Medium Software Testing Interview Questions

Assess impact and risk, discuss with product and dev, decide to fix, defer with a workaround or delay release, and document the decision.

Internationalisation tests that the product can support many languages and formats; localisation tests that a specific locale is correct for text, currency, date and layout.

List conditions and actions in a table and cover every combination of conditions (rules) — ideal for business rules like loan approval: salary > X AND credit score > Y → approve.

Status code, response body and schema, headers, response time, error messages for invalid input, authentication (401/403) and that data is saved in the database.

Clear, concise, independent, repeatable, traceable to a requirement, with precise expected results and tested data.

An urgent patch released outside the normal schedule to fix a critical production defect, followed by regression testing and merge back to the main branch.

Verify inserted, updated and deleted rows match UI actions, check constraints, duplicates, NULLs and totals with COUNT and SUM queries.

Basic operations, division by zero, decimals, large numbers, order of operations, clear and backspace, repeated operations and memory keys.

Add, remove, update quantity, price and tax calculation, coupon codes, stock limits, cart persistence after login and checkout navigation.

Allowed and disallowed formats, size limits, empty file, duplicate names, special-character names, cancel upload, slow network and multiple files.

Severity is impact on the system; priority is urgency of the fix. A crash in a rare report is high severity, low priority; a spelling mistake in the logo is low severity, high priority.

A team meeting at the end of a sprint to discuss what went well, what did not and what to improve next.

Code is built and tested automatically on each change; tests are quality gates that stop faulty builds from moving forward.

Checking the application works across browsers, devices, operating systems, screen sizes and network conditions.

Testing services directly without the UI, checking status codes, responses, security and performance. It finds issues early and is faster than UI tests.

DELETE removes selected rows and can be rolled back; TRUNCATE quickly removes all rows and resets the table.

Send page, size, sort and filter parameters, then verify counts, order, boundaries (first, last, empty page) and invalid parameter handling.

JIRA Query Language, used to search issues, for example project = ABC AND status = Open AND priority = High.

Re-check the requirement, reproduce with clear steps and evidence (screenshots, logs), discuss with the BA/PO and record the final decision.

They let testers verify totals and counts per category, such as the number of orders per customer, and compare them with the UI or reports.

Log and track bugs, link them to stories, build dashboards and filters with JQL, manage sprints and generate reports.

Peer review for clarity, coverage of requirements, correct expected results, test data and traceability, then update and baseline them.

The observation that a small number of modules contain most defects, so testing should focus on those areas.

Prioritising tests by the likelihood and impact of failure, so critical areas get the most coverage when time is limited.

A technique that tests all pairs of input values instead of every combination, greatly reducing test cases while catching most defects.

Testing how a system moves between states based on events, for example an order going from placed to paid to shipped to delivered.

Learning, test design and execution at the same time, without scripted cases — time-boxed sessions with a charter (e.g. 'explore checkout with coupons'), noting bugs and ideas. Great for finding edge cases.

Verifying the application works across different hardware, software and settings combinations.

Valid keyword, partial match, no results, special characters, very long text, empty search, case sensitivity, spelling errors, suggestions and speed of results.

INNER returns matching rows, LEFT keeps all left rows, RIGHT keeps all right rows and FULL keeps all rows from both tables.

The team selects stories for the sprint. QA helps estimate testing effort, clarifies acceptance criteria and flags dependencies and risks.

Statuses like To Do, In Progress, In Review, Ready for QA, Done and Reopened, with transitions that depend on the team's configuration.

A regular review where QA, development and product assess new bugs and decide severity, priority, owner and target release.

Defects found after release that testing should have caught; leakage % = defects in production / total defects x 100.

A suite is a collection of related test cases; a run is one execution of a set of tests against a build.

Valid transfer, insufficient balance, daily limit, wrong beneficiary, OTP failure, network drop mid-transaction, duplicate click and statement update.

A bug is behaviour that deviates from agreed requirements; an enhancement is a new or improved capability beyond the current requirements.

Positive cases use valid inputs to confirm expected behaviour; negative cases use invalid inputs to confirm the system handles errors gracefully.

Smoke tests run on every build for quick feedback; full regression runs less often, such as nightly or before release.

Scope (in and out), objectives, approach, environments, schedule, roles, entry/exit criteria, risks and mitigation, deliverables and tools.

Measuring speed and stability: load (expected users), stress (beyond limits), spike (sudden surge), endurance (long duration) and scalability testing.

State the problem, location and condition briefly, for example 'Checkout button disabled after applying a coupon on the cart page'.

A development model where each development phase has a matching testing phase, such as requirements with acceptance tests and design with integration tests.

An API style using HTTP methods on resources identified by URLs, usually exchanging JSON and staying stateless.

Re-testing existing features after a change. Automate stable, repetitive, high-value flows that run every release.

Keep tests modular, prioritise by risk, use exploratory testing, automate stable parts and keep close contact with product owners.

By business criticality, usage frequency, defect history, risk and dependencies, running high-priority cases first.

GET retrieves data and has parameters in the URL; POST sends data in the body to create or process something.

The extent of requirements or code exercised by tests. Measure requirement coverage with a traceability matrix and code coverage with tools.

Designing tests from user flows described in use cases to verify complete real-world interactions.

A model with many fast unit tests at the base, fewer API or integration tests in the middle and a small number of UI tests at the top.

Test on real devices and OS versions, interrupts such as calls, battery, network changes, gestures, permissions and app store guidelines.

The inputs used in tests. Prepare using valid, invalid and boundary values from production-like but masked data, spreadsheets or generators.

Mandatory fields, email format, password rules, duplicate email, terms checkbox, captcha, confirmation email and field length limits.

Static testing reviews documents and code without executing; dynamic testing executes the software to observe behaviour.

Rules such as NOT NULL, UNIQUE, PRIMARY KEY, FOREIGN KEY and CHECK that keep data valid and consistent.

200 OK, 201 Created, 204 No Content, 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 500 Internal Server Error.

An epic is a large body of work; stories are user-facing slices of it; tasks are technical work items; bugs are defects.

Valid card and PIN, wrong PIN, three failed attempts, amount above balance, amount above daily limit, invalid denomination, machine out of cash, network failure and receipt printing.

A defect that stops testing or release of a feature because no workaround exists, so it is highest priority.

Evaluating how easy and pleasant a product is to use by observing real users complete tasks and noting confusion.

Test execution rate, pass percentage, defect density, defect leakage, defect rejection ratio, requirement coverage and automation coverage.

Checking that people with disabilities can use the product, using screen readers, keyboard navigation, colour contrast and WCAG guidelines.

Sprint planning (estimate test effort), daily stand-up (status and blockers), sprint review (demo) and retrospective (improve). Testers clarify acceptance criteria early and test within the sprint.

Entry criteria are conditions that must be met to start testing (build ready, environment set); exit criteria define when testing can stop (pass rate, no critical defects).

A shared checklist for when a story is complete, usually including code review, tests passing, no open critical bugs and documentation updated.

Testing at the edges of input ranges, such as 17, 18 and 19 for an age limit of 18, since errors cluster at boundaries.

The number of defects per size of software, for example defects per thousand lines of code or per module, used to compare quality.

Using experience to guess where defects likely hide, such as empty fields, special characters or unexpected sequences, and designing tests for them.

Testing shows presence of defects, exhaustive testing is impossible, test early, defects cluster, the pesticide paradox, testing is context-dependent and absence-of-errors is a fallacy.

Re-check environment, data, browser and steps; check the logs; try the reporter's setup; add video and console logs; mark it 'cannot reproduce' only after discussing with the developer, and keep monitoring.

Check access with valid, expired and missing tokens, role-based permissions, error codes and that sensitive data is never exposed.

A grid mapping requirements to test cases and defects, proving every requirement is tested.

Create a request with method, URL, headers and body, send it, check status and body, add test scripts and save it in a collection.

Finding why a defect was introduced, such as unclear requirements or missed reviews, to prevent similar defects in future.

TDD writes unit tests before code to drive design; BDD describes behaviour in business language scenarios that become automated acceptance tests.

The pesticide paradox says that if you run the same tests again and again, they stop finding new defects, just as pests become resistant to the same pesticide. To counter it, regularly review and update test cases, add new scenarios from recent production bugs, vary test data, and mix scripted runs with exploratory sessions. Rotating testers across modules also brings fresh eyes and new ideas.

It means that finding and fixing many defects does not guarantee success if the system itself does not meet user needs. A bug-free product built on wrong or misunderstood requirements is still a failure. For example, a perfectly working report that shows the wrong business metric is useless to the client. This is why testers validate against real user expectations, not just the written specification.

Shift-left means starting testing activities earlier in the life cycle: reviewing requirements, joining design discussions and writing tests before code is complete. A defect found in requirements may cost a short conversation to fix, while the same defect found in production may need a hotfix, data correction and customer support. Testers shift left by asking questions in grooming, defining acceptance criteria and reviewing designs.

Check that each requirement is clear, complete, consistent and testable. Look for vague words like fast or user-friendly, missing error handling, undefined limits, conflicting rules and missing roles or states. For each requirement ask how you would test it and what the expected result is. Record questions in a review log and get answers from the business analyst before writing test cases, so ambiguity does not turn into defects later.

A test oracle is the source you use to decide whether a test result is correct, that is, the expected result. It can be a requirement document, a user story, an older version of the system, a calculation in a spreadsheet, a domain expert or common sense. For example, when testing a tax calculator, the official tax slab table is the oracle. Without a reliable oracle, you cannot say a test passed or failed.

Both are static review techniques. A walkthrough is informal and led by the author, who explains the document or code to peers to share knowledge and gather feedback. An inspection is the most formal review: it has defined roles such as moderator, reader and scribe, uses checklists, needs preparation and records defects and metrics. Inspections find more defects but take more effort.

First ask the product owner or business analyst for the expected behaviour and write down the answers as draft acceptance criteria. Meanwhile, explore the feature, compare it with similar existing features and list assumptions. Share the assumptions in the story so everyone agrees before you sign off. Raise the missing criteria in the next refinement so future stories are not picked up without them.

The tests verified the specification but did not validate the user experience. The test cases probably checked only functional outcomes and missed usability: unclear labels, too many steps or poor error messages. Next time, add usability heuristics to reviews, do exploratory sessions as a real user persona and involve users in UAT or demos. Log the current feedback as improvement items with clear examples.

Spend five minutes understanding its purpose and main user flows. Then run a quick smoke check of the main flow end to end, test key inputs with valid, invalid and boundary values, check links, buttons and error messages, and try the page on a second browser and a mobile width. Keep short notes and take screenshots as you go. Report the top issues by risk at the end, not every small cosmetic point.

Read the requirement and identify inputs, outputs, business rules, user roles and states. Turn each rule into a condition with an expected result, then add negative and boundary conditions. For example, 'users can withdraw up to 10,000 per day' becomes: withdraw below the limit, exactly at the limit, above the limit, multiple withdrawals adding up to the limit, and the limit resetting the next day. Each condition then becomes one or more test cases.

Model answer: Situation: before a release of an insurance app, all regression tests had passed. Task: I was doing a final exploratory round. Action: I renewed a policy on the last day of the month and saw that the premium was calculated for 31 days in a 30-day month. I logged it with exact data and the formula difference. Result: the date logic was fixed before release, and I added month-end cases to the suite.

Specification-based (black box) techniques derive tests systematically from requirements: equivalence partitioning, boundary values, decision tables, state transitions and use cases. They give measurable coverage. Experience-based techniques rely on the tester's knowledge and intuition: error guessing, exploratory testing and checklist-based testing. They are good at finding defects the specification never mentioned. Strong testers use specification techniques for coverage and experience techniques to fill the gaps.

Statement coverage measures the percentage of code statements executed by tests. Branch coverage measures whether every decision outcome, true and false, has been executed. Branch coverage is stronger: for 'if (amount > 1000) applyDiscount()', one test with 1500 gives 100 percent statement coverage, but you need a second test with 500 to cover the false branch. 100 percent branch coverage implies 100 percent statement coverage, not the other way round.

Model answer: Situation: I got a story for 'flexible EMI options' with only one line of description. Task: test it within the sprint. Action: I listed my assumptions on tenure, interest and rounding, reviewed them with the product owner in a 15-minute call, and wrote test cases only after we agreed. Result: three rules were changed before coding finished, and the feature passed UAT without rework.

Length partitions: below 8 (invalid), 8 to 16 (valid), above 16 (invalid). Boundaries: 7, 8, 9, 15, 16 and 17 characters. Digit partitions: contains a digit (valid), no digit (invalid). Sample tests: 'abc1234' with 7 characters is rejected, 'abcdefg1' with 8 is accepted, a 16-character value with a digit is accepted, 17 characters is rejected, and 'abcdefgh' with no digit is rejected. Also test empty input and spaces.

Verify a correct OTP within validity logs the user in. Verify a wrong OTP shows an error and an expired OTP is rejected. Check the OTP length and that only digits are allowed. Test resend: it is disabled during the countdown, and the old OTP stops working after resend. Check the maximum number of wrong attempts locks verification. Verify auto-read on mobile, paste support, and behaviour when the network drops during submission.

Apply a valid coupon and check the discount and final amount. Test invalid, expired and not-yet-active coupons. Check minimum order value, maximum discount cap and category restrictions. Verify one-time-use coupons cannot be reused and that only one coupon applies if stacking is not allowed. Check case sensitivity and leading or trailing spaces. Remove the coupon and confirm the total resets. Change cart items after applying and verify the discount is recalculated.

Send and receive text messages and check order and timestamps. Test sent, delivered and read status. Send emojis, long messages, links and attachments within and over the size limit. Check messages sent while offline are queued and delivered on reconnect. Verify blocking a user stops messages. Test notifications when the app is in background. Check chat history after reinstall or on a second device, and that deleted messages disappear for both users if supported.

Verify each status change appears in order: placed, accepted, preparing, picked up and delivered. Check the rider's location updates on the map at the expected interval. Test the estimated time updates when there is a delay. Verify notifications for each status. Check behaviour when the network drops and recovers, when the app is reopened, and when the order is cancelled midway. Confirm tracking stops after delivery and the rating screen appears.

Check the state list is empty or disabled until a country is selected. Select a country and verify the correct states load. Change the country and confirm the old state selection is cleared and the new list loads. Test countries with no states, a long list with scrolling and search, and default values on page load. Submit the form and verify the saved values, then reload and check both dropdowns keep the saved selection.

Export the cases and group them by module and requirement. Mark duplicates, merge them into one well-written case, and retire cases for removed features. Check which cases have not been executed or failed in months and confirm whether they are still valid. Link the remaining cases to requirements so gaps are visible. Do it module by module with peer review, and set a rule that every story update also updates its test cases.

The word fast is not testable, so ask the product owner for a measurable target, for example the page loads within 3 seconds on a 4G network for 95 percent of requests. Agree on the conditions: device, network, data size and whether it is first load or cached. Then write the test with those conditions and expected time. Record the agreed number in the story so the expected result is not open to opinion.

Use the wireframes and the user story as the test basis. Write test scenarios and high-level cases for the flows, field validations, navigation and error states shown in the design. Note open questions, such as missing empty states or error messages, and clarify them with the designer. Keep exact UI text and steps light so they are easy to update. Once the build arrives, refine the cases and add any missing details.

Write one clear objective per case, keep steps short and avoid hard-coding data that changes. Put shared steps such as login into a common precondition instead of repeating them. Use consistent naming, link each case to a requirement and group them by module. Keep expected results specific but not tied to exact pixel layouts. Review and update cases whenever a story changes, so the suite stays trustworthy for regression.

Reopen the bug when the same issue, with the same steps and expected result, still fails after the fix. Log a new bug when the fix works but a different problem appears, even in the same screen, or when the original bug has already been closed in a past release. Link the new bug to the old one. Mixing different problems in one reopened ticket confuses tracking and metrics.

Defect age is how long a defect stays open, measured either in time, from the date it was logged to the date it was closed, or in phases, from the phase where it was introduced to the phase where it was found. High defect age signals slow fixing or triage. Phase-based age shows how late defects are caught; a requirement defect found in UAT has a high age and is costly.

Defect removal efficiency shows how many defects the team found before release. DRE = defects found before release divided by (defects found before release plus defects found after release), multiplied by 100. If QA found 90 bugs and users reported 10, DRE is 90 percent. A falling DRE means testing is missing more defects, and the escaped bugs should be analysed to improve test coverage.

Create test cases as linked issues or in a test management add-on and link each one to its story with a tests relationship. When a test fails, create the bug from the test execution or link it to both the test and the story with is blocked by or relates to. Use the same fix version for all. A story then shows its tests and open bugs, which makes sign-off and the traceability report easy.

Won't Fix means the bug is acknowledged as real, but the team decides not to fix it, usually because the impact is very low, the feature is being retired or the cost of fixing is higher than the benefit. The decision is made by the product owner, often in triage with dev and QA leads. The tester should make sure the reason is recorded and, if user-facing, documented as a known issue.

Start with preconditions: environment, build number, user role and the exact data state, such as an account with two pending orders and zero wallet balance. Mention how to create the data or give the test account ID. Then list numbered steps with exact inputs and finish with expected and actual results. If the data is hard to set up, attach the SQL used or a database screenshot so the developer can recreate it quickly.

An open bug is any defect not yet resolved. A known issue is an open bug that the team has consciously agreed to release with, after assessing its impact, and has documented in release notes or support notes, often with a workaround. Every known issue is an open bug, but not every open bug should ship. QA makes sure known issues are listed and approved by the product owner.

Model answer: Situation: two days before a release, we found 15 new bugs in checkout. Task: help the team decide what to fix. Action: I stayed calm, retested each one quickly, ranked them by user impact, and shared a clear list in triage with must-fix and can-wait items. Result: we fixed five critical bugs, released on time with documented known issues, and no critical issue reached users.

A defect is a flaw in the software that makes it behave differently from the requirement, whether found in testing or production. A production incident is an event that disrupts or degrades service for users, such as an outage or a failed payment flow. An incident may be caused by a defect, but also by infrastructure, configuration or third-party failures. Incidents are handled by an incident process first, then linked to defects for the fix.

Model answer: Situation: I logged a bug where the invoice PDF showed the wrong GST number, and the developer marked it minor because the screen value was correct. Task: get the right priority. Action: I explained that customers use the PDF for tax filing and showed the requirement. Result: the product owner agreed it was major, it was fixed before release, and we added PDF checks to regression.

Model answer: Situation: a discount was applied twice when users pressed the pay button quickly. Task: I had tested the feature and missed it. Action: I owned it in the retrospective, helped reproduce and verify the fix, and added double-click and slow network cases to our checklist for all payment buttons. Result: similar issues were caught in later sprints, and I learned to always test repeated actions.

INVEST is a checklist for good user stories: Independent, Negotiable, Valuable, Estimable, Small and Testable. For testers, testable is the most important: a story must have clear acceptance criteria so you can say pass or fail. Small stories are easier to test within a sprint. If a story fails INVEST, raise it in refinement rather than discovering the gaps during testing.

Three Amigos is a short meeting where a business person or product owner, a developer and a tester discuss a story before development. The business explains the need, the developer considers how to build it and the tester asks what could go wrong and how it will be verified. The output is clear acceptance criteria and example scenarios. It prevents misunderstandings and reduces bugs found late.

Model answer: Situation: our sprints kept ending with stories stuck in testing. Task: suggest a fix in the retrospective. Action: I showed that most stories reached QA in the last two days and proposed smaller stories, early test case sharing and developers deploying to QA daily. Result: the team tried it next sprint, and the number of stories carried over dropped from five to one.

Yes, very likely. An index lets the database find rows quickly, like the index of a book. With a small QA table, a full table scan is still fast, but with millions of production rows it becomes slow. Compare indexes on the searched columns in both environments and ask a developer to check the query plan. Test key queries on production-size data in staging, and include data volume in future performance checks.

JSON schema validation checks that a response has the expected structure: required fields are present, data types are correct, formats like email or date are valid and no unexpected fields appear. Instead of checking only one value, it protects against contract changes that break the app. In Postman you can validate a response against a schema in the test script, and run it on every request in a collection.

Note the order ID and compare the UI value, the API response and the database value to find where they differ. Check if the UI calculates the total on the screen instead of using the saved value, whether taxes, discounts or rounding are applied at different layers and whether a later update job changed the record. Log the bug with all three values, because invoices and reports will use the database figure.

Tell the Scrum Master and product owner today, not at the review. Focus testing on the acceptance criteria and the riskiest paths of the story with the most value, and ask a developer to help with test data or simple checks. If a story cannot be finished with quality, it should be carried over, not marked done with untested parts. Raise the cause in the retrospective, such as late handover.

Usually yes. Status codes should reflect the result so clients and monitoring can react correctly; an error with 200 can hide failures and break retries. A validation error should return 400 or 422, a missing resource 404 and a server failure 500. Check the API contract first: some legacy APIs document this pattern. If it is not documented, log it as a defect with the request and response attached.

Model answer: Situation: our product owner added two small changes to a story mid-sprint, which pushed testing to the last day. Task: protect quality without being rigid. Action: I showed the extra test effort in stand-up and asked the Scrum Master to help decide what to swap out. Result: one change moved to the next sprint, and the team agreed new requests go through the backlog.

Both are temporary pieces of code used in integration testing when some modules are not ready. A stub replaces a called lower-level module and returns fixed responses, used in top-down testing; for example, a stub payment service that always returns success. A driver replaces a calling higher-level module and sends inputs to the module under test, used in bottom-up testing. In API testing, mock servers play the role of stubs.

Recovery testing checks how well the system recovers from crashes, hardware failures, network loss or other failures. For example, kill the server during a file upload, or disconnect the network during payment, and verify the system restores a consistent state, does not lose or duplicate data and resumes or shows a clear message. It also measures recovery time against agreed targets, which matters for banking and healthcare systems.

Installation testing checks that software installs correctly on supported systems: fresh install, custom paths, low disk space, missing prerequisites and clean uninstall. Upgrade testing checks moving from an older version to the new one: user data and settings must be kept, database migrations must run, and the app must work after the upgrade. Also test skipping versions, such as 1.2 to 1.5, and what happens if the upgrade is interrupted.

Use analytics to pick browsers and versions that most real users have, plus the ones listed in the requirement, usually the latest two versions of major desktop and mobile browsers. Run the main flows on each and check layout, fonts, forms, date pickers, file upload and JavaScript errors in the console. Use responsive mode for screen sizes, and real devices or a cloud device lab for mobile browsers.

QA does not decide which version wins, but makes sure the experiment is trustworthy. Verify both variants work end to end, users are split in the agreed ratio, each user sees the same variant consistently across sessions, and analytics events fire correctly for each group. Also check that turning the experiment off returns everyone to the default. A broken tracking event can make the whole experiment's result wrong.

Retest the change itself, then run a focused regression on every page type that uses the header: home, listing, detail, checkout and account. Check navigation links, search, login and logout state, cart count and the mobile menu. Do cross-browser and responsive checks because layout changes affect all sizes. A quick visual comparison against the previous build helps spot alignment issues across many pages.

Read the hotfix ticket to know exactly what changed. First verify the fix with the original reproduction steps and data. Then check the directly connected flows, for example if the fix is in coupon calculation, test applying, removing and paying with a coupon. Finish with a quick smoke of login and the main business flow. Report the result immediately, mentioning what was and was not covered.

Trigger the email from each event, such as signup or order placed, and verify it arrives at the right address within the expected time. Check subject, sender name, personalised fields, amounts and links. Click every link and confirm it opens the right page. Check the layout on desktop and mobile mail apps, the unsubscribe option where required, and that no email is sent for failed or cancelled actions. Use a test mailbox tool in QA.

Model answer: Situation: a new leave management module had passed all scripted cases. Task: I had a one-hour exploratory session. Action: I applied leave, then changed my manager in the profile while the request was pending. Result: the request disappeared for both managers and could never be approved. It was fixed before release, and the team added role-change scenarios to the regression suite.

A test strategy is a high-level document, often at organisation or product level, that defines the general approach: test levels, types, tools, environments, automation approach and standards. It changes rarely. A test plan is project or release specific: scope, schedule, resources, entry and exit criteria, risks and deliverables. The plan follows the strategy and applies it to a particular release.

Suspension criteria define when testing should be paused because continuing would waste effort, for example when a blocker bug stops the main flow, the build fails smoke testing or the environment is down. Resumption criteria define what must happen to restart, such as a new build that passes smoke testing or the environment restored. Writing these down avoids arguments and shows clearly why testing time was lost.

In sprint planning, review each story's acceptance criteria and estimate test effort, including test data and regression. Write test cases in the first days while development starts. Ask for early builds so testing is spread across the sprint, not crowded at the end. Keep time for regression and bug retesting in the last two or three days. Track progress on the board and raise risks in stand-up.

Rank test cases by business risk and usage: critical flows like login, payment and data saving first, then new features, then high-risk regression from past defects, and cosmetic checks last. Run smoke testing immediately to avoid wasting time on a broken build. Share the reduced plan with the lead and product owner so they know what will not be covered, and get agreement on the remaining risk.

Escalate immediately with the impact on the schedule. While it is down, prepare test data, review and update test cases, and test what you can elsewhere: API tests against another environment, UI on a developer machine or a staging copy. Track the lost hours in the status report. When the environment returns, run smoke first, then the prioritised list, and ask whether the release date or scope needs to change.

Test monitoring compares actual testing progress with the plan, using metrics like test cases executed, pass rate, open defects and effort spent. Test control is the action taken when monitoring shows a gap, such as re-prioritising tests, adding testers, changing the schedule or tightening entry criteria. For example, if half the time has passed but only a quarter of cases are executed, the lead must act and inform stakeholders.

Spend the first day learning the scope: read the release notes, user stories and test plan, and ask the lead what is at risk. Get access to the environment, tracker and test repository. Pick up a clearly defined module, run its existing test cases to learn the application and note gaps. Ask questions early in stand-up. Within a few days, take ownership of retesting and regression for that module.

Model answer: Situation: I was supporting two products whose releases fell in the same week. Task: deliver both without dropping quality. Action: I listed tasks by release date and risk, agreed priorities with both leads, blocked focus time for each product and shared daily status. I also asked a teammate to take retesting on one project. Result: both releases went out on time with no critical escapes.

Check that the app asks for permission only when the feature is used, with a clear reason. Test allow, deny, and deny with do not ask again. When denied, the app must not crash and should explain how to enable it in settings. Revoke permission from settings while the app is in background and return. Test allow only once or only while using the app options on newer OS versions.

Verify notifications arrive when the app is in foreground, background and closed. Check title, text, icon and that tapping opens the right screen with the correct data. Test with notifications disabled at OS level and inside app settings. Check behaviour after logout, reinstall and on multiple devices with the same account. Test grouping of many notifications, time-sensitive ones, and that no notification shows private data on the lock screen.

It checks app behaviour on different networks: Wi-Fi, 4G, 5G, slow 2G or 3G, high latency, packet loss and no network. Also test switching between Wi-Fi and mobile data in the middle of an action, and airplane mode. The app should show loaders and clear offline messages, retry safely without duplicate actions and not freeze. Network throttling tools in developer options or proxy tools help simulate these conditions.

Run typical user sessions on a real device and measure battery drain, CPU and memory with platform profiling tools or the device's battery statistics. Compare with the previous version. Look for background work continuing after the app is closed, GPS left on, frequent network polling and memory that keeps growing, which signals a leak. Test on low-RAM devices too, where the OS kills heavy apps quickly.

A deep link opens a specific screen inside the app from a URL, email, SMS, QR code or notification. Test that each link opens the correct screen with the right data when the app is installed, closed or running in background. If the app is not installed, it should open the store page or a web fallback. Test links that need login, expired or invalid links, and that parameters cannot be tampered with to access other users' data.

Android has many manufacturers, screen sizes and OS versions with custom skins, so device fragmentation and background-kill behaviour need more coverage. iOS has fewer devices but strict permission, privacy and store review rules. Navigation differs: Android has a system back button or gesture, iOS relies on in-app navigation and swipe back. Notification, permission and file-access behaviours also differ, so test cases need platform-specific steps.

Enable developer options and USB debugging, connect the phone and confirm it is visible with adb devices. Clear old logs with adb logcat -c, reproduce the bug, then save logs with adb logcat -d > crash_log.txt, filtering by the app package or error level if needed. For a crash, search for FATAL EXCEPTION. Attach the log, device model, OS version, app version and a screen recording to the bug.

Turn on the screen reader, TalkBack on Android or VoiceOver on iOS, and check every button, image and field has a meaningful label and the reading order is logical. Check text scales with system font size, colour contrast is sufficient and touch targets are large enough, about 48 by 48 density-independent pixels. Make sure information is not shown by colour alone and that the app works without complex gestures.

Test enabling biometrics in app settings after a password login. Verify login with a registered fingerprint or face, and failure with an unregistered one, falling back to PIN or password after the allowed attempts. Remove or add a fingerprint in device settings and check the app asks for re-authentication. Test devices without biometric hardware, disabled biometrics and app behaviour after an OS update or reinstall.

Test with location permission allowed, denied and approximate only. Use mock location tools to simulate different cities and moving routes. Verify the app shows nearby results correctly, updates location while moving and handles GPS turned off. Check accuracy indoors and with weak GPS, battery impact of continuous tracking and that background location is used only if needed and explained to the user.

Check that the form data is still there when the user returns after a few seconds and after a longer time. Test when the OS kills the app in background due to low memory, which you can force with developer options, and confirm the app restores state or at least warns the user. Also check session timeout behaviour and that sensitive screens are hidden in the recent apps view if required.

Model answer: Situation: users of one budget phone model reported that the camera upload screen was black. Task: reproduce it. Action: I borrowed the same model, found the issue only appeared when the battery saver was on, and logged the bug with the device model, OS version, logs and a video. Result: the developer fixed the camera initialisation, and we added that model to our device matrix.

An average hides slow requests. If 90 requests take 1 second and 10 take 10 seconds, the average is 1.9 seconds, which looks fine, but one user in ten waits 10 seconds. The p95 value means 95 percent of requests were faster than it, so it shows what most users actually experience, including the slow tail. Service level targets are usually written as percentiles, such as p95 under 2 seconds.

A performance baseline is a set of measurements of the current system under a known load, such as response times, throughput, error rate and resource usage. Every new build or release is compared with it to spot regressions. For example, if the checkout API had p95 of 800 milliseconds at 200 users last release and now shows 1.5 seconds, the change needs investigation. A benchmark compares against an industry or competitor standard.

Explain that daily users are not concurrent users. Of 50,000 users a day, only a fraction are active at the same moment, and even they pause between actions because of think time. Use analytics to find the real peak concurrency and request rate, for example 1,500 concurrent users at peak hour, and model that with a safety margin. Running 50,000 users clicking at once tests a load that never happens and wastes effort.

A bottleneck is the component that limits the whole system's performance, so adding load beyond it increases response times or errors. Common places are slow database queries or missing indexes, too few database connections or threads, CPU or memory limits on servers, slow third-party APIs, large uncompressed files and chatty code that makes many small calls. Monitoring each layer during a test shows which resource saturates first.

Collect details from affected users: location, device, browser, network and time. Try to reproduce with similar conditions using browser network throttling. Use the browser developer tools network tab to find slow requests, large files or failing calls, and compare with a fast user. Check whether those users have more data, like a long order history. Share the slow request, timing and conditions in the bug for the developers.

The OWASP Top 10 is a widely used list of the most critical web application security risks, published by an open community project. It includes broken access control, cryptographic failures, injection, insecure design, security misconfiguration, vulnerable components and authentication failures. Testers use it as a checklist to include basic security checks in their testing and to speak the same language as security teams.

SQL injection happens when user input is added directly into a database query, letting an attacker change the query to read or modify data. A tester can enter inputs like a single quote or ' OR '1'='1 in login, search and URL parameters and watch for database errors, unexpected results or a login bypass. Only test in approved environments. The real fix is parameterised queries, not input filtering alone.

XSS is a vulnerability where an attacker's script is injected into a page and runs in other users' browsers, which can steal session data or change the page. It occurs when user input is shown without proper encoding. Testers enter a harmless script tag or an image tag with an onerror alert in comments, profile names and search boxes, then check if it executes when the page is displayed. Output encoding prevents it.

Check that a new session ID is created after login, and that the session expires after the defined idle time. Verify logout invalidates the session on the server, so pressing back or reusing the old cookie does not work. Check that cookies use Secure, HttpOnly and SameSite flags. Test concurrent logins if they are limited, and that changing the password ends other sessions. Session IDs must not appear in URLs.

Check that responses return only needed fields, with no passwords, password hashes, full card numbers, full ID numbers or internal keys. Verify personal data is masked where required, for example only the last four digits of a phone number. Look at application and browser console logs for tokens or personal data. Check error responses do not expose stack traces, SQL or server versions. Raise any leak as a high-severity bug.

Treat it as a high-severity security defect, because storing full card numbers in logs breaks payment card security rules and creates a data leak risk. Do not copy the card numbers into the bug; use masked examples and the log location instead. Log the bug with restricted visibility and inform your lead and the security contact right away. After the fix, verify new logs are masked and confirm old logs are cleaned.

Scalability testing checks how well the system handles growing load by adding resources, such as more servers or bigger machines, and whether performance improves in proportion. For example, if two servers handle 1,000 users, do four servers handle about 2,000 at the same response time? It finds limits that resources cannot fix, such as a single database bottleneck, and helps plan capacity for future growth.

Data integrity means data stays accurate and consistent through its life. Entity integrity: every row has a unique, non-null primary key. Referential integrity: a foreign key always points to an existing parent row, such as every order pointing to a real customer. Domain integrity: values stay within allowed types and ranges, enforced by data types, CHECK and NOT NULL constraints. User-defined integrity covers business rules, such as an order total never being negative.

ACID means Atomicity, Consistency, Isolation and Durability. Atomicity: a transfer that debits one account must also credit the other, or neither happens; test by forcing a failure midway. Consistency: constraints still hold after the transaction. Isolation: two users updating together do not see each other's half-done work; test with two sessions. Durability: committed data survives a restart; test by committing, restarting the service and querying again.

First read what the trigger should do and when it fires, such as AFTER UPDATE on the salary column writing a row to an audit table. Then perform the event that should fire it and query the target table to confirm the expected row and values. Also perform events that should not fire it and confirm nothing happens. Check multi-row updates, NULL values and rollback: if the main statement fails, the trigger's changes must not remain.

Data mapping testing checks that each field on a screen, file or API goes to the correct table and column with the correct format. For example, the Date of Birth field on the signup form must land in users.dob as a date, and the State dropdown must store the state code, not the label. Testers use a mapping document, enter known values in the UI or API and query the database to compare field by field.

Normalization organises tables to reduce duplicate data, for example storing the customer address once in a customers table instead of repeating it in every order. Testers should understand it because it explains where data lives and which joins are needed to verify a screen. It also shows risk: in a denormalized report table, the same value is copied in many places, so updates must be tested to confirm every copy changes.

First query the main users table to see whether the update was saved. If it was, check where the report reads from: a view, a reporting copy, a cache or a nightly ETL table. The report may simply be stale until the next refresh, which may be by design. If the main table still has the old value, check the API request, the update query and any errors in logs, then log a bug with both query results.

Run the report query with GROUP BY on the business key and HAVING COUNT(*) > 1 to find which records repeat. Then check whether the duplicates exist in the base table or are created by the query, usually a new join to a one-to-many table such as addresses. Compare the query before and after the release. Include the duplicate keys, the count and the suspected join in the bug report.

This suggests the input is not handled safely, possibly string-built SQL, which is also a SQL injection risk. Test names with apostrophes, double quotes, Hindi and other Unicode text, emojis, leading spaces and maximum length. Query the database to confirm the exact stored value and character encoding. Then check the value displays correctly everywhere it is read back. Log a high-severity bug and mention the possible injection risk.

Create your own data with a clear prefix or tag, such as emails starting with qa_ravi_, or IDs in a reserved range. Insert data through the app or API where possible so it follows real rules, and keep SQL setup scripts in version control. After testing, delete only your tagged rows, or run inside a transaction and roll back. Never edit shared master data without telling the team.

Situation: a wallet refund screen showed success for every test. Task: I wanted to confirm the balance logic. Action: I queried the wallet_transactions table and saw two refund rows when I double-clicked the submit button, though the UI showed one. I logged it with both query outputs and the steps. Result: developers added an idempotency key, and the team added a database check to our regression checklist.

A latent defect exists in the software but has not caused a failure yet because the needed conditions have not occurred, such as a leap-year bug that appears only on 29 February. A masked defect is hidden by another defect, for example a broken discount calculation you cannot reach because the cart page crashes first. After the first bug is fixed, the masked one appears, which is one reason regression and retesting matter.

A bug bash is a short, time-boxed session where people from across the team, including developers, product and support, test the product together to find as many issues as possible before a release. To run one, share a build, scope and test accounts, assign focus areas, give a simple bug template and a shared board, then triage findings at the end. It brings fresh eyes and finds usability issues formal tests miss.

Compliance testing checks that software meets external laws, standards or internal policies, not just functional requirements. Examples include payment security standards for card data, data protection rules for personal data, accessibility guidelines and RBI rules for banking apps. Testers verify items such as consent capture, data retention, audit logs and masking. Findings are usually documented as evidence for auditors, so traceability and clear records matter as much as the tests.

A test readiness review is a checkpoint before formal test execution starts, where the team confirms everything needed is in place. It checks that the build is deployed and smoke tested, the environment and test data are ready, test cases are reviewed and approved, access and tools work, and entry criteria are met. It prevents wasted days when execution starts and testers discover a missing service or empty database.

Fill the device storage close to the limit, then install or update the app and confirm a clear message if it cannot proceed. Inside the app, try downloads, photo capture, caching and saving drafts. The app should show a helpful error, not crash or corrupt data. Also check what happens to the local database when a write fails, and whether the app recovers after space is freed.

Situation: a new seller onboarding flow was due in a week and only two testers had seen it. Task: I wanted wider coverage quickly. Action: I set up a one-hour bug bash with developers, product and support, shared test accounts, focus areas and a simple bug form, then triaged findings with the lead. Result: we found 18 issues, including two blockers on low-end phones, and fixed them before launch.

Turn on the screen reader, for example NVDA with a browser, and listen rather than look. Navigate by headings to check the structure is logical, by landmarks to find main regions and by Tab through controls. Each control should announce a clear name, role and state, such as 'Subscribe, checkbox, not checked'. Check images, form errors, dynamic updates like cart counts and dialogs. Note exactly what was announced in bug reports.

Contrast ratio compares the brightness of text and its background, from 1:1 to 21:1. WCAG AA requires at least 4.5:1 for normal text and 3:1 for large text, which is about 18 point or 14 point bold. User interface parts such as input borders and icons need 3:1. AAA raises text to 7:1. Testers check this with a contrast checker or browser developer tools, including placeholder, disabled and hover states.

Check that every field has a visible label tied to it, so clicking the label focuses the field and a screen reader announces it. Required fields must be indicated in text, not only by colour or an asterisk without explanation. Submit with errors and check that messages are specific, appear next to the field, are announced by the screen reader and focus moves to the first error. Also check autocomplete for name, email and address.

Common tools are axe DevTools, Lighthouse in Chrome, WAVE and accessibility linters in CI. They quickly catch missing alt text, low contrast, missing labels and invalid ARIA. Their limit is that they find only roughly a third of WCAG issues. They cannot judge whether alt text is meaningful, focus order is logical, error messages make sense or a custom widget works with a screen reader, so manual testing is still required.

Set browser zoom to 200 percent and check that all text is readable and no content or buttons are cut off. Then zoom to 400 percent, or use a 1280 pixel wide window, which gives a 320 CSS pixel viewport; content should reflow into one column without horizontal scrolling, except for things like data tables and maps. Also increase text spacing and the operating system font size to check that labels do not overlap.

Check that prerecorded videos have accurate, synchronised captions, not just auto-generated ones with errors, and that audio-only content like podcasts has a transcript. Important visual information that is not spoken should have audio description or be covered in the transcript. Media should not autoplay with sound, and player controls must work by keyboard and be announced by screen readers. Also check that nothing flashes more than three times per second.

Heuristic evaluation is an expert review where a few evaluators inspect the interface against known usability principles, such as Nielsen's ten heuristics, and list problems with severity. It is fast and cheap and needs no participants. A usability test watches real users perform tasks and shows where they actually struggle. Heuristic reviews find many obvious issues early, but they can miss problems that only real users with real goals reveal.

Define goals and three to five realistic tasks, such as 'Book a train ticket for next Friday'. Recruit participants who match real users. In the session, explain that you are testing the product, not them, ask them to think aloud, and avoid hinting even when they struggle. Record the screen with consent, note where they hesitate or fail, and finish with a short questionnaire. Then group findings by severity and frequency.

Log it as a high-severity accessibility bug because it fully blocks a group of users from signing up. An image-only CAPTCHA fails WCAG unless an alternative is offered. Recommend options such as invisible or risk-based bot checks, an email or OTP verification step, an audio alternative plus another modality, and rate limiting on the server. Retest the full signup with NVDA and TalkBack after the change.

The toolbar uses icon-only buttons without accessible names, so users hear the role but not the purpose. Report it with the page, the screen reader and browser versions, the exact announcement and the expected one, such as 'Bold, toggle button, not pressed'. Reference WCAG 4.1.2 Name, Role, Value. The fix is an aria-label or visually hidden text on each button, plus a tooltip that also helps sighted users.

Not necessarily. Automated tools catch only a part of WCAG issues, such as missing labels and contrast. A clean scan still needs manual checks: keyboard-only navigation, focus order, a screen reader pass, meaningful alt text and link names, error handling, zoom and reflow and dynamic content. Report the result as 'no automated violations found' and add the manual checklist outcome before claiming conformance.

Give a clear title, such as 'Checkout: Place Order button not reachable by keyboard'. Include the page URL, browser, operating system and assistive technology with versions. Write exact steps, what was announced or happened, and what was expected. Add the WCAG success criterion, such as 2.1.1 Keyboard, and the user impact. Attach a screenshot or audio recording, and suggest a fix when obvious. Severity should reflect whether users are fully blocked.

Check that buttons and icons are large enough to tap without hitting neighbours: Android guidance is 48 by 48 dp and iOS is 44 by 44 points. Test with large font settings and one-handed use. Any action using complex gestures, such as swipe to delete or pinch, must have a simple tap alternative. Then turn on TalkBack and VoiceOver and confirm each control can be focused, named and activated.

Situation: before a release, I found the payment form errors were not announced by screen readers and not reachable by keyboard. Task: the team wanted to defer it. Action: I recorded a short NVDA video showing a user could not finish payment, linked it to WCAG and our customer commitments, and proposed a small fix. Result: the fix took half a day, shipped in the release and we added keyboard checks to our definition of done.

Situation: while testing a leave application form, every test case passed. Task: I still felt the flow was confusing. Action: I noticed the date picker started on Sunday and the half-day option was hidden under 'More', so I asked two colleagues to apply for leave while I watched; both made mistakes. I logged a usability suggestion with notes. Result: product moved the option and support queries dropped.

Android phone makers ship their own skins and settings on top of Android, so the same app can behave differently. Common problems are aggressive battery savers that kill background tasks and delay notifications, different permission screens, custom fonts and display scaling, camera differences and modified WebViews. Pick devices from the brands most used by your audience and test background work, notifications, camera and layout on each.

Send requests with missing required fields, wrong data types, values beyond limits, invalid formats such as a bad email, unknown fields and an empty or malformed JSON body. The API should return a 4xx code such as 400 or 422, a clear error message that names the field, and no stack trace or database details. Also check that nothing was partly saved in the database after the failed request.

Selenium is the oldest, uses the WebDriver standard, supports many languages like Java, Python and C# and every major browser, and is common in older enterprise suites. Playwright supports TypeScript, Python, Java and .NET, runs Chromium, Firefox and WebKit, and has built-in auto-waiting, tracing and parallel runs. Cypress runs inside the browser with JavaScript or TypeScript, has a friendly runner and is popular with front-end teams.

A position-based XPath such as /html/body/div[3]/div[2]/button breaks whenever a developer adds a wrapper div or reorders the layout, even though the feature still works. That creates false failures and maintenance work. Locators based on a dedicated data-testid attribute or the accessible role and name, like a button named Submit, stay valid through design changes and describe intent clearly. Testers should ask developers to add test IDs.

An implicit wait, in Selenium, sets a global time the driver keeps retrying to find any element before failing. An explicit wait waits for a specific condition, such as an element being clickable or a spinner disappearing, and is more precise. Auto-waiting, built into Playwright and Cypress, automatically waits for elements to be visible, enabled and stable before acting. Mixing implicit and explicit waits in Selenium can cause unpredictable delays.

The Page Object Model is a design pattern where each page or major component gets a class that holds its locators and actions, such as LoginPage with a login method. Tests call these methods instead of using locators directly. When the login button changes, you update one place instead of fifty tests. Tests become readable, like steps a manual tester would write, and duplication drops. Keep assertions mostly in tests, not page objects.

A flaky test passes and fails on the same code without any change. Common causes are timing problems such as fixed sleeps or missing waits, tests depending on each other or on shared data, unstable locators, animations, third-party services, test order in parallel runs and environment issues like slow servers. Flaky tests destroy trust in the suite, so teams quarantine them, find the root cause and fix it rather than adding retries forever.

Data-driven testing runs the same test steps many times with different input and expected values taken from a table, CSV, JSON or spreadsheet. For example, one login test can run with valid users, locked users, wrong passwords and blank fields. It reuses the logic, makes adding cases easy and maps well to equivalence partitioning and boundary values from manual design. Tools support it through parameterised tests, such as pytest.mark.parametrize.

Pick a small set of stable, high-value regression cases first. Review each one: make steps precise, remove judgement-based checks and define clear expected results. Prepare test data that the script can create and clean up. Build reusable page objects and helpers for common steps like login. Automate, run several times to confirm stability, then link each script to its manual case ID and mark the manual case as automated.

UI automation drives the browser or app like a user, so it checks the full experience but is slower and breaks more often with design changes. API automation sends requests directly to services and checks responses, which is much faster, more stable and can run before the UI exists. API tests give faster feedback, so teams place most business rule checks at the API level and keep a smaller set of UI journeys.

Stop using the dynamic ID. Look for a stable alternative: the element's role and visible name, its label, a stable attribute, or a relative locator based on a nearby fixed element. The best long-term fix is asking developers to add a data-testid attribute. Avoid partial matches on random strings, which can break again. Then update the locator in the page object so every test using it is fixed at once.

A useful report shows total tests run, passed, failed and skipped, the run time, the environment, build number and browser. For each failure it should show the test name, the failing step, the error message, and a screenshot, video or trace, plus logs. Trends across runs help spot flaky tests. Linking failures to Jira bugs or manual case IDs helps managers see real product risk, not just numbers.

Visual regression testing takes screenshots of pages or components and compares them with approved baseline images to detect unexpected layout, font, colour or spacing changes that functional assertions miss. When a difference crosses a threshold, a person reviews it and either accepts the new baseline or logs a bug. Dynamic content like dates and ads must be masked, and the same browser and screen size must be used to avoid noise.

Most frameworks support this through configuration. In Playwright, set screenshot to only-on-failure, video to retain-on-failure and trace to on-first-retry in the config, then open the trace viewer to step through actions, network calls and the page state. In Selenium, call save_screenshot in a teardown hook when a test fails. Store these artefacts in CI so anyone can debug the failure without rerunning it.

Situation: a small tax rounding change was made late on a Friday. Task: no manual regression was planned for pricing. Action: our nightly API suite failed one data-driven case where a 3-item cart was off by one rupee; I checked the trace, reproduced it manually and logged it with the failing input. Result: it was fixed before release, and the team agreed to keep pricing tests in the pull request suite.

Appium is an open-source tool for automating native, hybrid and mobile web apps on Android and iOS using the WebDriver protocol. Tests can be written in Java, Python, JavaScript and other languages, and it uses platform drivers such as UiAutomator2 for Android and XCUITest for iOS. It can run on emulators, simulators, real devices and cloud device farms. Stable accessibility IDs make the best locators for it.

I agree the split with the team at sprint planning. Testing new stories manually comes first because it blocks the sprint goal. I then automate the stable flows from the previous sprint, so scripts are not rewritten while features change. For example, I block two afternoons a week for automation and report progress in stand-up. If a release is at risk, I pause automation and tell the lead openly.

Answer with strengths and honesty. For example: I am strong at understanding requirements, designing test cases with techniques like boundary values and finding bugs through exploratory testing, which automation depends on to be useful. I also write SQL and test APIs in Postman. I am learning Playwright and have automated a few smoke tests, so I can grow into automation while adding value from the first week.