To programs running on components in a distributed system, both network and component failures manifest as connection faults that are represented by exceptions. Although many strategies are available for handling connection faults, it is often necessary to compose multiple strategies in such programs, especially in Internet of Things systems and cyber-physical systems. Moreover, it should be possible to specify a program's connection fault handling behaviors prior to implementation. Having observed the lack of appropriate design-level constructs, we propose an extended AND/OR graph for modeling composite connection fault handling behaviors in programs. The extended AND/OR graph enables succinct representations of complex fault handling behaviors by composing the constituent strategies of retrying, communicating failure, and ignoring failure. Furthermore, we develop a model-based testing framework that accepts the extended AND/OR graph specification as input and generates tests for checking the connection fault handling behaviors of a program constructed from the specification. The proposed method is illustrated with a Java program to detect and report failure of a device. In particular, the AND/OR graph specification stipulates that the program handles connection faults covering network failures by composing retrying strategy. From this specification, tests are generated by finding all solution trees of the AND/OR graph subject to the number of retries to cover all the paths that lead to the program’s normal and exceptional exits, respectively. The extended AND/OR graph and the model-based testing framework contribute to the means for specifying and testing connection fault handling behaviors of programs that are crucial to the success of Internet of Things systems and cyber-physical systems.