Senior QA Engineer Interview Questions &amp; Answers

Show answer

Note the order ID and compare the UI value, the API response and the database value to find where they differ. Check if the UI calculates the total on the screen instead of using the saved value, whether taxes, discounts or rounding are applied at different layers and whether a later update job changed the record. Log the bug with all three values, because invoices and reports will use the database figure.

How do you test API error handling for invalid input?

Show answer

Send requests with missing required fields, wrong data types, values beyond limits, invalid formats such as a bad email, unknown fields and an empty or malformed JSON body. The API should return a 4xx code such as 400 or 422, a clear error message that names the field, and no stack trace or database details. Also check that nothing was partly saved in the database after the failed request.

How do you handle a product owner who keeps adding scope in the middle of a sprint?

Show answer

Model answer: Situation: our product owner added two small changes to a story mid-sprint, which pushed testing to the last day. Task: protect quality without being rigid. Action: I showed the extra test effort in stand-up and asked the Scrum Master to help decide what to swap out. Result: one change moved to the next sprint, and the team agreed new requests go through the backlog.

What is a workload model in performance testing?

Show answer

A workload model describes the realistic load to simulate: which user journeys run, their mix in percentages, the number of concurrent users, request rates, think times, data volumes and the ramp-up pattern. For example, 60 percent browse, 25 percent search, 10 percent add to cart and 5 percent checkout at a peak of 2,000 concurrent users. It is built from production analytics and business forecasts, and wrong models produce meaningless results.

How do you test a REST API with authentication?

Show answer

Check access with valid, expired and missing tokens, role-based permissions, error codes and that sensitive data is never exposed.

How do you estimate testing effort?

Show answer

Break the work into modules and test cases, use past velocity or three-point estimation (optimistic, likely, pessimistic), add time for test data, environment issues, retesting and regression, and keep a risk buffer.

What is a traceability matrix?

Show answer

A grid mapping requirements to test cases and defects, proving every requirement is tested.

What is CSRF and how is it prevented?

Show answer

Cross-site request forgery tricks a logged-in user's browser into sending an unwanted request to a site, such as changing their email, because the browser automatically includes cookies. Prevention includes anti-CSRF tokens in forms, SameSite cookie settings and re-authentication for sensitive actions. Testers check that state-changing requests fail when the token is missing or reused, and that such actions are not done through GET requests.

How would you choose a device matrix for testing an app in India?

Mobile TestingHard

Show answer

Use the app's analytics, or market data if it is a new app, to find the top devices, OS versions and screen sizes. In India, cover a strong share of budget and mid-range Android phones with low RAM, a few manufacturers' custom Android skins, the two or three latest Android versions, and recent iPhones if iOS is supported. Add a tablet if relevant. Review the matrix each quarter and use a cloud device lab for wider coverage.

What sensitive data checks do you do in API responses and logs?

Performance and Security BasicsMedium

Show answer

Check that responses return only needed fields, with no passwords, password hashes, full card numbers, full ID numbers or internal keys. Verify personal data is masked where required, for example only the last four digits of a phone number. Look at application and browser console logs for tokens or personal data. Check error responses do not expose stack traces, SQL or server versions. Raise any leak as a high-severity bug.

Write a Postman test script that checks the status is 201 and the response contains an id.

Show answer

pm.test('Status is 201', function () { pm.response.to.have.status(201); }); pm.test('Response has id', function () { const body = pm.response.json(); pm.expect(body).to.have.property('id'); pm.expect(body.id).to.be.a('number'); });

How would you set up a testing approach for a new Agile team with no QA process?

Agile, SQL and API TestingHard

Show answer

Start small. Agree on a definition of ready and definition of done that include acceptance criteria and testing. Join refinement and run Three Amigos for every story. Set up a simple bug workflow and severity guide in the tracker, a shared test case repository and a smoke checklist for each build. Then add API checks and automated regression for stable flows. Review what works in each retrospective and adjust.

Search works fine in QA but is very slow in production. Could a missing database index be the reason, and how do you check?

Show answer

Yes, very likely. An index lets the database find rows quickly, like the index of a book. With a small QA table, a full table scan is still fast, but with millions of production rows it becomes slow. Compare indexes on the searched columns in both environments and ask a developer to check the query plan. Test key queries on production-size data in staging, and include data volume in future performance checks.

How do you plan regression testing for a monthly release?

Show answer

Keep a tiered regression suite: a smoke set for every build, a core set of critical flows for every release and a full set run on a rotation or before major releases. Each month, add impact-based tests from the release changes and cases for recent production bugs. Automate stable, repeated cases and keep manual effort for new or changing areas. Schedule regression early enough to fix and retest found issues.

What is the difference between a test strategy and a test plan?

Show answer

A test strategy is a high-level document, often at organisation or product level, that defines the general approach: test levels, types, tools, environments, automation approach and standards. It changes rarely. A test plan is project or release specific: scope, schedule, resources, entry and exit criteria, risks and deliverables. The plan follows the strategy and applies it to a particular release.

What is TDD vs BDD?

Show answer

TDD writes unit tests before code to drive design; BDD describes behaviour in business language scenarios that become automated acceptance tests.

What is the difference between vulnerability scanning and penetration testing?

Show answer

Vulnerability scanning uses automated tools to look for known weaknesses, such as outdated libraries, missing security headers or open ports. It is fast, repeatable and can run in the pipeline, but gives false positives. Penetration testing is a deeper, mostly manual exercise by security experts who try to exploit weaknesses and chain them like a real attacker. Teams scan regularly and run penetration tests before major releases or yearly.

What is the use of SQL GROUP BY and HAVING in test validation?

Show answer

They let testers verify totals and counts per category, such as the number of orders per customer, and compare them with the UI or reports.

What is a performance bottleneck and where do bottlenecks usually occur?

Performance and Security BasicsMedium

Show answer

A bottleneck is the component that limits the whole system's performance, so adding load beyond it increases response times or errors. Common places are slow database queries or missing indexes, too few database connections or threads, CPU or memory limits on servers, slow third-party APIs, large uncompressed files and chatty code that makes many small calls. Monitoring each layer during a test shows which resource saturates first.

How do you decide the priority of test cases?

Show answer

By business criticality, usage frequency, defect history, risk and dependencies, running high-priority cases first.

User reviews say the app drains the battery. How do you investigate?

Mobile TestingHard

Show answer

Collect details from reviews and support: devices, OS versions and app version when it started. Compare battery usage of the current and previous versions on the same devices over a typical session and while idle in background. Use profiling tools to look for background location, wake locks, frequent sync or network polling. Share measurements with developers, verify the fix with the same method, and add a battery check to release testing.

What is the difference between DELETE and TRUNCATE?

Show answer

DELETE removes selected rows and can be rolled back; TRUNCATE quickly removes all rows and resets the table.

What metrics do QA teams track?

Show answer

Test execution rate, pass percentage, defect density, defect leakage, defect rejection ratio, requirement coverage and automation coverage.

How do you decide testing is complete when some bugs are still open?

Show answer

Testing is complete when agreed exit criteria are met, not when the bug count is zero. Check that planned tests ran, critical and high bugs are fixed or formally accepted, and remaining open bugs have workarounds and low user impact. Present the list with risk to the product owner, who decides on release. Record accepted bugs as known issues, so nothing is hidden and they are planned for a later release.

How do you plan testing for a feature that depends on a third-party service?

Automation Basics for Manual TestersHard

Show answer

Identify the integration points and the service's sandbox, limits and test data. Plan to test with a mock or stub early for our logic and error handling, then against the real sandbox for integration. Include failure scenarios: timeout, slow responses, invalid data and the service being down. Add the dependency to the risk list, with contacts and a fallback plan, and confirm production credentials and monitoring before go-live.

Your team has 500 manual regression test cases and wants to start automating. Where do you start?

Show answer

Do not automate all 500. First clean the suite: remove duplicates and outdated cases. Rank the rest by business risk, run frequency and stability. Start with a smoke set of 20 to 30 critical journeys and move rule-heavy checks to the API level. Choose a tool that fits the team's skills, build a simple framework with page objects and CI runs, then expand in batches while tracking time saved and flakiness.

What is a REST API?

Show answer

An API style using HTTP methods on resources identified by URLs, usually exchanging JSON and staying stateless.

What is the difference between product risks and project risks in a test plan?

Show answer

Product risks are about the quality of the software itself: features that may fail and harm users, such as wrong interest calculation or a data leak. They decide what to test more deeply. Project risks are about running the test project: late builds, unstable environments, missing skills, unclear requirements or tight deadlines. They decide how to plan, with mitigations like buffers, backup environments or training.

A manager says the app has 50,000 daily users, so the load test must run 50,000 virtual users at once. How do you respond?

Performance and Security BasicsMedium

Show answer

Explain that daily users are not concurrent users. Of 50,000 users a day, only a fraction are active at the same moment, and even they pause between actions because of think time. Use analytics to find the real peak concurrency and request rate, for example 1,500 concurrent users at peak hour, and model that with a safety margin. Running 50,000 users clicking at once tests a load that never happens and wastes effort.

What is cold start versus warm start, and why test app launch time?

Mobile TestingHard

Show answer

A cold start launches the app from scratch when it is not in memory, loading the process and the first screen; it is the slowest. A warm start happens when the app process exists but the screen must be recreated, and a hot start just brings it to the foreground. Users abandon slow apps, so teams set targets, such as cold start under two seconds on a mid-range device, and measure each release for regressions.

How would you test rate limiting on a public API?

Agile, SQL and API TestingHard

Show answer

Find the documented limit, for example 100 requests per minute per key. Send requests just below and above the limit and check that extra requests get 429 Too Many Requests with a Retry-After header. Verify the counter resets after the window and that limits apply per key or per IP as designed. Check that one user hitting the limit does not block others, and that normal traffic is not throttled.

What is mutation testing?

Testing TypesHard

Show answer

Mutation testing measures the quality of a test suite. A tool makes small changes, called mutants, to the code, such as changing greater than to greater than or equal, and runs the tests. If a test fails, the mutant is killed; if all tests still pass, the mutant survived, which shows a weak spot in the tests. The mutation score is killed mutants divided by total mutants. It is strong but slow, so teams apply it to critical modules.

How do you include automation in a test strategy document?

Show answer

State the goals, such as cutting regression time and giving pull request feedback within fifteen minutes. Define the split across unit, API and UI layers, the tools and language, which suites run on each pull request, nightly and before release, and who writes and maintains tests. Add entry rules for automating a case, reporting, flaky test handling and environments. Review metrics every quarter and adjust.

Tell me about a time you mentored a junior tester.

Show answer

Model answer: Situation: a new fresher on my team was writing very long, unclear bug reports. Task: help her improve quickly. Action: I reviewed five of her bugs with her, showed a simple template, paired with her on two exploratory sessions and gave weekly feedback. Result: within a month developers stopped asking her for clarification, and she later found and reported a major session bug on her own.

What is a go or no-go meeting and what does QA present?

Show answer

A go or no-go meeting is held before release to decide whether to deploy. QA presents test coverage against scope, pass and fail counts, open defects by severity with their impact, known issues and workarounds, any untested areas and the overall risk. QA gives a recommendation, but the business owner decides. The decision and accepted risks should be recorded in the meeting notes.

What are common HTTP status codes?

Show answer

200 OK, 201 Created, 204 No Content, 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 500 Internal Server Error.

What is idempotency in APIs and how do you test it?

Agile, SQL and API TestingHard

Show answer

An operation is idempotent if repeating the same request gives the same result as doing it once. GET, PUT and DELETE should be idempotent; POST usually is not. To test, send the same request several times and check the server state does not change after the first call. For payments, check that retrying with the same idempotency key does not create a second charge, which protects users during network retries.

What is the role of a QA lead across the STLC?

Show answer

A QA lead reviews requirements and plans testing, including scope, estimates, resources and risks. They assign work, set standards for test cases and bug reports, and review test artefacts. During execution, they track progress, run triage and remove blockers. At the end, they give a clear release recommendation, prepare closure reports and drive lessons learned. They also mentor the team and improve the process over time.

Release is tomorrow and you can't test everything. What now?