Software Testing Interview Questions for 2 Years Experience
40 questions with answers for candidates with 2 years of experience — 4 easy, 33 medium, 3 hard.
What interviewers expect: 2 years experience
At two years, interviewers expect confident API testing with Postman, SQL for data validation, solid regression planning and Agile participation. Scenario questions become common: unclear requirements, production bugs, late builds. You should show ownership of features from refinement to sign-off and some awareness of automation and mobile testing, and explain how you choose what to regression test.
This set is weighted towards Accessibility & Usability Testing (6), Agile, SQL and API Testing (6), Test Case Design (5), Mobile Testing (5).
API testing with Postman Scenario-based questions Feature ownership in Agile Mobile and cross-browser testing
Solved at this levelStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
First read what the trigger should do and when it fires, such as AFTER UPDATE on the salary column writing a row to an audit table. Then perform the event that should fire it and query the target table to confirm the expected row and values. Also perform events that should not fire it and confirm nothing happens. Check multi-row updates, NULL values and rollback: if the main statement fails, the trigger's changes must not remain.
Turn on the screen reader, for example NVDA with a browser, and listen rather than look. Navigate by headings to check the structure is logical, by landmarks to find main regions and by Tab through controls. Each control should announce a clear name, role and state, such as 'Subscribe, checkbox, not checked'. Check images, form errors, dynamic updates like cart counts and dialogs. Note exactly what was announced in bug reports.
03
What is SQL injection and how can a tester check for it at a basic level?
SQL injection happens when user input is added directly into a database query, letting an attacker change the query to read or modify data. A tester can enter inputs like a single quote or ' OR '1'='1 in login, search and URL parameters and watch for database errors, unexpected results or a login bypass. Only test in approved environments. The real fix is parameterised queries, not input filtering alone.
Verify reset with a registered email sends a link. Verify an unregistered email shows a generic message without revealing whether the account exists. Check the link opens the reset page and expires after the defined time. Check the link works only once. Validate new password rules and that confirm password must match. Verify login works with the new password and fails with the old one. Check resend limits and that other sessions are logged out.
05
What do testers look for during a requirement review?
Check that each requirement is clear, complete, consistent and testable. Look for vague words like fast or user-friendly, missing error handling, undefined limits, conflicting rules and missing roles or states. For each requirement ask how you would test it and what the expected result is. Record questions in a review log and get answers from the business analyst before writing test cases, so ambiguity does not turn into defects later.
A bottleneck is the component that limits the whole system's performance, so adding load beyond it increases response times or errors. Common places are slow database queries or missing indexes, too few database connections or threads, CPU or memory limits on servers, slow third-party APIs, large uncompressed files and chatty code that makes many small calls. Monitoring each layer during a test shows which resource saturates first.
09
A CAPTCHA on the signup page blocks screen reader users. What do you recommend?
Log it as a high-severity accessibility bug because it fully blocks a group of users from signing up. An image-only CAPTCHA fails WCAG unless an alternative is offered. Recommend options such as invisible or risk-based bot checks, an email or OTP verification step, an audio alternative plus another modality, and rate limiting on the server. Retest the full signup with NVDA and TalkBack after the change.
10
You join a project in the middle of a release. How do you plan your testing?
Spend the first day learning the scope: read the release notes, user stories and test plan, and ask the lead what is at risk. Get access to the environment, tracker and test repository. Pick up a clearly defined module, run its existing test cases to learn the application and note gaps. Ask questions early in stand-up. Within a few days, take ownership of retesting and regression for that module.
11
How do you make test cases reusable and easy to maintain?
Write one clear objective per case, keep steps short and avoid hard-coding data that changes. Put shared steps such as login into a common precondition instead of repeating them. Use consistent naming, link each case to a requirement and group them by module. Keep expected results specific but not tied to exact pixel layouts. Review and update cases whenever a story changes, so the suite stays trustworthy for regression.
Escalate immediately with the impact on the schedule. While it is down, prepare test data, review and update test cases, and test what you can elsewhere: API tests against another environment, UI on a developer machine or a staging copy. Track the lost hours in the status report. When the environment returns, run smoke first, then the prioritised list, and ask whether the release date or scope needs to change.
It means that finding and fixing many defects does not guarantee success if the system itself does not meet user needs. A bug-free product built on wrong or misunderstood requirements is still a failure. For example, a perfectly working report that shows the wrong business metric is useless to the client. This is why testers validate against real user expectations, not just the written specification.
15
How do you test biometric login with fingerprint or face unlock?
Test enabling biometrics in app settings after a password login. Verify login with a registered fingerprint or face, and failure with an unregistered one, falling back to PIN or password after the allowed attempts. Remove or add a fingerprint in device settings and check the app asks for re-authentication. Test devices without biometric hardware, disabled biometrics and app behaviour after an OS update or reinstall.
Check the state list is empty or disabled until a country is selected. Select a country and verify the correct states load. Change the country and confirm the old state selection is cleared and the new list loads. Test countries with no states, a long list with scrolling and search, and default values on page load. Submit the form and verify the saved values, then reload and check both dropdowns keep the saved selection.
18
The app crashes only on one older Android version. What are your steps?
Reproduce it on that exact OS version, using a real device or an emulator image, and note the device model and app build. Capture the crash log and stack trace. Check if the code uses an API or library not supported on that version, or a permission or storage behaviour that changed. Log the bug with logs and the minimum supported version from the requirement, so the team can decide to fix it or raise the minimum version.
Appium is an open-source tool for automating native, hybrid and mobile web apps on Android and iOS using the WebDriver protocol. Tests can be written in Java, Python, JavaScript and other languages, and it uses platform drivers such as UiAutomator2 for Android and XCUITest for iOS. It can run on emulators, simulators, real devices and cloud device farms. Stable accessibility IDs make the best locators for it.
Situation: a wallet refund screen showed success for every test. Task: I wanted to confirm the balance logic. Action: I queried the wallet_transactions table and saw two refund rows when I double-clicked the submit button, though the UI showed one. I logged it with both query outputs and the steps. Result: developers added an idempotency key, and the team added a database check to our regression checklist.
Compliance testing checks that software meets external laws, standards or internal policies, not just functional requirements. Examples include payment security standards for card data, data protection rules for personal data, accessibility guidelines and RBI rules for banking apps. Testers verify items such as consent capture, data retention, audit logs and masking. Findings are usually documented as evidence for auditors, so traceability and clear records matter as much as the tests.
Think time is the pause a real user takes between actions, such as reading a product page before adding it to the cart. Performance scripts add think time, often with random variation, so virtual users behave realistically. Without think time, a few virtual users generate a load equal to many real users, which gives misleading results. Think time values are usually taken from analytics or production logs.
Won't Fix means the bug is acknowledged as real, but the team decides not to fix it, usually because the impact is very low, the feature is being retired or the cost of fixing is higher than the benefit. The decision is made by the product owner, often in triage with dev and QA leads. The tester should make sure the reason is recorded and, if user-facing, documented as a known issue.
26
How do you handle a product owner who keeps adding scope in the middle of a sprint?
Model answer: Situation: our product owner added two small changes to a story mid-sprint, which pushed testing to the last day. Task: protect quality without being rigid. Action: I showed the extra test effort in stand-up and asked the Scrum Master to help decide what to swap out. Result: one change moved to the next sprint, and the team agreed new requests go through the backlog.
27
What is the difference between DELETE and TRUNCATE?
Situation: before a release, I found the payment form errors were not announced by screen readers and not reachable by keyboard. Task: the team wanted to defer it. Action: I recorded a short NVDA video showing a user could not finish payment, linked it to WCAG and our customer commitments, and proposed a small fix. Result: the fix took half a day, shipped in the release and we added keyboard checks to our definition of done.
29
Your automated accessibility scan shows zero errors. Is the page accessible?
Not necessarily. Automated tools catch only a part of WCAG issues, such as missing labels and contrast. A clean scan still needs manual checks: keyboard-only navigation, focus order, a screen reader pass, meaningful alt text and link names, error handling, zoom and reflow and dynamic content. Report the result as 'no automated violations found' and add the manual checklist outcome before claiming conformance.
Cause-effect graphing is a black box technique that models input conditions (causes) and output actions (effects) with logical relations like AND, OR and NOT. The graph is converted into a decision table, and each column becomes a test case. It is useful when outputs depend on combinations of inputs, such as loan approval based on income, age and credit score. It helps find missing or contradictory rules in the requirement.
31
How do you set up and clean test data for database tests without affecting other testers?
Create your own data with a clear prefix or tag, such as emails starting with qa_ravi_, or IDs in a reserved range. Insert data through the app or API where possible so it follows real rules, and keep SQL setup scripts in version control. After testing, delete only your tagged rows, or run inside a transaction and roll back. Never edit shared master data without telling the team.
32
How do you test location-based features in a mobile app?
Test with location permission allowed, denied and approximate only. Use mock location tools to simulate different cities and moving routes. Verify the app shows nearby results correctly, updates location while moving and handles GPS turned off. Check accuracy indoors and with weak GPS, battery impact of continuous tracking and that background location is used only if needed and explained to the user.
33
What is the difference between a story, epic, task and bug in JIRA?
ARIA, Accessible Rich Internet Applications, is a set of HTML attributes such as role, aria-label, aria-expanded and aria-live that tell assistive technology what a custom component is and what state it is in. The first rule is to prefer native HTML elements, such as a real button, because they are accessible by default. Wrong ARIA is worse than none, so testers verify announced roles and states match real behaviour.
35
The build arrived three days late but the release date has not moved. How do you prioritise execution?
Rank test cases by business risk and usage: critical flows like login, payment and data saving first, then new features, then high-risk regression from past defects, and cosmetic checks last. Run smoke testing immediately to avoid wasting time on a broken build. Share the reduced plan with the lead and product owner so they know what will not be covered, and get agreement on the remaining risk.
Status code, response body and schema, headers, response time, error messages for invalid input, authentication (401/403) and that data is saved in the database.
A fixed sleep, such as waiting five seconds, is either too long, which makes the suite slow when the page loads in one second, or too short, which makes the test fail when the server is slow. Both waste time and cause flaky results. Instead, wait for a real condition: an element to appear, a network response to finish or a loading spinner to disappear. Modern tools do much of this automatically.
Put the mouse away. Press Tab and Shift+Tab to move through every link, button and field, and check that the order is logical and the focus outline is always visible. Use Enter and Space to activate buttons and links, arrow keys for menus, radio groups and sliders, and Escape to close dialogs. Check that nothing traps focus, hidden items do not receive focus and a skip to main content link works.
40
What are the main testing differences between Android and iOS?
Android has many manufacturers, screen sizes and OS versions with custom skins, so device fragmentation and background-kill behaviour need more coverage. iOS has fewer devices but strict permission, privacy and store review rules. Navigation differs: Android has a system back button or gesture, iOS relies on in-app navigation and swipe back. Notification, permission and file-access behaviours also differ, so test cases need platform-specific steps.
Frequently asked questions
What is asked in Software Testing interviews for 2 years of experience?
At two years, interviewers expect confident API testing with Postman, SQL for data validation, solid regression planning and Agile participation. Scenario questions become common: unclear requirements, production bugs, late builds. You should show ownership of features from refinement to sign-off and some awareness of automation and mobile testing, and explain how you choose what to regression test.
How many questions should I practise before a Software Testing interview?
Work through all 40 questions here, then the company-wise sets for the employers you are targeting. Quality matters more than count: be able to explain why each answer is right.
Which topics matter most for 2 years of experience?
Focus first on API testing with Postman, Scenario-based questions, Feature ownership in Agile, Mobile and cross-browser testing.