40 questions with answers for candidates with 7 years of experience — 17 medium, 23 hard.
What interviewers expect: 7 years experience
Expect discussions about test strategy across multiple teams, choosing and introducing tools, building automation frameworks with the right balance of manual testing, and representing quality in release decisions. Interviewers often ask about Advanced level knowledge, stakeholder management, budgeting effort and leading distributed teams. Be prepared to explain how you balanced speed, cost and quality on a large programme, and how you built a strong testing culture.
This set is weighted towards Defect and Configuration Management (9), Managing the Test Activities (7), Black-Box Test Techniques (6), Fundamentals of Testing (4).
Test strategy Tool selection and rollout Stakeholder management Distributed team leadership
Solved at this levelStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
Calculate a three-point estimate where optimistic is 6, most likely is 9 and pessimistic is 18 person-days.
I would log these as anomalies in a review because they are not testable. I would ask stakeholders for measurable criteria, for example 'search results appear within 2 seconds for 95 percent of requests at 1,000 concurrent users' and 'a new user completes registration in under three minutes without help'. Testable requirements make test design, acceptance and sign-off objective and prevent disputes later.
Test analysis answers 'what to test': it analyses the test basis, identifies testable features, defines and prioritises test conditions, and evaluates the test basis for defects. Test design answers 'how to test': it turns test conditions into test cases, identifies coverage items, defines test data requirements and designs the test environment. Example: the condition 'login with a locked account' becomes, in design, a case with exact inputs and the expected error message.
04
Describe how you improved the defect management process in a team.
Situation: defects stayed open for weeks and reports were often incomplete. Task: speed up resolution. Action: I introduced a defect template, clear status rules, a twice-weekly triage meeting and a dashboard of defect age and re-open rate. I trained testers on writing reproducible reports. Result: average resolution time fell by about 40 percent, and developers stopped returning reports for missing information.
05
Prepare a fault attack list for a file upload feature.
List likely failures and design tests for each: empty file; file just above the size limit; very large file; wrong extension; correct extension with wrong content; file names with spaces, Unicode or very long names; duplicate names; upload interrupted by network loss; many uploads at once; malicious files such as scripts; and uploads without login or with an expired session. Prioritise by risk.
06
On a safety-critical medical project, developers want to do all testing themselves to save time. How do you advise?
For safety-critical products, regulations and risk usually demand higher independence. I would keep developer component testing and static analysis, but recommend that system and acceptance testing be done by an independent test team, possibly with external assessors for certification. I would explain the benefits: a fresh perspective, fewer shared assumptions and objective evidence for regulators, while keeping close communication to avoid isolation and delays.
07
Management expects automation to replace all manual testers within six months. How do you respond?
I would explain the risks of unrealistic expectations. Automation is excellent for stable, repetitive regression checks, but exploratory, usability and new-feature testing still need human judgment. Introducing a tool also needs time for framework design, training and maintenance. I would propose a phased plan: automate a high-value smoke and regression set first, measure the benefits, and redeploy testers to higher-value testing.
08
Which test estimation techniques are described in CTFL v4.0?
Estimation based on ratios uses historical figures, such as a development-to-test effort ratio. Extrapolation uses measurements from the current project, for example averaging the last three iterations. Wideband Delphi is an expert-based technique where experts estimate separately and iterate until consensus; Planning Poker is an Agile variant. Three-point estimation uses optimistic, most likely and pessimistic values to calculate a weighted estimate and its standard deviation.
09
What happens in test monitoring, test control and test completion?
Test monitoring gathers information about testing to check progress and whether exit criteria are met, using metrics like test case progress, defect counts, coverage and cost. Test control uses that information to give guidance and corrective actions, such as reprioritising tests or changing the schedule. Test completion collects data from finished activities to consolidate experience, testware and other information, usually at milestones like release or end of iteration.
10
Describe a time you led a test team through conflicting priorities.
Situation: two product owners wanted their features tested first in the same sprint. Task: decide fairly and keep the team focused. Action: I brought both to a short meeting, scored the features by business risk and release dates, and agreed a shared order with the delivery manager. I shared the plan with the team and tracked it daily. Result: both features shipped, and the risk-based method became our default.
11
Why does 100 percent branch coverage guarantee 100 percent statement coverage, but not the other way round?
Every statement lies on at least one branch, so exercising all branches executes all statements. The reverse fails when a decision has an empty outcome. Example: 'if x > 10: print(big)' followed by 'print(done)'. One test with x = 15 runs every statement, giving 100 percent statement coverage, but the false branch is never taken, so branch coverage is only 50 percent. This is called subsumption.
12
Exit criteria are not met, but the business wants to release tomorrow. What do you do?
Testers provide information; the release decision belongs to stakeholders. I would prepare a short report showing which criteria are not met, open defects by severity, untested areas and the resulting risks, with possible mitigations such as feature flags, hotfix readiness or limited rollout. If stakeholders accept the risk, I would record the decision and the residual risks in the completion report.
13
Production defects increased over the last three releases. How do you analyse and act?
I would categorise escaped defects by module, root cause and the test level that should have found them, and calculate defect detection percentage per release. Typical findings are missing regression coverage, unclear requirements or environment differences. Actions might include requirement reviews, adding regression tests for each escaped defect, improving test data and environment parity, and tracking the trend to confirm improvement.
14
The requirements are incomplete and release is in two days. How do you test?
I would use session-based exploratory testing. I would write short charters for the riskiest areas, agree priorities with the product owner, run time-boxed sessions, note defects and questions, and debrief after each session. I would add error guessing for common failure types and a quick checklist for critical flows, and report clearly which areas were covered and which risks remain.
15
A decision table has three Boolean conditions. If condition A is false, the result is always 'reject'. How many columns does the minimised table have?
A full table has 2 to the power 3 = 8 columns. When A is false, the other two conditions do not matter, so those four columns merge into one column with dashes for B and C. When A is true, the four combinations of B and C remain. The minimised table has 4 + 1 = 5 columns, so 5 tests give full coverage, if all columns are feasible.
16
How is configuration management handled in a DevOps environment?
In DevOps, configuration management is largely automated within the CI/CD pipeline. Source code, test scripts, pipeline definitions and infrastructure as code are all in version control. Each build gets a unique version, artefacts are stored in a repository, and environments are created from versioned templates. This makes test results reproducible and lets teams trace exactly which code, tests and configuration produced a given result.
17
Testers spent a day testing the wrong build version. How do you prevent this?
This is a configuration management failure. I would ensure every build has a unique version shown in the application and in the release notes, that deployments to test environments are automated and logged, and that test runs record the build version tested. Entry criteria should include confirming the build version. A deployment notification in the team channel also helps everyone stay aligned.
18
Which review type would you choose for safety-critical requirements, and why?
I would choose an inspection: a formal process with a trained moderator, defined roles, checklists, mandatory preparation, entry and exit criteria and collected metrics. Its aim is to find as many anomalies as possible and to provide documented evidence for audits. For a quick internal design idea, a walkthrough or informal review is enough, because the higher cost of inspection is justified only by high risk.
19
What are the coverage criteria for state transition testing?
All states coverage requires every state to be visited. Valid transitions coverage, also called 0-switch coverage, requires every valid transition to be exercised. All transitions coverage requires every valid transition to be exercised and every invalid transition to be attempted, ideally one invalid transition per test to avoid fault masking. Full valid transitions coverage guarantees full all states coverage, and all transitions coverage is recommended for safety-critical software.
20
How do you run an effective defect triage meeting?
Invite the test lead, a development lead and the product owner. Prepare a filtered list of new and re-opened defects before the meeting. For each defect, confirm it is valid and not a duplicate, agree severity and priority, assign an owner and a target release, or reject or defer it with a reason. Keep it time-boxed, record decisions in the tool, and review ageing critical defects regularly.
21
Midway through the test cycle you are 30 percent behind schedule. What test control actions can you take?
I would analyse the cause first: unstable builds, late delivery or underestimated effort. Then take control actions: reprioritise tests by risk so critical areas run first, request extra testers or environments, automate repetitive checks, raise blocking defects with developers, and, if needed, agree with stakeholders on reduced scope or a revised date. I would report the impact and residual risks transparently.
22
A production hotfix must go live in three hours. How do you decide what to test?
I would do a quick impact analysis to see what the change touches, run confirmation tests for the defect, then a risk-based regression subset covering the changed module, its integrations and critical business flows like login and payment. I would use the automated smoke suite in the pipeline, record what was not covered, and plan fuller regression in the next regular release.
23
An amount field accepts 0.01 to 999.99 with two decimal places. What are the 2-value boundary values?
The closest neighbour depends on the precision, here 0.01. Lower boundary: 0.00 (invalid) and 0.01 (valid). Upper boundary: 999.99 (valid) and 1000.00 (invalid). So the four test values are 0.00, 0.01, 999.99 and 1000.00. Always confirm the precision from the specification, because with whole numbers the neighbour would be 1, and with three decimals it would be 0.001.
24
What makes an inspection different from other review types?
Inspection is the most formal review type. It follows the complete review process, uses defined roles and checklists, requires individual preparation, applies entry and exit criteria, and collects metrics such as anomalies found per page to improve both the development and inspection processes. The author cannot act as review leader or scribe. It suits safety-critical and high-risk work products, but it costs the most effort.
25
Your manager asks you to lower the severity of a defect to meet release targets. How do you respond?
Situation: before a release, my manager wanted a payment defect marked minor. Task: stay honest without creating conflict. Action: I explained the actual impact with data, how often it occurred and affected users, and suggested keeping severity accurate while lowering priority if the business accepted the risk, with a workaround documented. Result: the manager agreed, and the risk was recorded transparently.
26
What are the benefits and risks of DevOps for testing?
DevOps joins development and operations through a CI/CD pipeline. Benefits for testing: fast feedback on code quality, shift-left through automated component tests and static analysis on every commit, stable environments through automation, more visibility of non-functional qualities and less repetitive manual work. Risks: the pipeline must be defined and maintained, CI/CD tools must be set up, and automation needs extra resources. Manual testing from the user's perspective is still needed.
27
How do you use a state table to find invalid transitions?
A state table lists states as rows and events as columns, and each cell shows the resulting state or marks the transition as invalid. Example: a document workflow with states Draft, Review and Published, and events submit, approve and reject. Draft with approve is invalid. Valid cells are coverage items for valid transitions coverage; invalid cells are tested for all transitions coverage, one per test case.
28
Explain defect density and defect detection percentage.
Defect density is the number of defects per unit of size, such as per thousand lines of code or per function point. It helps find defect clusters and compare components. Defect detection percentage (DDP) is defects found by testing divided by all defects found, including those found after release, times 100. A falling DDP means more defects are escaping, which signals weaker test effectiveness.
29
What are false positives and false negatives in testing?
A false positive is a test result that reports a defect when none exists, for example a test failing because of wrong test data or an unstable environment. A false negative is a test that passes even though a defect is present, so the defect is missed. False positives waste time and reduce trust in tests; false negatives are more dangerous because defects escape to production.
30
Discount depends on customer type (regular, gold, platinum) and whether the order exceeds 1,000 rupees. How many rules does the full decision table have?
When conditions are not Boolean, multiply the number of values of each condition. Customer type has 3 values and the order condition has 2, so the full table has 3 x 2 = 6 rules. Each rule becomes one test case for 100 percent decision table coverage. If, for example, platinum always gets the same discount regardless of amount, those two columns can be merged, giving 5.
31
Give an example of a high-severity low-priority defect and a low-severity high-priority defect.
High severity, low priority: the app crashes when exporting a report in a legacy format that almost nobody uses; the impact is severe but rarely triggered, so it can wait. Low severity, high priority: the company logo is misspelled on the home page before a major launch; functionality is unaffected, but brand impact makes it urgent. Severity reflects impact, priority reflects business urgency.
32
How do you use impact analysis to decide regression scope?
Identify changed items from commits and change requests; use traceability to find affected requirements, components and interfaces; check dependency maps and defect history; rank the affected areas by risk; select automated regression for broad coverage plus targeted manual tests for high-risk flows; and document what is excluded and why. Impact analysis can also help decide whether a risky change should be made at all.
33
How do you perform a simple root cause analysis on a production failure?
Collect the failure details and logs, reproduce the issue and identify the defect. Then ask 'why' repeatedly until you reach a process cause. Example: a wrong discount was shown; why? the code used an old rule; why? the requirement changed without notice; why? there was no change review step. Action: add change notifications and a review step. Fixing root causes prevents whole families of similar defects.
34
Tell me about a time you introduced a new tool to your team.
Situation: test cases lived in spreadsheets and traceability was poor. Task: introduce a test management tool. Action: I compared options with the team, ran a two-week pilot on one module, migrated priority test cases, built simple dashboards and ran short training sessions. Result: the team adopted it within a month, and release reports that took a day now took an hour.
The quadrants group test types by whether they are business-facing or technology-facing, and whether they support the team or critique the product. Q1 (technology, support): component and component integration tests, usually automated. Q2 (business, support): functional tests, examples, user story tests, prototypes. Q3 (business, critique): exploratory, usability and user acceptance testing. Q4 (technology, critique): smoke tests and non-functional tests except usability, such as performance and security.
36
What certification path can you follow after CTFL?
After CTFL you can take Advanced Level modules: Test Analyst, Technical Test Analyst and Test Management. Specialist modules include Test Automation Engineering, Performance Testing, Security Testing, Mobile Application Testing, Usability Testing and AI Testing, among others. Expert Level certifications follow for experienced professionals. Choose based on your role: automation engineers pick technical paths, while leads pick test management.
37
Why is traceability between the test basis and testware important?
Traceability links test basis items such as requirements, risks and user stories to test conditions, test cases, results and defects. It lets teams measure coverage, assess the impact of changes, support audits in regulated domains and report progress in business terms, for example 'requirement R12 has three passed tests and one open defect'. When a requirement changes, traceability shows exactly which tests must be updated or re-run.
38
Explain collaborative user story writing, the 3 Cs and INVEST.
User stories are written collaboratively by business, development and testing. The 3 Cs are Card (the medium describing the story), Conversation (how the story will be used, documented or verbal) and Confirmation (the acceptance criteria). A good story follows INVEST: Independent, Negotiable, Valuable, Estimable, Small and Testable. If stakeholders cannot say how to test a story, it is probably unclear or does not reflect real value.
39
An insurance premium depends on five Boolean conditions. The full decision table has 32 columns. How do you keep testing manageable?
First remove infeasible combinations, for example 'under 18' with 'retired'. Then minimise the table by merging columns where a condition has no effect on the action. Next, prioritise the remaining rules by risk and business value, testing high-impact rules first. I would also verify the rules with the business, since a large table often exposes contradictions or missing actions.
40
What triggers maintenance testing, and what decides its scope?
Maintenance testing covers changes to a system already in production. Triggers are modifications such as enhancements, corrective fixes or hotfixes; upgrades or migrations of the operational environment, including data migration; and retirement of an application, which may need archiving and restore tests. Scope depends on the risk of the change, the size of the existing system and the size of the change, with impact analysis guiding regression selection.
Frequently asked questions
What is asked in ISTQB interviews for 7 years of experience?
Expect discussions about test strategy across multiple teams, choosing and introducing tools, building automation frameworks with the right balance of manual testing, and representing quality in release decisions. Interviewers often ask about Advanced level knowledge, stakeholder management, budgeting effort and leading distributed teams. Be prepared to explain how you balanced speed, cost and quality on a large programme, and how you built a strong testing culture.
How many questions should I practise before a ISTQB interview?
Work through all 40 questions here, then the company-wise sets for the employers you are targeting. Quality matters more than count: be able to explain why each answer is right.
Which topics matter most for 7 years of experience?
Focus first on Test strategy, Tool selection and rollout, Stakeholder management, Distributed team leadership.