause, 7 principles, activities and roles, skills, independence |
| 2. Testing Throughout the SDLC | 130 min | SDLC models, TDD/ATDD/BDD, DevOps, shift-left, retrospectives, test levels and types, regression, maintenance |
| 3. Static Testing | 80 min | Value of static testing, review process, roles, review types, success factors |
| 4. Test Analysis and Design | 390 min | Equivalence partitioning, boundary values, decision tables, state transitions, statement and branch coverage, exploratory testing, user stories, ATDD |
| 5. Managing the Test Activities | 335 min | Test plan, entry and exit criteria, estimation, prioritization, pyramid, quadrants, risk, metrics, reports, configuration, defects |
| 6. Test Tools | 20 min | Tool types, benefits and risks of test automation |
Notice the proportions: chapters 4 and 5 account for more than 60% of the time and most of the K3 exam questions. That is where you pass or fail.
Chapter 1. Fundamentals of Testing
The first chapter defines what testing is. A key idea: testing is not just running software. It includes static activities (reviewing requirements, code or designs) and dynamic ones (executing the system), and covers both verification (did we build it right?) and validation (did we build the right thing?).
Concepts you need to master:
- Testing vs. debugging: testing finds failures or defects; debugging locates, analyzes and fixes them, usually done by the developer.
- Error, defect, failure and root cause: a person makes an error (mistake), which introduces a defect in code or a document; when executed, the defect may cause a visible failure. The root cause is the underlying reason for the error (time pressure, an ambiguous requirement, lack of training).
- Testing and quality assurance: testing is quality control (product-oriented, corrective); quality assurance is process-oriented and preventive.
Then come the seven testing principles, which show up in almost every exam:
- Testing shows the presence, not the absence, of defects.
- Exhaustive testing is impossible.
- Early testing saves time and money.
- Defects cluster together.
- Tests wear out.
- Testing is context dependent.
- Absence-of-defects fallacy: a system with no known defects may still not meet user needs.
The chapter describes the test activities: planning, monitoring and control, analysis (what to test: test conditions), design (how to test: test cases), implementation (testware, data and environment), execution and completion. It also covers the testware each activity produces, the value of traceability between the test basis and testware, and two roles: the test management role and the testing role.
It closes with generic testing skills (domain knowledge, critical thinking, communication, curiosity), the whole-team approach (quality is everyone's job) and the pros and cons of independence of testing: an independent tester finds different defects than the author, but may become isolated from the team.
Chapter 2. Testing Throughout the Software Development Lifecycle
This chapter connects testing with how software is built. Whether it is waterfall, the V-model, iterative or agile, some good practices are universal: every development activity has a corresponding test activity, each test level has specific objectives, test analysis and design start during the corresponding development activity, and testers review drafts as early as possible.
It explains three approaches where testing drives development: TDD (unit test first, then code), ATDD (tests derived from acceptance criteria before development) and BDD (behavior expressed in natural language with Given/When/Then).
It also covers DevOps (continuous integration and delivery, fast feedback, more automation), the shift-left approach (reviewing requirements, writing tests before code, static analysis in the pipeline) and retrospectives as an improvement mechanism.
The second half defines the test levels: component, component integration, system, system integration and acceptance; and the test types: functional, non-functional (based on the ISO/IEC 25010 quality characteristics such as performance efficiency, usability, security or reliability), black-box and white-box. A common point of confusion: any test type can be performed at any test level.
It ends with the difference between confirmation testing (checking that a defect was fixed) and regression testing (checking that the change did not break anything else), and with maintenance testing, triggered by modifications, migrations or retirement of a system.
Chapter 3. Static Testing
Static testing evaluates work products without executing them: requirements, user stories, designs, code, test plans, contracts. It can be done through reviews (people) or static analysis (tools). Its big value is finding defects early, when they are cheapest to fix, and detecting problems dynamic testing cannot see, such as ambiguous requirements, unreachable code or deviations from standards.
The syllabus describes the review process: planning, review initiation, individual review, communication and analysis, and fixing and reporting. It also defines the roles: manager, author, moderator (facilitator), scribe, reviewer and review leader.
And the review types, from least to most formal: informal review, walkthrough (led by the author), technical review (technical peers aiming for consensus) and inspection (the most formal, with a defined process and metrics). A typical exam question gives you a scenario and asks you to choose the right review type.
A practical example: before a sprint, the team reviews the story "As a customer I want to pay by card." The tester asks: which cards are accepted? What happens if the bank declines the charge? Is there a minimum amount? Those three questions are defects found without a single line of code.
Chapter 4. Test Analysis and Design
This is the most important chapter: 390 minutes of minimum training and 11 of the 40 exam questions, 5 of them K3 (exercises you have to solve). It groups techniques into three families: black-box (specification-based), white-box (structure-based) and experience-based.
Equivalence partitioning. You split data into partitions the system should treat the same way and test at least one value from each. Example: an age field accepts 18 to 65. Partitions: under 18 (invalid), 18 to 65 (valid) and over 65 (invalid). Three test cases give 100% partition coverage.
Boundary value analysis. Defects hide at the edges. In 2-value BVA you test each boundary and its closest neighbor in the adjacent partition: 17, 18, 65 and 66. In 3-value BVA you test the boundary and both neighbors: 17, 18, 19, 64, 65 and 66.
Decision table testing. Useful when the outcome depends on combinations of conditions. Example: a discount applies if the customer is a member and the purchase exceeds a certain amount. Two true/false conditions give four rules; each column is a test case. You also need to know how to minimize tables and spot infeasible combinations.
State transition testing. Models systems that change state in response to events, such as an order: created, paid, shipped, delivered, cancelled. The syllabus defines three coverage criteria: all states, valid transitions (0-switch coverage) and all transitions, including invalid ones.
White-box. Statement coverage measures the percentage of executable statements exercised; branch coverage, the percentage of branches exercised. 100% branch coverage guarantees 100% statement coverage, but not the other way around. In CTFL 4.0 these are K2 topics: you need to understand them, not calculate them.
Experience-based. Error guessing (including fault attacks), exploratory testing (designing, executing and learning at the same time, often in chartered sessions) and checklist-based testing.
The chapter ends with the collaboration-based approaches that are new in version 4.0: collaborative user story writing with the 3 Cs (card, conversation, confirmation) and INVEST, acceptance criteria in scenario-oriented (Given/When/Then) or rule-oriented formats, and ATDD as a K3 technique for deriving test cases.
Chapter 5. Managing the Test Activities
The second heaviest chapter (335 minutes, 9 questions, 3 of them K3). It covers the management side every tester needs, even if they are not a lead.
- Test plan: purpose and content (context, assumptions, scope, risks, approach, budget and schedule).
- Agile planning: how testers add value to release and iteration planning.
- Entry and exit criteria, which in agile map to the Definition of Ready and the Definition of Done.
- Estimation (K3): ratio-based, extrapolation, Wideband Delphi (including planning poker) and three-point estimation: E = (a + 4m + b) / 6. Example: optimistic 6 h, most likely 9 h, pessimistic 18 h gives E = (6 + 36 + 18) / 6 = 10 h.
- Test case prioritization (K3): risk-based, coverage-based or requirements-based, respecting dependencies.
- Test pyramid and testing quadrants (Q1 to Q4: technology- or business-facing, supporting the team or critiquing the product).
- Risk management: risk level = likelihood × impact; project risks (delays, staffing, suppliers) vs. product risks (software quality); and risk control: mitigation through testing, acceptance, transfer or a contingency plan.
- Monitoring, control and completion: metrics, progress and completion reports, and how to communicate status to each audience.
- Configuration management and defect management: what a good defect report contains (K3), such as ID, title, steps to reproduce, expected and actual results, severity, priority and environment.
Chapter 6. Test Tools
The shortest chapter (20 minutes, 2 questions). It classifies tools by what they support: management, static testing, design and implementation, execution and coverage, non-functional testing, DevOps, collaboration, and scalability and deployment standardization (virtual machines, containers). It lists the benefits of automation (less repetitive manual work, consistency, objective measurement, faster execution) and its risks (unrealistic expectations, underestimating maintenance, over-reliance on the tool, a vendor going out of business).
Download the official syllabus
The syllabus is the only source for the exam: every section is examinable except the introduction and the appendices. Read it end to end at least once.
The English version is the minor 4.0.1 revision; the Spanish version is the Programa de Estudio Nivel Básico v4.0 used by HASTQB and SSTQB. The examinable content is the same, and the certification is equally valid in any language.
The CTFL 4.0 exam
Verified structure
| Item | Value |
|---|---|
| Questions | 40 multiple-choice, 1 point each |
| Pass mark | 26 points (65%) |
| Duration | 60 minutes; 75 if you take it in a language that is not your native one (+25%) |
| Cognitive levels | 8 K1, 24 K2 and 8 K3 questions |
| Prerequisites | None |
| Validity | Lifetime |
Question distribution by chapter, according to ISTQB's official exam structure tables:
| Chapter | Questions | K1 | K2 | K3 |
|---|---|---|---|---|
| 1. Fundamentals | 8 | 2 | 6 | 0 |
| 2. SDLC | 6 | 2 | 4 | 0 |
| 3. Static testing | 4 | 2 | 2 | 0 |
| 4. Analysis and design | 11 | 0 | 6 | 5 |
| 5. Management | 9 | 1 | 5 | 3 |
| 6. Tools | 2 | 1 | 1 | 0 |
Exam options
- Online from home with remote proctoring (iSQI FLEX): available 24/7; for Foundation you can book as little as 2 hours ahead. You need a webcam, a microphone, a second camera using your phone and a government-issued ID.
- Pearson VUE: at a test center or online with OnVUE.
- On-site at your company: for groups of 6 or more, Cool Testers brings a proctor.
Paper-based exams are no longer offered. If you take the exam in a language that is not your native one, you get 25% extra time.
Where to buy it
The exam is not included in the course. You have two options:
- Directly from iSQI, our partner and official exam provider, with a 20% coupon off the price on their site for your first attempt, which we send when you enroll. This is the best option if you are paying yourself.
- Through Cool Testers: our certification exam with 1 or 2 attempts. A good fit if your company pays, you get reimbursed or you need an invoice. You have 1 year to take it.
How to prepare
6-week plan
| Week | What to study | Goal |
|---|---|---|
| 1 | Chapter 1 and glossary | Explain the 7 principles and error vs. defect vs. failure without notes |
| 2 | Chapters 2 and 3 | Tell test levels from test types; pick the right review type in a scenario |
| 3 | Chapter 4, black-box | Solve 20 partitioning, boundary value, decision table and state exercises |
| 4 | Rest of chapter 4 and chapter 6 | White-box, exploratory, user stories, ATDD; tools |
| 5 | Chapter 5 | Three-point estimation, prioritization, risk and defect reports |
| 6 | Mock exams | At least 3 full exams scoring 80% or more before booking |
Common mistakes
- Studying 2018 material. Many online mock exams are still CTFL 3.1: they include topics that were removed and miss the new ones.
- Answering from experience instead of the syllabus. The exam tests ISTQB terminology, even if your company calls things differently.
- Not practicing chapter 4 with pen and paper. K3 questions are solved, not memorized.
- Ignoring keywords. Any keyword can appear in a K1 question.
- Reading too fast. Words like NOT, BEST or MOST likely change the answer.
Our ISTQB Foundation Level 4.0 course
Our ISTQB Foundation Level 4.0 course is an accredited course with 40 live hours on Microsoft Teams on Saturdays, taught by Miguel Hernández. It also includes the pre-recorded course, a 6-hour Express review course and 4 practice exams. You keep the recordings for 3 years, and you can retake the course for free in any open group within the following 6 months.
In open groups you can pay in installments (50% today plus 3 biweekly payments, with a 10% financing fee), and two people enrolling together get 10% off. If you plan to continue with Agile Tester, Test Management or GenAI, ask about the bundle with 50% off the second course. Questions? Message us on WhatsApp.
Benefits and career paths
- Entry ticket to QA jobs: CTFL is the testing certification that appears most often in QA job postings, especially at consulting firms serving US and European projects.
- International recognition: the same certificate is recognized worldwide, regardless of the language you take the exam in.
- Common vocabulary: you speak the same language as testers, developers and leads in any company.
- Door to everything else: without CTFL you cannot take Advanced or most Specialist exams.
- For companies: a certified team works with a common, measurable process. We deliver the course for companies online or on-site; request a quote.
Typical roles after CTFL: QA tester or manual tester, test analyst, QA in agile teams, user acceptance tester and, adding programming skills, test automation engineer.
How it relates to other certifications and what comes next
CTFL is a prerequisite for almost the whole portfolio. Depending on your profile, the next step could be:
- Agile teams: Agile Tester (CTFL-AT), available in English until May 2027, or its successor, the Advanced Level Agile Tester (CTAL-AT v2.0).
- Leadership: Test Management (CTAL-TM), for people who plan, estimate and report on testing.
- Functional analysis: Test Analyst (CTAL-TA).
- Technical profile: Technical Test Analyst (CTAL-TTA) and Test Automation Engineering (CTAL-TAE).
- Artificial intelligence: Testing with Generative AI (CT-GenAI) and AI Testing (CT-AI).
Frequently asked questions
Do I need experience to take ISTQB Foundation?
No. CTFL has no experience, education or programming prerequisites. Anyone can take it.
How many questions does the CTFL 4.0 exam have and what is the pass mark?
40 multiple-choice questions worth 1 point each. You pass with 26 correct answers (65%). You have 60 minutes, or 75 if you are not taking it in your native language.
Does the CTFL certification expire?
No. The ISTQB Foundation Level certification is valid for life and does not need to be renewed.
If I hold CTFL 3.1, do I need to recertify on 4.0?
No. Your certificate is still valid and still counts as the prerequisite for higher levels. Some people update their knowledge with 4.0 because it adds agile and DevOps practices.
Can I take the exam in English or Spanish?
Yes, both are available. The certification is exactly as valid in either language. Some companies with US projects may prefer the English exam, but that is an employer preference, not a difference in the certification.
Can I take the exam from home?
Yes, online with remote proctoring (iSQI FLEX, 24/7) or with Pearson VUE OnVUE. You can also go to a Pearson VUE test center.
Is the exam included in the course?
No. You can buy it directly from iSQI with the 20% coupon we send when you enroll, or through Cool Testers if your company pays or you need an invoice.
How long does it take to prepare?
With an accredited course and steady practice, most people are ready in 4 to 8 weeks. The syllabus requires a minimum of almost 19 hours of training.