American Express Software Testing Interview Questions & Answers
Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About American Express hiring for Software Testing roles
American Express is a global payments and card company offering charge and credit cards, travel services and merchant acquiring. Its India centres in Gurugram and Bengaluru support technology, risk, analytics and servicing. It hires for software engineers, QA engineers, data analysts, data scientists and credit risk analysts.
For Software Testing roles, this American Express practice set focuses most on STLC and Test Planning (6), Performance and Security Basics (5), Test Case Design (5), Bug Life Cycle and Jira (4). It has 4 easy, 33 medium, 3 hard questions, so you can start easy and work up to the harder ones.
Company type
Banking & finance
Headquarters
New York, USA
Main India offices
Gurugram, Bengaluru
American Express Software Testing interview process
Online assessment (aptitude + coding or analytics)
Technical round
Case or domain round
Hiring manager round
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for American ExpressStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
Why must input validation be tested on the server and not only in the browser?
Client-side validation improves user experience by giving quick feedback, but anyone can bypass it by disabling JavaScript or sending requests directly with tools like Postman. The server must validate every input again for type, length, format and business rules. Testers check this by sending invalid data straight to the API, such as a negative quantity or a very long name, and confirming the server rejects it.
02
What is the difference between a test suite and a test run?
A test readiness review is a checkpoint before formal test execution starts, where the team confirms everything needed is in place. It checks that the build is deployed and smoke tested, the environment and test data are ready, test cases are reviewed and approved, access and tools work, and entry criteria are met. It prevents wasted days when execution starts and testers discover a missing service or empty database.
04
A training portal is adding recorded video lessons and podcasts. What accessibility checks do you run?
Check that prerecorded videos have accurate, synchronised captions, not just auto-generated ones with errors, and that audio-only content like podcasts has a transcript. Important visual information that is not spoken should have audio description or be covered in the transcript. Media should not autoplay with sound, and player controls must work by keyboard and be announced by screen readers. Also check that nothing flashes more than three times per second.
05
A bug happens only in production and not in the QA environment. How do you investigate?
Collect exact details: user, time, device, browser and request IDs. Compare production with QA for configuration, feature flags, data volume, third-party integrations, versions and caching. Ask for production logs and error traces through the support or dev team. Try to reproduce in QA with production-like data or in a staging environment. Once found, add a test for the gap and fix the environment difference if one caused it.
The OWASP Top 10 is a widely used list of the most critical web application security risks, published by an open community project. It includes broken access control, cryptographic failures, injection, insecure design, security misconfiguration, vulnerable components and authentication failures. Testers use it as a checklist to include basic security checks in their testing and to speak the same language as security teams.
An urgent patch released outside the normal schedule to fix a critical production defect, followed by regression testing and merge back to the main branch.
09
Design EP and BVA tests for a password that must be 8 to 16 characters and contain at least one digit.
Length partitions: below 8 (invalid), 8 to 16 (valid), above 16 (invalid). Boundaries: 7, 8, 9, 15, 16 and 17 characters. Digit partitions: contains a digit (valid), no digit (invalid). Sample tests: 'abc1234' with 7 characters is rejected, 'abcdefg1' with 8 is accepted, a 16-character value with a digit is accepted, 17 characters is rejected, and 'abcdefgh' with no digit is rejected. Also test empty input and spaces.
10
What is SQL injection and how can a tester check for it at a basic level?
SQL injection happens when user input is added directly into a database query, letting an attacker change the query to read or modify data. A tester can enter inputs like a single quote or ' OR '1'='1 in login, search and URL parameters and watch for database errors, unexpected results or a login bypass. Only test in approved environments. The real fix is parameterised queries, not input filtering alone.
Apply a valid coupon and check the discount and final amount. Test invalid, expired and not-yet-active coupons. Check minimum order value, maximum discount cap and category restrictions. Verify one-time-use coupons cannot be reused and that only one coupon applies if stacking is not allowed. Check case sensitivity and leading or trailing spaces. Remove the coupon and confirm the total resets. Change cart items after applying and verify the discount is recalculated.
Compliance testing checks that software meets external laws, standards or internal policies, not just functional requirements. Examples include payment security standards for card data, data protection rules for personal data, accessibility guidelines and RBI rules for banking apps. Testers verify items such as consent capture, data retention, audit logs and masking. Findings are usually documented as evidence for auditors, so traceability and clear records matter as much as the tests.
A development model where each development phase has a matching testing phase, such as requirements with acceptance tests and design with integration tests.
16
What are suspension and resumption criteria in a test plan?
Suspension criteria define when testing should be paused because continuing would waste effort, for example when a blocker bug stops the main flow, the build fails smoke testing or the environment is down. Resumption criteria define what must happen to restart, such as a new build that passes smoke testing or the environment restored. Writing these down avoids arguments and shows clearly why testing time was lost.
Send and receive text messages and check order and timestamps. Test sent, delivered and read status. Send emojis, long messages, links and attachments within and over the size limit. Check messages sent while offline are queued and delivered on reconnect. Verify blocking a user stops messages. Test notifications when the app is in background. Check chat history after reinstall or on a second device, and that deleted messages disappear for both users if supported.
18
How do you write steps to reproduce for a bug that needs specific test data?
Start with preconditions: environment, build number, user role and the exact data state, such as an account with two pending orders and zero wallet balance. Mention how to create the data or give the test account ID. Then list numbered steps with exact inputs and finish with expected and actual results. If the data is hard to set up, attach the SQL used or a database screenshot so the developer can recreate it quickly.
19
How do you run a moderated usability test session?
Define goals and three to five realistic tasks, such as 'Book a train ticket for next Friday'. Recruit participants who match real users. In the session, explain that you are testing the product, not them, ask them to think aloud, and avoid hinting even when they struggle. Record the screen with consent, note where they hesitate or fail, and finish with a short questionnaire. Then group findings by severity and frequency.
System testing tests the complete, integrated application against the requirements in an environment close to production. It is done by the testing team after integration testing and before UAT. It covers functional testing of all features plus non-functional aspects such as performance, security, usability and compatibility. It is black box testing, so the tester checks behaviour from the user's point of view without looking at the code.
22
Product is running an A/B test on the checkout button. What does QA need to verify?
QA does not decide which version wins, but makes sure the experiment is trustworthy. Verify both variants work end to end, users are split in the agreed ratio, each user sees the same variant consistently across sessions, and analytics events fire correctly for each group. Also check that turning the experiment off returns everyone to the default. A broken tracking event can make the whole experiment's result wrong.
23
An automated test passes on your laptop but fails in the CI pipeline. How do you troubleshoot?
Check the CI logs, screenshots, video or trace to see exactly where it failed. Then compare the environments: headless versus headed browser, screen size, browser version, time zone, environment URLs and secrets, test data and network speed. Run the test locally in headless mode with the CI settings. Common causes are timing, missing data in the CI environment and tests depending on run order. Fix the cause, not with a sleep.
24
How do you test battery and memory usage of a mobile app?
Run typical user sessions on a real device and measure battery drain, CPU and memory with platform profiling tools or the device's battery statistics. Compare with the previous version. Look for background work continuing after the app is closed, GPS left on, frequent network polling and memory that keeps growing, which signals a leak. Test on low-RAM devices too, where the OS kills heavy apps quickly.
The Page Object Model is a design pattern where each page or major component gets a class that holds its locators and actions, such as LoginPage with a login method. Tests call these methods instead of using locators directly. When the login button changes, you update one place instead of fifty tests. Tests become readable, like steps a manual tester would write, and duplication drops. Keep assertions mostly in tests, not page objects.
26
You join a project in the middle of a release. How do you plan your testing?
Spend the first day learning the scope: read the release notes, user stories and test plan, and ask the lead what is at risk. Get access to the environment, tracker and test repository. Pick up a clearly defined module, run its existing test cases to learn the application and note gaps. Ask questions early in stand-up. Within a few days, take ownership of retesting and regression for that module.
PUT replaces the whole resource with the data sent, so fields you leave out may be cleared or reset. PATCH applies a partial update and changes only the fields sent. For example, to change only a user's phone number, PATCH with just the phone field is enough, while PUT expects the complete user object. Testers check that PUT and PATCH behave as documented and that missing fields are handled correctly.
28
You change the order ID in a URL and see another customer's order. What is this and what do you do?
This is an insecure direct object reference, a form of broken access control and a critical security bug, because any user can read other users' data. Stop exploring further beyond what is needed to confirm it, record the request, accounts used and evidence, and log it as a critical bug with restricted visibility. Inform the lead and security contact immediately. The fix is a server-side ownership check on every request.
A performance baseline is a set of measurements of the current system under a known load, such as response times, throughput, error rate and resource usage. Every new build or release is compared with it to spot regressions. For example, if the checkout API had p95 of 800 milliseconds at 200 users last release and now shows 1.5 seconds, the change needs investigation. A benchmark compares against an industry or competitor standard.
Exhaustive testing means trying every possible input, path and combination, which is practically infinite for real software. Even a single text field accepting 20 characters has more combinations than you could ever run. So testers use risk and techniques like equivalence partitioning and boundary value analysis to select a small set of tests that give high confidence. The goal is enough coverage of important risks, not every possible case.
31
A CAPTCHA on the signup page blocks screen reader users. What do you recommend?
Log it as a high-severity accessibility bug because it fully blocks a group of users from signing up. An image-only CAPTCHA fails WCAG unless an alternative is offered. Recommend options such as invisible or risk-based bot checks, an email or OTP verification step, an audio alternative plus another modality, and rate limiting on the server. Retest the full signup with NVDA and TalkBack after the change.
32
A user fills a long form, switches to another app and comes back. What should you test?
Check that the form data is still there when the user returns after a few seconds and after a longer time. Test when the OS kills the app in background due to low memory, which you can force with developer options, and confirm the app restores state or at least warns the user. Also check session timeout behaviour and that sensitive screens are hidden in the recent apps view if required.
Usually yes. Status codes should reflect the result so clients and monitoring can react correctly; an error with 200 can hide failures and break retries. A validation error should return 400 or 422, a missing resource 404 and a server failure 500. Check the API contract first: some legacy APIs document this pattern. If it is not documented, log it as a defect with the request and response attached.
35
Describe a time an automated test caught a regression that manual testing would have missed.
Situation: a small tax rounding change was made late on a Friday. Task: no manual regression was planned for pricing. Action: our nightly API suite failed one data-driven case where a 3-item cart was off by one rupee; I checked the trace, reproduced it manually and logged it with the failing input. Result: it was fixed before release, and the team agreed to keep pricing tests in the pull request suite.
Test with location permission allowed, denied and approximate only. Use mock location tools to simulate different cities and moving routes. Verify the app shows nearby results correctly, updates location while moving and handles GPS turned off. Check accuracy indoors and with weak GPS, battery impact of continuous tracking and that background location is used only if needed and explained to the user.
Test monitoring compares actual testing progress with the plan, using metrics like test cases executed, pass rate, open defects and effort spent. Test control is the action taken when monitoring shows a gap, such as re-prioritising tests, adding testers, changing the schedule or tightening entry criteria. For example, if half the time has passed but only a quarter of cases are executed, the lead must act and inform stakeholders.
39
Write a Postman test script that checks the status is 201 and the response contains an id.
pm.test('Status is 201', function () {
pm.response.to.have.status(201);
});
pm.test('Response has id', function () {
const body = pm.response.json();
pm.expect(body).to.have.property('id');
pm.expect(body.id).to.be.a('number');
});
40
Tell me about a device-specific bug you found and how you reported it.
Model answer: Situation: users of one budget phone model reported that the camera upload screen was black. Task: reproduce it. Action: I borrowed the same model, found the issue only appeared when the battery saver was on, and logged the bug with the device model, OS version, logs and a video. Result: the developer fixed the camera initialisation, and we added that model to our device matrix.
Tips to crack the American Express Software Testing interview
Learn credit card business basics like spend, revolve, delinquency and customer lifetime value for analytics interviews.
Practise SQL, Python and statistics, including model evaluation for risk or marketing use cases.
Read about American Express's Blue Box values and its strong focus on customer service.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; American Express interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the American Express Software Testing interview?
Candidates usually go through 5 stages: Online assessment (aptitude + coding or analytics); Technical round; Case or domain round; Hiring manager round; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the American Express Software Testing interview?
This practice set leans on STLC and Test Planning (6), Performance and Security Basics (5), Test Case Design (5), Bug Life Cycle and Jira (4). Revise those first, then practise explaining one or two of your own projects end to end, because most American Express interviewers ask you to walk through real work.
Are these the exact questions asked at American Express?
No. These are curated practice questions that match the skills and difficulty usually tested in banking & finance interviews like American Express's. They are not a leaked or verified list of past questions.
Where does American Express hire Software Testing professionals in India?
American Express has large teams in Gurugram, Bengaluru. Openings and locations change often, so check the American Express careers page and filter by city and experience.