HSBC Software Testing Interview Questions & Answers

SDLC is the full software development life cycle; STLC is the testing life cycle: requirement analysis, test planning, test design, environment setup, execution and closure.

Test 17, 18, 19, 59, 60 and 61.

Reproduce and assess impact, inform stakeholders, help developers fix and verify in staging, run regression and check monitoring after the hotfix, then do a post-mortem.

Testing at the edges of input ranges, such as 17, 18 and 19 for an age limit of 18, since errors cluster at boundaries.

Evaluating how easy and pleasant a product is to use by observing real users complete tasks and noting confusion.

A development model where each development phase has a matching testing phase, such as requirements with acceptance tests and design with integration tests.

An epic is a large body of work; stories are user-facing slices of it; tasks are technical work items; bugs are defects.

Peer review for clarity, coverage of requirements, correct expected results, test data and traceability, then update and baseline them.

Use mocks or stubs from the API contract such as Swagger, write test cases early and validate again when the real service is available.

Alpha is done in-house by internal teams before release; beta is done by a limited group of real users in their own environment.

A clear title, steps to reproduce, expected vs actual result, environment/build, severity and priority, and evidence (screenshot, video, logs).

A defect that stops testing or release of a feature because no workaround exists, so it is highest priority.

A set of steps with inputs and expected results. Components: ID, title, preconditions, steps, test data, expected result, actual result and status.

Internationalisation tests that the product can support many languages and formats; localisation tests that a specific locale is correct for text, currency, date and layout.

Positive cases use valid inputs to confirm expected behaviour; negative cases use invalid inputs to confirm the system handles errors gracefully.

Sprint planning (estimate test effort), daily stand-up (status and blockers), sprint review (demo) and retrospective (improve). Testers clarify acceptance criteria early and test within the sprint.

Risk-based testing: cover critical user flows, recent changes and high-defect areas first. Clearly communicate the untested risks and get stakeholder sign-off.

200 OK, 201 Created, 204 No Content, 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 500 Internal Server Error.

Static testing reviews documents and code without executing; dynamic testing executes the software to observe behaviour.

Verify inserted, updated and deleted rows match UI actions, check constraints, duplicates, NULLs and totals with COUNT and SUM queries.

A bug is behaviour that deviates from agreed requirements; an enhancement is a new or improved capability beyond the current requirements.

A model with many fast unit tests at the base, fewer API or integration tests in the middle and a small number of UI tests at the top.

Log and track bugs, link them to stories, build dashboards and filters with JQL, manage sprints and generate reports.

Testing how a system moves between states based on events, for example an order going from placed to paid to shipped to delivered.

Verifying the application works across different hardware, software and settings combinations.

An API style using HTTP methods on resources identified by URLs, usually exchanging JSON and staying stateless.

Smoke tests run on every build for quick feedback; full regression runs less often, such as nightly or before release.

Re-testing existing features after a change. Automate stable, repetitive, high-value flows that run every release.

A scenario is a high-level thing to test (user logs in); test cases are the detailed steps and data that verify it.

Success, failure and pending flows, timeouts, refunds, double-click payments, every method (UPI, cards, net banking), rounding, security (no card data stored) and reconciliation with bank reports.

Allowed and disallowed formats, size limits, empty file, duplicate names, special-character names, cancel upload, slow network and multiple files.

List conditions and actions in a table and cover every combination of conditions (rules) — ideal for business rules like loan approval: salary > X AND credit score > Y → approve.

A shared checklist for when a story is complete, usually including code review, tests passing, no open critical bugs and documentation updated.

Smoke testing checks that the critical features of a new build work (broad and shallow). Sanity testing checks that a specific fix or area works after a change (narrow and deep).

Verification: are we building the product right? (reviews, walkthroughs — no code run). Validation: are we building the right product? (actual testing against user needs).

Check SQL injection, brute-force lockout, password masking, session timeout, HTTPS, cookie flags, error messages not revealing users and password reset flow.

Send page, size, sort and filter parameters, then verify counts, order, boundaries (first, last, empty page) and invalid parameter handling.

User Acceptance Testing — end users or the client verify that the system meets business needs in a production-like environment before go-live.

Code is built and tested automatically on each change; tests are quality gates that stop faulty builds from moving forward.

Testing that is continuous and collaborative within each sprint, with testers working alongside developers and product owners from the start.

Mandatory fields, email format, password rules, duplicate email, terms checkbox, captcha, confirmation email and field length limits.

Statuses like To Do, In Progress, In Review, Ready for QA, Done and Reopened, with transitions that depend on the team's configuration.

Black box tests behaviour without code knowledge; white box tests internal logic and paths; grey box uses partial knowledge of the internals.

Shift left with early reviews, improve test design, automate regression, use better test data, add monitoring and learn from escaped defects.

A team meeting at the end of a sprint to discuss what went well, what did not and what to improve next.

Test execution rate, pass percentage, defect density, defect leakage, defect rejection ratio, requirement coverage and automation coverage.

GET retrieves data and has parameters in the URL; POST sends data in the body to create or process something.

They let testers verify totals and counts per category, such as the number of orders per customer, and compare them with the UI or reports.

Severity = impact on the system. Priority = urgency to fix. Logo misspelt on the homepage → low severity, high priority. Crash in a rarely used report → high severity, low priority.

Checking the application works across browsers, devices, operating systems, screen sizes and network conditions.

The team selects stories for the sprint. QA helps estimate testing effort, clarifies acceptance criteria and flags dependencies and risks.

DELETE removes selected rows and can be rolled back; TRUNCATE quickly removes all rows and resets the table.

A final document summarising what was tested, defects found and open, metrics, lessons learned and the recommendation for release.

Valid keyword, partial match, no results, special characters, very long text, empty search, case sensitivity, spelling errors, suggestions and speed of results.

JIRA Query Language, used to search issues, for example project = ABC AND status = Open AND priority = High.

The inputs used in tests. Prepare using valid, invalid and boundary values from production-like but masked data, spreadsheets or generators.