White-Box, Experience and Collaboration-Based Testing Interview Questions for ISTQB

Statement testing designs tests that execute the executable statements in the code. Statement coverage = statements executed by the tests / total executable statements x 100. Reaching 100 percent means every executable statement ran at least once, so a defect in any statement may be triggered. However, it does not guarantee that all decision logic is tested, for example the false outcome of an if without an else.

Error guessing anticipates errors, defects and failures based on the tester's knowledge: how the application worked before, the types of mistakes developers tend to make, and failures seen in similar applications. A methodical form is the fault attack: list possible errors, defects and failures, then design tests to expose them. Examples include division by zero, empty inputs, very long strings, special characters and wrong date formats.

In exploratory testing, tests are designed, executed and evaluated at the same time while the tester learns about the test object. It is often structured as session-based testing with a time box, a test charter and a debrief. It is most useful when specifications are few or poor, under time pressure, or to complement formal techniques. Its success depends on the tester's experience, domain knowledge, curiosity and analytical skills.

In checklist-based testing, the tester designs and runs tests to cover the conditions on a checklist built from experience, user needs or knowledge of why software fails. Items should be specific and testable, not vague or automatable by tools. Checklists give some consistency and guidance when detailed test cases are missing, but they become less effective over time as developers learn to avoid those mistakes, so they must be updated regularly.

This is error guessing, an experience-based technique. The tester anticipates mistakes based on knowledge of similar applications, typical developer errors and past failures. When done methodically by listing possible errors and designing tests for each, it is called a fault attack. It is not checklist-based testing unless the tester works from a prepared checklist of conditions.

Situation: I joined a project two weeks before a release. Task: become productive quickly. Action: I read user stories and help pages, did short exploratory sessions on main flows, built a mind map of features, asked a senior tester for the riskiest areas and reviewed recent defects. Result: within a week I was executing regression tests independently and found two defects in the first sprint.

A branch is a transfer of control between two nodes in the control flow graph. Branches can be unconditional, like straight-line code, or conditional, like the true and false outcomes of an if or the cases of a switch. Branch coverage = branches exercised / total branches x 100. Branch testing designs tests so that every branch, including the hidden false path of an if without else, is exercised.

Every statement lies on at least one branch, so exercising all branches executes all statements. The reverse fails when a decision has an empty outcome. Example: 'if x > 10: print(big)' followed by 'print(done)'. One test with x = 15 runs every statement, giving 100 percent statement coverage, but the false branch is never taken, so branch coverage is only 50 percent. This is called subsumption.

White-box testing considers the whole implementation, so it can find defects even when the specification is vague, outdated or incomplete. Coverage gives an objective measure of thoroughness. It can also be used in static testing, for example dry runs of code or pseudocode. Its main weakness is that it cannot detect omissions: if a requirement was never implemented, no white-box test will notice it.

User stories are written collaboratively by business, development and testing. The 3 Cs are Card (the medium describing the story), Conversation (how the story will be used, documented or verbal) and Confirmation (the acceptance criteria). A good story follows INVEST: Independent, Negotiable, Valuable, Estimable, Small and Testable. If stakeholders cannot say how to test a story, it is probably unclear or does not reflect real value.

The two common formats are scenario-oriented, such as the Given/When/Then style used in BDD, and rule-oriented, such as a bullet-point verification list or a tabulated input-output mapping. Acceptance criteria define the scope of the story, reach consensus among stakeholders, describe positive and negative scenarios, serve as the basis for acceptance testing and support accurate planning and estimation. Teams can also use other formats as long as criteria are well defined and clear.

Charter: Explore the checkout page with different coupon and payment combinations to discover pricing and rounding errors. Time box: 60 minutes. Focus areas: coupon stacking, expired coupons, quantity changes after applying a coupon, currency rounding, and using the browser back button. Record test ideas, defects, questions and areas covered. Debrief with the test lead after the session to agree next charters.

Coverage shows which code was executed, not that the code is correct or complete. The defect may come from a missing requirement that was never coded, which white-box testing cannot detect; from specific data values not used in tests; from integration or environment issues; or from wrong expected results. Coverage is a useful measure of thoroughness, but it must be combined with black-box and experience-based techniques.

I would use session-based exploratory testing. I would write short charters for the riskiest areas, agree priorities with the product owner, run time-boxed sessions, note defects and questions, and debrief after each session. I would add error guessing for common failure types and a quick checklist for critical flows, and report clearly which areas were covered and which risks remain.

I would suggest a short three-amigos session with the product owner and a developer. Together we would turn the vague criterion into testable ones, for example 'searching by product name returns matching items sorted by relevance', 'no results shows a helpful message' and 'results load in under 2 seconds'. Writing them as Given/When/Then scenarios makes them clear and ready for ATDD.

A checklist of high-level conditions, such as validations, error messages, navigation and security basics, gives the new tester structure and consistency while learning the domain. Each run can vary slightly, which increases coverage. The risk is that checklists wear out as developers learn to avoid listed defects, so the team should update them with new defect patterns and pair the tester with an experienced colleague.

Situation: a ticket booking app had passed all scripted tests. Task: run a one-hour exploratory session on seat selection. Action: I tried quick double taps, switching networks and booking the same seat from two devices. Result: two users could book the same seat. I logged a detailed report with videos, it was fixed before release, and concurrency tests were added to the regression suite.

ATDD is a test-first approach. The team, including business, developers and testers, analyses the story and acceptance criteria in a specification workshop, then writes test cases before implementation. Positive tests come first, then negative tests and non-functional characteristics. Tests are written in a form stakeholders understand, cover every criterion without going beyond the story, and are often automated so they become executable requirements.

Statement coverage = 8 / 10 x 100 = 80 percent. Branch coverage = 3 / 4 x 100 = 75 percent. To raise them, look at the control flow graph to see which statements and which branch outcome were missed, then design inputs that force execution down those paths. Coverage tools in CI pipelines report these numbers automatically for each build.

List likely failures and design tests for each: empty file; file just above the size limit; very large file; wrong extension; correct extension with wrong content; file names with spaces, Unicode or very long names; duplicate names; upload interrupted by network loss; many uploads at once; malicious files such as scripts; and uploads without login or with an expired session. Prioritise by risk.

I would use black-box techniques: EP and BVA for amount limits, decision tables for rules such as daily limits and first-time payee checks, and state transitions for payment status from initiated to success, failed or pending. Developers would add white-box branch coverage in unit tests. I would add error guessing and exploratory sessions on network drops, duplicate taps and timeouts, prioritised by risk.

Situation: escaped defects kept coming from untested code paths. Task: improve unit testing without slowing the team. Action: I showed coverage reports linking low-coverage modules to production defects, proposed a gate of 80 percent branch coverage on new code only, and helped write the first tests. Result: within two months coverage on changed code rose sharply and escaped defects in those modules fell.