Software Testing Interview Questions for Experienced Professionals (₹10–12 LPA)

Sprint planning (estimate test effort), daily stand-up (status and blockers), sprint review (demo) and retrospective (improve). Testers clarify acceptance criteria early and test within the sprint.

Prioritising tests by the likelihood and impact of failure, so critical areas get the most coverage when time is limited.

A set of steps with inputs and expected results. Components: ID, title, preconditions, steps, test data, expected result, actual result and status.

Success, failure and pending flows, timeouts, refunds, double-click payments, every method (UPI, cards, net banking), rounding, security (no card data stored) and reconciliation with bank reports.

Valid keyword, partial match, no results, special characters, very long text, empty search, case sensitivity, spelling errors, suggestions and speed of results.

The hardware, software, data and configuration where testing happens, set up to mirror production as closely as practical.

The team selects stories for the sprint. QA helps estimate testing effort, clarifies acceptance criteria and flags dependencies and risks.

New → Assigned → Open → Fixed → Retest → Verified → Closed, with Reopened, Rejected, Deferred and Duplicate as side paths.

Keep tests modular, prioritise by risk, use exploratory testing, automate stable parts and keep close contact with product owners.

Use mocks or stubs from the API contract such as Swagger, write test cases early and validate again when the real service is available.

Valid login, invalid login, forgot password, locked account and session handling are the main scenarios to cover.

Severity = impact on the system. Priority = urgency to fix. Logo misspelt on the homepage → low severity, high priority. Crash in a rarely used report → high severity, low priority.

Check SQL injection, brute-force lockout, password masking, session timeout, HTTPS, cookie flags, error messages not revealing users and password reset flow.

An epic is a large body of work; stories are user-facing slices of it; tasks are technical work items; bugs are defects.

Shift left with early reviews, improve test design, automate regression, use better test data, add monitoring and learn from escaped defects.

Allowed and disallowed formats, size limits, empty file, duplicate names, special-character names, cancel upload, slow network and multiple files.

Break the work into modules and test cases, use past velocity or three-point estimation (optimistic, likely, pessimistic), add time for test data, environment issues, retesting and regression, and keep a risk buffer.

SDLC is the full software development life cycle; STLC is the testing life cycle: requirement analysis, test planning, test design, environment setup, execution and closure.

GET retrieves data and has parameters in the URL; POST sends data in the body to create or process something.

Valid card and PIN, wrong PIN, three failed attempts, amount above balance, amount above daily limit, invalid denomination, machine out of cash, network failure and receipt printing.

Testing that is continuous and collaborative within each sprint, with testers working alongside developers and product owners from the start.

Black box tests behaviour without code knowledge; white box tests internal logic and paths; grey box uses partial knowledge of the internals.

Designing tests from user flows described in use cases to verify complete real-world interactions.

Smoke tests run on every build for quick feedback; full regression runs less often, such as nightly or before release.

A human error causes a defect in the code, and when that defect is executed it produces a failure visible to users.

Verifying the application works across different hardware, software and settings combinations.

A bug is behaviour that deviates from agreed requirements; an enhancement is a new or improved capability beyond the current requirements.

Measuring speed and stability: load (expected users), stress (beyond limits), spike (sudden surge), endurance (long duration) and scalability testing.

A language to query databases. Testers use it to verify data saved by the application, prepare test data and check backend results.

Code is built and tested automatically on each change; tests are quality gates that stop faulty builds from moving forward.

Test on real devices and OS versions, interrupts such as calls, battery, network changes, gestures, permissions and app store guidelines.

Scope (in and out), objectives, approach, environments, schedule, roles, entry/exit criteria, risks and mitigation, deliverables and tools.

By business criticality, usage frequency, defect history, risk and dependencies, running high-priority cases first.

They let testers verify totals and counts per category, such as the number of orders per customer, and compare them with the UI or reports.

The extent of requirements or code exercised by tests. Measure requirement coverage with a traceability matrix and code coverage with tools.

A grid mapping requirements to test cases and defects, proving every requirement is tested.

Internationalisation tests that the product can support many languages and formats; localisation tests that a specific locale is correct for text, currency, date and layout.

Verification: are we building the product right? (reviews, walkthroughs — no code run). Validation: are we building the right product? (actual testing against user needs).

Finding why a defect was introduced, such as unclear requirements or missed reviews, to prevent similar defects in future.

Testing shows presence of defects, exhaustive testing is impossible, test early, defects cluster, the pesticide paradox, testing is context-dependent and absence-of-errors is a fallacy.

Re-testing existing features after a change. Automate stable, repetitive, high-value flows that run every release.

JIRA Query Language, used to search issues, for example project = ABC AND status = Open AND priority = High.

200 OK, 201 Created, 204 No Content, 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 500 Internal Server Error.

A shared checklist for when a story is complete, usually including code review, tests passing, no open critical bugs and documentation updated.

Functional testing checks what the system does (login, checkout). Non-functional testing checks how well it does it (performance, security, usability, compatibility).

Using experience to guess where defects likely hide, such as empty fields, special characters or unexpected sequences, and designing tests for them.

Test execution rate, pass percentage, defect density, defect leakage, defect rejection ratio, requirement coverage and automation coverage.

A defect that stops testing or release of a feature because no workaround exists, so it is highest priority.

Log and track bugs, link them to stories, build dashboards and filters with JQL, manage sprints and generate reports.

Unit, integration, system and acceptance testing, moving from individual components to the complete product in front of users.

A document defining scope, approach, resources, schedule, entry and exit criteria, risks and deliverables of testing.

Create a request with method, URL, headers and body, send it, check status and body, add test scripts and save it in a collection.

Rules such as NOT NULL, UNIQUE, PRIMARY KEY, FOREIGN KEY and CHECK that keep data valid and consistent.

Checking that people with disabilities can use the product, using screen readers, keyboard navigation, colour contrast and WCAG guidelines.

The observation that a small number of modules contain most defects, so testing should focus on those areas.

A scenario is a high-level thing to test (user logs in); test cases are the detailed steps and data that verify it.

Testing how a system moves between states based on events, for example an order going from placed to paid to shipped to delivered.

Smoke testing checks that the critical features of a new build work (broad and shallow). Sanity testing checks that a specific fix or area works after a change (narrow and deep).

Entry criteria are conditions that must be met to start testing (build ready, environment set); exit criteria define when testing can stop (pass rate, no critical defects).

For a field accepting 1–100: valid class 1–100 (test 50), invalid below 1 (test −5), invalid above 100 (test 150). One value represents each class.

Severity is impact on the system; priority is urgency of the fix. A crash in a rare report is high severity, low priority; a spelling mistake in the logo is low severity, high priority.

Learning, test design and execution at the same time, without scripted cases — time-boxed sessions with a charter (e.g. 'explore checkout with coupons'), noting bugs and ideas. Great for finding edge cases.

A model with many fast unit tests at the base, fewer API or integration tests in the middle and a small number of UI tests at the top.

Valid login, wrong password, empty fields, case sensitivity, max length, SQL-injection strings, password masking, 'remember me', lock-out after N attempts and the forgot-password link.

A team meeting at the end of a sprint to discuss what went well, what did not and what to improve next.

Re-check environment, data, browser and steps; check the logs; try the reporter's setup; add video and console logs; mark it 'cannot reproduce' only after discussing with the developer, and keep monitoring.

Mandatory fields, email format, password rules, duplicate email, terms checkbox, captcha, confirmation email and field length limits.

A regular review where QA, development and product assess new bugs and decide severity, priority, owner and target release.

A suite is a collection of related test cases; a run is one execution of a set of tests against a build.

State the problem, location and condition briefly, for example 'Checkout button disabled after applying a coupon on the cart page'.

INNER returns matching rows, LEFT keeps all left rows, RIGHT keeps all right rows and FULL keeps all rows from both tables.

Status code, response body and schema, headers, response time, error messages for invalid input, authentication (401/403) and that data is saved in the database.

Risk-based testing: cover critical user flows, recent changes and high-defect areas first. Clearly communicate the untested risks and get stakeholder sign-off.