Software Testing Interview Questions for 7 Years Experience
40 questions with answers for candidates with 7 years of experience — 16 medium, 24 hard.
What interviewers expect: 7 years experience
At seven years, roles are usually QA lead or test manager. Interviews focus on leading teams across releases, building QA processes, balancing manual and automated testing, managing risk with tight timelines and reporting to leadership. Expect deep scenario questions on production incidents, team conflicts, hiring, budgets and quality governance across multiple teams.
This set is weighted towards Agile, SQL and API Testing (8), STLC and Test Planning (5), Mobile Testing (5), Test Case Design (4).
Team leadership and planning QA process design Risk and incident management Leadership reporting
Solved at this levelStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
What automated accessibility tools exist and what are their limits?
Common tools are axe DevTools, Lighthouse in Chrome, WAVE and accessibility linters in CI. They quickly catch missing alt text, low contrast, missing labels and invalid ARIA. Their limit is that they find only roughly a third of WCAG issues. They cannot judge whether alt text is meaningful, focus order is logical, error messages make sense or a custom widget works with a screen reader, so manual testing is still required.
02
The sprint ends tomorrow and two stories are still in testing. What do you do?
Tell the Scrum Master and product owner today, not at the review. Focus testing on the acceptance criteria and the riskiest paths of the story with the most value, and ask a developer to help with test data or simple checks. If a story cannot be finished with quality, it should be carried over, not marked done with untested parts. Raise the cause in the retrospective, such as late handover.
A test strategy is a high-level document, often at organisation or product level, that defines the general approach: test levels, types, tools, environments, automation approach and standards. It changes rarely. A test plan is project or release specific: scope, schedule, resources, entry and exit criteria, risks and deliverables. The plan follows the strategy and applies it to a particular release.
05
How do you test concurrent updates to the same record, such as two agents editing one ticket?
Open the same record in two sessions, change different fields and save both, then change the same field and save both. Check the database to see which value won and whether data was silently lost. A good design uses optimistic locking, where the second save fails with a 'record changed, please reload' message because a version column changed. Also repeat with API calls fired together to catch timing issues the UI hides.
06
How do you design test cases for role-based access with admin, editor and viewer roles?
Build a permission matrix with roles as rows and actions as columns, such as create, edit, delete, publish and view, marking allowed or denied from the requirement. Write a positive test for each allowed cell and a negative test for each denied one. Test through the UI and also call the APIs directly, because hidden buttons are not security. Check role changes take effect immediately and that users cannot access other users' data by changing IDs.
07
How would you choose a device matrix for testing an app in India?
Use the app's analytics, or market data if it is a new app, to find the top devices, OS versions and screen sizes. In India, cover a strong share of budget and mid-range Android phones with low RAM, a few manufacturers' custom Android skins, the two or three latest Android versions, and recent iPhones if iOS is supported. Add a tablet if relevant. Review the matrix each quarter and use a cloud device lab for wider coverage.
08
How do you test an application with no documentation?
Talk to developers and users, explore the product, review similar systems, create notes and mind maps, confirm assumptions and write test cases as you learn.
09
What do testers look for during a requirement review?
Check that each requirement is clear, complete, consistent and testable. Look for vague words like fast or user-friendly, missing error handling, undefined limits, conflicting rules and missing roles or states. For each requirement ask how you would test it and what the expected result is. Record questions in a review log and get answers from the business analyst before writing test cases, so ambiguity does not turn into defects later.
10
What new success criteria in WCAG 2.2 should testers know?
WCAG 2.2, published in 2023, added criteria including Focus Not Obscured, so sticky headers must not hide the focused element; Dragging Movements, which needs a non-drag alternative; Target Size Minimum of 24 by 24 CSS pixels; Consistent Help placement; Redundant Entry, so users are not asked for the same information twice; and Accessible Authentication, which avoids memory puzzles at login. It also removed the old Parsing criterion.
11
How would you add basic security testing to a team that has no security process?
Start with low-cost steps. Add an OWASP-based security checklist to the definition of done for stories touching login, payments or personal data. Train testers on access control, injection and session checks. Add automated dependency and vulnerability scans to the CI pipeline. Include negative authorization tests in API suites. Arrange a penetration test before major releases and track security bugs separately with clear severity rules.
A go or no-go meeting is held before release to decide whether to deploy. QA presents test coverage against scope, pass and fail counts, open defects by severity with their impact, known issues and workarounds, any untested areas and the overall risk. QA gives a recommendation, but the business owner decides. The decision and accepted risks should be recorded in the meeting notes.
14
Your team wants to use an AI tool to generate test cases and automation scripts. What benefits and risks do you point out?
AI assistants can draft test cases from requirements, suggest edge cases, generate first versions of scripts and test data, and some tools self-heal locators when the page changes. Risks are confident but wrong output, tests that assert the wrong behaviour, hidden locator changes that mask real bugs and leaking confidential data into external tools. Treat AI output like a junior's draft: review it, run it and keep human judgement on what matters.
15
Leadership asks for a one-page quality update before a release. Which bug metrics do you report?
Keep it short and decision-oriented. Show open bugs by severity, the created versus resolved trend, blockers with owners and dates, defect leakage from the last release and modules with the most defects. Give a clear recommendation, such as ready, ready with known issues or not ready, with reasons. Use a shared dashboard for detail, and one slide or email summary for leaders who need only the risk picture.
16
Notifications arrive late, and some screens look broken, only on certain Android phone brands. Why can this happen and what do you test?
Android phone makers ship their own skins and settings on top of Android, so the same app can behave differently. Common problems are aggressive battery savers that kill background tasks and delay notifications, different permission screens, custom fonts and display scaling, camera differences and modified WebViews. Pick devices from the brands most used by your audience and test background work, notifications, camera and layout on each.
Android has many manufacturers, screen sizes and OS versions with custom skins, so device fragmentation and background-kill behaviour need more coverage. iOS has fewer devices but strict permission, privacy and store review rules. Navigation differs: Android has a system back button or gesture, iOS relies on in-app navigation and swipe back. Notification, permission and file-access behaviours also differ, so test cases need platform-specific steps.
The classification tree method breaks the input domain into classifications (aspects like payment type, user type, device) and classes (values like card, UPI, wallet). These are drawn as a tree, and test cases are formed by picking one class from each classification in a combination table. It makes coverage visible, helps reviewers spot missing classes and combines well with pairwise selection to keep the number of test cases manageable.
Find the documented limit, for example 100 requests per minute per key. Send requests just below and above the limit and check that extra requests get 429 Too Many Requests with a Retry-After header. Verify the counter resets after the window and that limits apply per key or per IP as designed. Check that one user hitting the limit does not block others, and that normal traffic is not throttled.
XSS is a vulnerability where an attacker's script is injected into a page and runs in other users' browsers, which can steal session data or change the page. It occurs when user input is shown without proper encoding. Testers enter a harmless script tag or an image tag with an onerror alert in comments, profile names and search boxes, then check if it executes when the page is displayed. Output encoding prevents it.
22
Tell me about a time you worked with developers to make an application easier to automate.
Situation: our UI scripts broke almost every sprint because of generated IDs and CSS class changes. Task: as the QA lead I needed stable tests. Action: I showed developers the failure history, proposed adding data-testid attributes and accessible labels to key components and added a short checklist to the pull request template. Result: within two sprints locator-related failures dropped by most of the previous level and maintenance time fell sharply.
23
What basic security checks do you do for a mobile app?
Check that sensitive data like tokens and personal details are not stored in plain text on the device or written to logs. Verify all traffic uses HTTPS and the app rejects invalid certificates. Check session timeout, logout clearing data and that sensitive screens block screenshots if required. Test behaviour on rooted or jailbroken devices if the policy needs it, and that API keys are not visible in the app package.
24
The developer says "it's not a bug". What do you do?
Run typical user sessions on a real device and measure battery drain, CPU and memory with platform profiling tools or the device's battery statistics. Compare with the previous version. Look for background work continuing after the app is closed, GPS left on, frequent network polling and memory that keeps growing, which signals a leak. Test on low-RAM devices too, where the OS kills heavy apps quickly.
27
What is operational acceptance testing and how is it different from UAT?
Operational acceptance testing checks that the system is ready to be run and supported in production: backup and restore, failover, monitoring and alerts, deployment and rollback scripts, log access, security patches and support runbooks. UAT checks that the system meets business users' needs. OAT is done with operations or SRE teams, UAT with business users. Both must pass before a major go-live.
28
Describe how you led a QA team through a very tight release.
Model answer: Situation: a regulatory change had to go live in ten days. Task: lead four testers. Action: I split work by risk, put our strongest tester on the calculation engine, ran daily 15-minute bug triage with developers and shared a single status dashboard. I also automated the repeated tax checks. Result: we released on the deadline with zero critical defects, and the client used our test evidence for their audit.
Success, failure and pending flows, timeouts, refunds, double-click payments, every method (UPI, cards, net banking), rounding, security (no card data stored) and reconciliation with bank reports.
Break the work into modules and test cases, use past velocity or three-point estimation (optimistic, likely, pessimistic), add time for test data, environment issues, retesting and regression, and keep a risk buffer.
31
How do you test API error handling for invalid input?
Send requests with missing required fields, wrong data types, values beyond limits, invalid formats such as a bad email, unknown fields and an empty or malformed JSON body. The API should return a 4xx code such as 400 or 422, a clear error message that names the field, and no stack trace or database details. Also check that nothing was partly saved in the database after the failed request.
SUS is a standard ten-question survey that users answer on a five-point agree to disagree scale after using a product. The answers are converted to a score from 0 to 100. A score around 68 is considered average, above about 80 is good and below 50 signals serious usability problems. It is quick and comparable across releases, but it gives a score, not reasons, so teams pair it with observation notes.
33
How would you set up a testing approach for a new Agile team with no QA process?
Start small. Agree on a definition of ready and definition of done that include acceptance criteria and testing. Join refinement and run Three Amigos for every story. Set up a simple bug workflow and severity guide in the tracker, a shared test case repository and a smoke checklist for each build. Then add API checks and automated regression for stable flows. Review what works in each retrospective and adjust.
Status code, response body and schema, headers, response time, error messages for invalid input, authentication (401/403) and that data is saved in the database.
35
What are transaction isolation levels and what is a dirty read?
Isolation levels control how much one transaction can see of another's uncommitted work. Common levels are Read Uncommitted, Read Committed, Repeatable Read and Serializable. A dirty read is reading data another transaction changed but has not committed; if it rolls back, you acted on data that never existed. Testers check isolation using two database sessions: update without committing in one and query in the other to see what is visible.
36
The product team wants to skip UAT to ship faster. What do you advise?
Explain the risk: system testing proves the software matches the specification, but only users confirm it fits real business work. Propose a lighter option instead of none: a short, focused UAT on critical flows with two or three key users, or a staged rollout to a small user group with monitoring and quick rollback. If they still skip it, record the decision and the accepted risks with the product owner.
37
What is the difference between DELETE and TRUNCATE?
Stop the retest loop and call a short session with the developer, lead and product owner. Check whether the fix addresses the root cause or only the symptom, whether everyone agrees on the expected behaviour and whether different environments or data are involved. Run a root cause analysis and agree on clear acceptance tests before the next fix. Add an automated regression check so it cannot silently return.
39
Leadership asks whether test automation is worth the investment for your project. How do you estimate the ROI?
Compare cost and savings over time. Cost includes building scripts, framework setup, tools, CI infrastructure and ongoing maintenance, often a large share of total effort. Savings include manual execution hours saved per run multiplied by runs per year, earlier bug detection and faster releases. For example, a 40-hour manual regression run every two weeks saves about 1000 hours a year. Tests that run rarely or break often may never pay back.
40
What is SQL injection and how can a tester check for it at a basic level?
SQL injection happens when user input is added directly into a database query, letting an attacker change the query to read or modify data. A tester can enter inputs like a single quote or ' OR '1'='1 in login, search and URL parameters and watch for database errors, unexpected results or a login bypass. Only test in approved environments. The real fix is parameterised queries, not input filtering alone.
Frequently asked questions
What is asked in Software Testing interviews for 7 years of experience?
At seven years, roles are usually QA lead or test manager. Interviews focus on leading teams across releases, building QA processes, balancing manual and automated testing, managing risk with tight timelines and reporting to leadership. Expect deep scenario questions on production incidents, team conflicts, hiring, budgets and quality governance across multiple teams.
How many questions should I practise before a Software Testing interview?
Work through all 40 questions here, then the company-wise sets for the employers you are targeting. Quality matters more than count: be able to explain why each answer is right.
Which topics matter most for 7 years of experience?
Focus first on Team leadership and planning, QA process design, Risk and incident management, Leadership reporting.