My experiences as SANS facilitator

At the BruCon conference in October 2016 I had an interesting conversation at the SANS stand. Their collection of security trainings was impressive, but unfortunately outside of my budget. However, they did mention there is something like the Work-Study program.

So I applied for the SANS Brussels Winter conference in December. End of December I got an email back that I was selected for the Work-Study program!

For a fraction of the price you get the complete training, 2 preparation exams, the real exam, online training(OnDemand) and audio files of the training. This is really nice.

What you have to do for this nice price?

  • Arrive a day early around 9 am to setup the rooms and network, prepare network, distribute trainingmaterial, etc.
    A lot of work, but I didn’t mind it.
  • Arrive early during the training to prepare the room, help participants and help the trainer.
  • During breaks attend to the classroom to see that nobody who isn’t on the list enters, help the trainer if necessary, fix urgent issues if there are any (usually there weren’t any issues).
  • In the evenings help out a bit. This is usually not much work so normally you can still enjoy the sessions.
  • Probably the last evening, you have to set up a network for the lab session at the last day. This is usually done in 2 hours.
  • At the last training day, tear down the networks, pack up all microphones, network gear, extension cords, training materials, greet each other and go home.
    The last training day usually stops around 15:00, so you might still be home in time to spend the evening with your family (if you don’t have to travel too far).

So what do you get out of it, next to the training itself and certification?

  • A very busy week, but with lots of good talks, good friendships and good contacts in the business.
  • Introduction into the SANS organization.

For me these advantages were all very valuable to me, so after getting my GIAC Certified Inciden Handler (GICH) certificate following the SEC504 training, I decided to apply again to the Work-Study program. With success because now I can facilitate the FOR508 at SANS Secure Europe in Amsterdam and ICS410 at Munich Summer 2017. Two very interesting trainings that will really help to further advance my security career!

Gherkin Tips & Tricks

A few months ago, I was selected to give a presentation at the Testnet ‘voorjaarsevenement’. My talk was about Gherkin and how to improve your Feature files and step definitions.  It’s time to put it on the blog.

Instead of writing an introduction to Gherkin, it’s better to point you to the Cucumber wiki. They have a very good explanation of it. So let’s move on to the tips & tricks!

Feature file tips

  • Avoid long descriptions
    Features should have a short and sensible title and description. This improves readability and you do want readable and understandable Feature files, don’t you? So there should be one sentence describing the scope and content.
  • Choose a single fomat
    I don’t care if you pick “As a [role], I want [feature] so that [benefit]”  or “In order to [benefit], as a [role] I want [feature]”. However, pick one and stick with it. Again, this improves the readability. And never forget the benefit, this makes it easier to decide on the business value.
  • Features… not big portions of the application
    There should only be one Feature per file and the Feature should be reflected in the file name. If you work in larger teams, it is easier to work parallel on smaller Feature files.
  • Domain language
    Involve the customers and use their domain language. Involve them in writing the user stories or at least have them review them. Keep the language consistent accross all Features (and even projects).
  • Organization
    Organize your Features and Scenarios with the same discipline like you would organize code. You can organize them according to execution time: fast (<1/10s), slow (<1s) or glacial (>1s).  Or put them in separate subdirectories. Or tag them.

Background tips

  • Use Backgrounds
    To avoid repetitions in the feature file, Backgrounds are ideal. However, since the user has to keep the Background in mind while reading or writing the Scenarios, keep them short. Max. 4 lines.
  • Don’t include technical stuff
    The Feature file is about the user. Starting or stopping the webserver, clearing tables, etc can be implemented in the Step Definitions. it shouldn’t be mentioned in the background.
    Of course, don’t use a Background if you have only one Scenario.
  • Don’t mix
    Don’t mix backgrounds in the Feature file with @before hooks in the Step Definitions. This will drive you nuts when debugging.

Scenario tips

  • Scenario vs Scenario Outline
    In fact it is very simple: if you have only one example, use a Scenario.
    If you have more than one example, use a Scenario Outline and a table
  • Short
    Keep your scenarios short.
    Hide the implementation details.
  • Declarative steps over imperative steps
    Using declarative steps is much more concise and about WHAT the user wants to do with the system, not HOW the user wants to do it.
    Declarative example:
    Given I have logged on to the system
    Then I should see my new messages
    Imperative example:
    Give I am on the login page
    When I fill in the username
    And I fill in the password
    And I click on the ‘Submit’ button
    Then I should be logged on to the system
    And I should see my new messages

Step tips

  • AND/OR are keywords
    so don’t use them within a step
    Given I’m on the homepage and logged on
    Should be
    Given I’m on the homepage
    And I’m logged on
  • Cover happy and non-happy paths
    Testing is more than only proving it works. It’s trying to break the system.
  • Refactor
    Your library of steps will increase in time, so try to generalize your steps to increase reuse.
    You understanding of the domain will increase also, so update your language and the steps.

Tag Tips

  • Never tag the background
    Tags allow you to organize your Features and Scenarios. You can have multiple Tags per Feature or Scenario, so never tag the Background.
  • Don’t tag Scenario with same Tag as Feature
    Feature Tags are also valid for all child Scenarios, so there is no need to apply the same Tag to the Scenarios.
  • What is the benefit of Tagging a Feature
    You can Tag individual Scenarios, so think about what value would be added by Tagging an entire Feature.  There may not be much use for it. Except perhaps Tagging the Feature with the story number.
  • Tag categories
    Possible tag categories may be
    Frequency of execution: @checkin, @hourly, @daily, @nightly
    Dependencies: @local, @database, @fixtures, @proxy
    Level: @acceptance, @smoke, @sanity
    Environment: @integration, @test, @stage, @live
    Some groups also Tag according to progress: @wip, @todo, @implemented, @blocked.
    I’m not saying this is bad, if you do, make sure you keep the tags up-to-date! If you can’t do that, don’t use them.

Step Definition Tips

Most of the tips below will increase the reuse of your Step Definitions and the readability of the Feature files.

  • Use flexible pluralization
    Add a ? after the pluralized word:
    Then /^the users? should receive an email$/ do
    Now it will match both user and users
  • Use non-capturing groups
    Instead of (some text), use (?:some text). Now the result is not captures and not passed as an argument to your step definition.
    It is especially useful in combination with alternation:
    When /^(?I|they) create a profile%/
    or
    And /^once the files? (?:have|has) finished processing*/ do
  • Consolidate Step definitions
    When /^the file is (not)? present$/ do |negate|
        negate ? check_if_file_is_not_present : check_if_file_is_present
    end
  • Use unanchored regular expressions
    Normally you anchor start with ^ and end with $. Sometimes it might be useful to omit one:
    Then /^wait (\d+) seconds/ do |seconds|
        sleep(seconds.to_i)
    end
    This will allow for more flexible expressive steps:
    Then wait 2 seconds for the calculation to finish
    Then wait 5 seconds while the document is converted
    Of course this can be dangerous, so I think you can only do this for this example 😉
  • Be DRY
    Don’t Repeat Yourself.
    Refactor when necessary and reuse Step Definitions within a project across Features and perhaps even across projects.
  • Parse date/time in a natural way
    For most programming languages there are libraries that allow you to parse dates and times in a more natural way. For example in Ruby you have Chronic and in Python you can use parsedatetime or pyparsing.

So there we have it: quite a few tips to improve your Gherkin Feature files, Backgrounds and Step Definitions.

However, most important tip I can give you is to exercise discipline when writing your test automation code:

  • treat your code as production code
  • refactor when necessary
  • run your tests as often as possible
  • and don’t be too smart: somebody needs to understand next year. And that person might even be you.

For your benefit I have included my presentation and the checklists I created.

Making a Breakout game with Scratch

Lately I’ve been involved with CoderDojo. It’s real fun to challenge children to be creative with code. A tool we start with is Scratch. Now, if you have programmed in ‘real’ programming languages, you may think Scratch is only for children, but it really isn’t. It’s quite powerful!

Especially for creating games it is much easier to quickly create simple games in it than it would be in Python/PyGame for example. In this post I’ll show you how you can create a simple Breakout clone.

If you don’t know Breakout yet, you can read up on it on Wikipedia. In essence it works like this:

In the game, a layer of bricks lines the top third of the screen. A ball travels across the screen, bouncing off the top and side walls of the screen. When a brick is hit, the ball bounces away and the brick is destroyed. The player loses a turn when the ball touches the bottom of the screen. To prevent this from happening, the player has a movable paddle to bounce the ball upward, keeping it in play.

So, to start open Scratch, right click the Cat scratch, delete it and paint new sprite. Create a nice round colored circle (shift helps to make it round instead of oval):

Next step is to make the ball move. You can do this by changing the X and Y coordinates. I’ll always put initialization code immediately after “when flag clicked”. This way I’m always sure where my sprite is located, if it visible, etc.

Ball_move

If you run it, you’ll see that the ball goes to the edge of the screen and then moves along the edge to one corner. It should bounce of course!

Scratch has a very simple mechanism to achieve this: <touching color>. To use this, we create a Stage with corners. At the top and bottom I put a black line. At the bottom I put dark grey lines. You can create this in another program or by selecting Stage, then tab Backdrops, and draw a black line, select it, enlarge it, and move it to top. Copy it and move the copy to bottom. Repeat with grey line for left and right, like this:

Stage

Now it is just a matter of using <touching color> to detect which edge we hit. If we hit the top/bottom edge, we should reverse the Y direction. If we hit left/right edge, we should reverse the X direction, like this:

Ball_collision

Next: the paddle. Create a new sprite and draw the paddle. Add code to move it left and right:

Paddle

We still have an issue that the ball doesn’t bounce of the paddle. Unless you made the paddle the same color as the edges of the Stage. Hey, good idea, let’s do that:Paddle

If you run this on your computer, you might notice that the paddle lags a bit. This is a Windows issue. To solve this, search in Control Panel for keyboard and change the Repeat delay:

Keyboard

Now it should start moving quicker.

Ball moves, ball bounces on all sides and on the paddle. But wait, the ball should NOT bounce on the bottom border! So change the bottom border to red for example. An here is an ideal moment to introduce another very useful block of scratch: Broadcast.

With it you can give a signal to other sprite (or your own sprite) that something happened. Very handy to let everything stop for example. Or just to clean up your scripts.

Bal_killed

To keep score, I add a variable Score. And to increase the score we need to remove the blocks on the top of the screen. So that’s for the next post…

The Scratch file up to this point: Breakout1

 

Online newspapers

Everybody knows newspapers don’t have it easy with the Internet. Lots of content is free available, people don’t want to pay and if you publish something interesting, it is immediately copied.

I’ve been reading everyday on the sites of several newspapers. What you notice is that several newspapers have almost identical articles. Well, I thought, what do you expect? They are under the umbrella of the same publisher and they can’t spend much money on content they deliver for free.

So some time ago we bought a subscription for a newspaper in print. I thought this would give me lots more background information, more thought provoking editorials etc. However, I came away quite dissatisfied. Lots of sport articles, football especially, which doesn’t interest me one bit.

Maybe it’s better online? Well, no. Taking a free article of the New York Times and placing it even without translation behind your paywall will not persuade me to pay for access. And this is from a self proclaimed “Quality newspaper”!

So, the solution?  I don’t have it. They way I see the quality of newspaper declining, I  don’t think they will have much future at the current quality level. I do think people will pay for quality content, but then you absolutely have to make sure it is quality content.

 

 

Decoding mp3 files with a right click

Recently I made a very good deal on a used NI Maschine Mk1.

maschine-mk1-2

It is a nifty musical device, includes lots of drum kits and allows me to quickly make some nice tracks (or better: musical snippets).  It’s lots of fun!

Another part of Maschine is that it really simplifies sampling, like this guy demonstrates:

Lots of people take old vinyl records and record a sample through a Numark record player.  I don’t have a Numark and I don’t have vinyl records. But I do have lots of CD’s ripped to mp3 files. Unfortunately Maschine doesn’t support mp3 files, only wav files.

How to convert them?

  • Of course there is Audacity and it even allows batch conversion, but it still is a too much work: open Audacity, open files, batch convert, close Audacity, …
  • I’ve tried looking for programs that would allow me to right click the file in Windows Explorer and convert it. They are available, often install add/malware, but no free programs or they are way to heavy.

Solution: Lame. Next to encoding files, it can also decode them with the –decode option.

Adding that command to the context menu can be done with NirSoft FileTypesMan. (check out the other tools at NirSoft!) Open FileTypesMan, search for mp3, Add new action ‘DecodeToWAV’. For the command-line, browse to the directory where you put lame.exe and add ‘ –decode’. That’s it!

Right click samples in Explorer, select DecodeToWAV and moments later you have a .wav version in the same directory. Couldn’t be simpler.

Never delete requirements in ALM with the DEL key

Suppose you want to delete the link of a requirement to a testcase.

In ALM you then go to the testcase, select tab Requirements Coverage, select the requirement and delete that link, yes?

This is true, but do not delete the link with the Delete button on your keyboard, because ALM will be so kind to delete the complete testcase, no the link!
You really have to use the icon in the tab menu.

Quality Center and BPT testing experiences

At my current customer we are working extensively with Business Process Testing (BPT) in Quality Center 10, and now recently ALM 11.52.

As you may know, BPT is an implementation of keyword-driven test automation.  The idea of BPT (or keyword-driven testing) is very nice:

  • test analyst can define Business Components (BC’s) (or keywords)
  • test engineer can implement these BC’s
  • test analyst can use the BC’s in test cases

BPTThe benefits can be big:

  • Nice separation between test analyst and test engineer.  It can be difficult to find a test analyst who can also write test code, or a test engineer who is willing to learn the business processes.
  • Test ‘scripts’ become more readable in keyword form.

HP has several documents and articles on BPT:

Unfortunately, we have two issues: 1) BPT in Quality Center is badly implemented, and 2) our usage of BPT is also badly implemented.

1) BPT in Quality Center is badly implemented

  • The editor doesn’t allow copy/past within a BPT test. This has been a problem in QC10, it still is a problem in ALM11.52 and apparently it is now possible to open a BPT test in UFT.  Guess what: it is not possible to open 2 BPT testcases in one UFT session, therefore it still is not possible to copy several steps between BPT testcases.  It is also not possible to copy a few BC calls several times in a test case; the BC has to be imported every time.  Very frustrating!
  • The editor isn’t flexible.  In QC10 the editor displayed the BC’s in a grid like manner: each row is a call to a BC, the columns were the names of the BC’s, status, input parameters, output parameters, …
    BPT_QC10As you can see, if BC’s have several parameters, they are all listed. This means only a few BC’s fit on the screen.  The user has lost the overview of the test case.
    Retrieving all the values of the parameters made this view also very slow.
    In ALM11.52 the editor changed: in grid view:
    BPT_ALM11_gridYes, it loads faster now and the test has the overview of the complete test case. However, what HP giveth, HP taketh away also: parameters are now not as easily visible: an extra screen has to be opened.  And you know HP: never remember the settings for a window! So every time you have to resize the window and columns.
  • The editor doesn’t allow to comment BPT test or flow steps. This makes it difficult to read the test case when editing it, but also the test report becomes less readable. For the last effect, we have made a “Add_comment” BC that gives info in the test report.  However in ALM11.52 the parameter is not visible in the BPT editor. Other solution is to group a few steps and you can rename the group to a more meaningfull name.  Grouping adds another extra click to retrieve the parameters of the BC’s in the group.  And the group name doesn’t come back in the test report…
  • BPT has a disastrous effect on our QLM performance.  In QC10 we had to turn of version control because we have so many BPT tests.  A few months ago we updated to ALM11.52 with version control turned on.  After a week, we had to turn off version control again due to performance reasons.

There are several more issues with BPT/ALM, but these are the most important ones for us.

2) Our usage of BPT is badly implemented

  • We have too detailed BC’s.  Our BC’s should be on the level of “CreateDepartureFlight with these parameters”.  However, they are on the level of “Goto_Tab”, “Open FlightEditor”, “Edit Flight”, “Save flight” with several steps in between.  This has several consequences:
    • Test cases become unreadable because there is too much detail in them. Since ALM11.52 doesn’t show the parameters anymore it is difficult to see what exactly the test case does.
    • Test execution becomes very slow. In QC10 this was even worse, in ALM11.52 HP introduced the BPTWrapperTest.  This speeds up the test execution (or at least the starting of the test). Sometimes you might want to disable it.
    • BC code becomes less maintainable, since each BC is implemented in a separate .vbs file. Now we are moving to an architecture where multiple BC’s are implemented in one .vbs file and the BC files only make calls to those files.

All these issues compounded lead to an almost unworkable, instable test automation ‘solution’.  Time to search for something else…

Sharing your limited hotel wifi network

Sometimes you stay at a hotel and they provide you with a free or paid Wifi connection. However, it is limited to only one device. And there you stand with your phone (data is too expensive since you are roaming), tablet (perhaps only Wifi available) and laptop…

No worry, open source to the rescue!

Step 1: Buy a DD-WRT compatible router.

For example a TP-Link TL-WR841N for something like 20 euros. If you already have a router, but you are not sure if it is DD-WRT compatible, look it up in their database.

Step 2: Install DD-WRT

Find the correct download files.  For the TP Link you can find them at their site.
Next steps are:
-Make a cabled connection between your laptop/pc and the router. Disable wireless on your laptop.
– Plug in the router and turn it on
– Get a new IP address on your laptop. Open a command prompt on your laptop and enter:
ipconfig /release
ipconfig /renew
– Point your webbrowser to http://192.168.0.1
– Go to system tools – firmware upgrade. Select factory-to-ddwrt.bin and upgrade. When done, reboot the router.
– Get a new IP address on your laptop. Open a command prompt on your laptop and enter:
ipconfig /release
ipconfig /renew

– Now point your webbrowser to http://192.168.1.1 (note the change)
– Set a new password
– Navigate to administration, firmware upgrade. Log in again if needed. Click browse. Select tl-wr841nd-webflash.bin. Click upgrade and reboot when done.
Congratulations, your router is now running DD-WRT!

Step 3: Configure your DD-WRT router to share the Wifi connection

The goal is to have the router log on to the hotel network with the settings they gave you and create a virtual interface to create a new wireless network for your devices.

Based on the default configuration, change following settings:

Wireless tab, Wireless Physical Interface:
Wireless mode:client, save
Wireless Network Name: [SSID of the hotel network], save

Wireless tab, Virtual Interfaces: (you may need to add a virtual interface)
Wireless Mode: AP
Wireless Network Name: MyNetwork
Wireless SSID Broadcast: enable, save

Wireless tab, Wireless security:
Physical Interface [SSID of the hotel Wifi]: [password of the hotel network] and save
Virtual Interfaces [MyNetwork]: WPA2 personal, AES
WPA Shared Key: [enter here the password you want for MyNetwork], save

Setup tab, Basic Setup:
WAN Connection Type: Automatic – DHCP, save

Network Address Server Settings: DHCP Server:
DHCP Server: enable, save
DNSMasq for DHCP, DNSMasq for DNS, DHCP-Authoritative: all yes, save
NTP client enable, UTC+1 (for ttraff daemon), save

Setup tab, Advanced routing:
Operating Mode: gateway, save

Services tab:
DNSMasq: enable
Local DNS: disable
NO DNS rebind: enable
ttraff daemon: enable, save

Security tab:
disable all checkmarks, save
SPI firewall: disable, save

Administration tab:
Reboot Router

Since the MyNetwork wireless network will only be available when the router can connect to the hotel network, you have to bring a network cable to connect your laptop to the router.  If you change hotel, connect the laptop with the cable (refresh the IP) and change the SSID and password of the ath0 interface. Your settings for MyNetwork can stay the same.

It might also happen that you need to fill in a name and a password on a webpage. Once when my laptop was connected via the router, the forwarding to that login page didn’t work. Connect your laptop directly to the hotel Wifi network and see to which page it is forwarded. DO NOT FILL IN THE PASSWORD, but copy the URL.
Now connect your laptop back to the router MyNetwork and paste the URL for the login page and log in.  All devices should now be able to use the hotel network.

Running a batch file from Windows Task Scheduler

For the test automation on my current assignment, we had to run a batch file every day. So of course, we used the Windows Task Scheduler.

It’s very easy to create a task and to schedule it every day around 22:00.  Unfortunately, after checking the next day we noticed it had started on time, but didn’t execute the batch correctly.  So we turned to Google, and found lots of people with the same problem: on TechNet, StackOverflow and others.

I tried all of the following suggestions from Technet:

  1. Make sure that the task is set to “configure for Windows Vista or Windows 2008” on the first page of the task properties (under the “general” tab)

  2. Make sure that the task is set to “start in” the folder that contains the batch file: open the task properties, click on the “actions” tab, click on the action and then the “edit” button at the bottom.  In the “Edit Action” Window there is a field for “start in (optional)” that you set to the path to the batch file.

  3. Make sure that the task is running as an account that has explicit “Full access” permissions to all these things:  The .bat file itself,  the folder containing the .bat file, and the target files/folders that are affected by the .bat script.  Inherited permissions didn’t seem to work for me.

  4. Make sure that the account running the task is a member of the local “administrators” group for this machine

  5. Make sure that the task is set to “run whether logged on or not”

  6. The Task should run successfully with expected output when you right-click on the task and select “run”  If it does that then it will run successfully when you are logged off.

  7. Tick the box “Run with highest privileges”.

Still no success.  Until I found the suggestion that the name of the batch file should be limited to 15 characters.  Did that and success!!

It’s a pity that an OS released in 2009 and Service Packed in 2011 (Windows 7), still has issues with longer filenames. I do remember being told in 1995 that we could use filenames with up to 255 characters.  Apparantly there is still some older code underneath.

 

Studying for Professional Scrum Master exam

Agile and certifications, is this a good match?  Usually agile supporters are proud to not be certified.

I don’t know, but at least several founders of Scrum seem to think it is. You have 2 big Scrum certification organisations:

  • Scrum Alliance, who have the Certified Scrum certifications (Master, Product Owner, Developer, Professional, Coach and Trainer).
    ScrumAlliancePath
  • Scrum.org, who have the Professional Scrum certifications (Masters, Developers and Product Owners). Scrum.org has 2 levels for almost each type, so there is a Professional Scrum Master I and II. (PSM I, PSM II). Likewise there is a PSPO I and II.  Only Professional Scrum Developer only has one level at the moment: PSD I.

What is the difference between the 2 organisations?  Well, I’m not involved in either of them, so I only know what I found out on the internet.  Time for some gossip: Scrum Alliance started first around 2002, but by 2009 Ken Schwaber had become extreme dissatisfied in it: the organisation he helped create was more interested in and dependant on the money coming in than in the mission.  So he founded Scrum.org. A longer description of this history is available (albeit a bit hidden) on the Scrum.org website.

The certifications of the Scrum Alliance do seem to go further. Especially the Scrum Coach and Trainer are not easy.  It is not just taking an exam, but demonstrate over 1500 hours of Scrum coaching with real client references.  So if you see a Certified Scrum Coach, you know that the customers were indeed satisfied with the word delivered. These certifications however are beyond my experience at the moment, so let’s focus on the Certified Scrum Master and Professional Scrum Master.

What is the difference between these certificates? Well, again, I only took the Professional Scrum Master assessment, so I know absolutely nothing about the Certified Scrum Master certificate.  However, I do know that it is possible to take the PSM assessment without having to follow a training, while this isn’t the case for the CSM. So that was one of my reasons for taking PSM I.  That both Ken Schwaber and Jeff Sutherland are involved in Scrum.org seems to be another plus.

So, how to prepare for the assessment?

  • First step is to read the Scrum Guide. Don’t let the number of pages, 16,  fool you.  There is really a lot in it. But it is the basis for the assessment.  Everything that is assessed, is in this document! Although I must say I got a few extra questions on burndown charts for example. So do not only read it, but study it carefully. You should not only know that something is done or not, but also why, understand Scrum!
    Even though I had followed the Certified Agile Tester training (and give it also), I still found new things in it.
  • Learn more about Scrum best practices not described in the Scrum Guide. Not necessary for the assessment, but it helps to better understand why certain choices were made.
  • Try to gather some experience. More difficult since not every project is an Agile project, not every Agile project is a Scrum project and many ‘Scrum’ projects are ScrumBut projects. A ScrumBut project is of course not a good preparation for the assessment.
  • Take the Scrum Open Assessment.  These are only 30 questions (the assessment is 80 questions),  but there is a larger pool, so if you take it several times, you get a few more questions. Before you take the real assessment, you should get consistently at least 29 on the Open Assessment with time to spare. For extra insight it is useful to  take the Developer Open Assessment also several times. You need a Scrum.org account to be able to take the Open Assessments.
    I noticed several questions from the Open Assessment coming back in the real assessment.
  • Follow the suggested readings list for Scrum Master on Scrum.org. There are many good books available.  All of these can give you extra insights.

Then the assessment itself, is it difficult?

Not so much, I scored 95%. If you know Scrum and understand it, achieving the required 85% should be quite easy to do. I needed 25 minutes to go through all 80 questions. So that left me plenty of time to go back to the bookmarked questions.  Some needed indeed some adjustment, but in the end I could finish easily in time.

So, does this prove I am now a good Scrum Master?

Of course not, no multiple choice exam can prove that. Just like ISTQB Foundation doesn’t prove that you are a good tester.  It only proves that you know the terminology, some techniques, have an understanding of risks, etc.  Prove that you are a good tester? That can only be done on the job.

Likewise, this certificate does prove that I know Scrum. And perhaps also that I can apply it. Doing this on a real project, with real people/organizational/time issues and constraints, that’s the next challenge!