Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About Postman hiring for Software Testing roles
Postman is an API platform used by millions of developers to design, test, document and monitor APIs. It began as a side project by Abhinav Asthana in Bengaluru and grew into a global company with headquarters in San Francisco. Its Bengaluru office hosts major engineering teams that hire software engineers, test engineers, developer advocates and product roles.
For Software Testing roles, this Postman practice set focuses most on Agile, SQL and API Testing (6), Database Testing (6), Accessibility & Usability Testing (5), STLC and Test Planning (5). It has 3 easy, 21 medium, 16 hard questions, so you can start easy and work up to the harder ones.
Company type
Product
Headquarters
San Francisco, USA
Main India offices
Bengaluru
Postman Software Testing interview process
Online coding assessment or take-home task
Technical round 1 (DSA or problem solving)
Technical round 2 (system design or API design)
Hiring manager and culture round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for PostmanStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
How do you test form accessibility, including labels and error messages?
Check that every field has a visible label tied to it, so clicking the label focuses the field and a screen reader announces it. Required fields must be indicated in text, not only by colour or an asterisk without explanation. Submit with errors and check that messages are specific, appear next to the field, are announced by the screen reader and focus moves to the first error. Also check autocomplete for name, email and address.
02
A dashboard shows pass or fail status only with red and green dots. What is the issue?
This relies on colour alone to give information, which fails WCAG criterion 1.4.1. Users with red-green colour blindness, which affects a noticeable share of men, cannot tell the states apart, and screen readers announce nothing. Recommend adding text or icons such as a tick and a cross with labels like 'Passed' and 'Failed', and accessible names for the dots. Test with a colour blindness simulator in browser developer tools.
03
The sprint ends tomorrow and two stories are still in testing. What do you do?
Tell the Scrum Master and product owner today, not at the review. Focus testing on the acceptance criteria and the riskiest paths of the story with the most value, and ask a developer to help with test data or simple checks. If a story cannot be finished with quality, it should be carried over, not marked done with untested parts. Raise the cause in the retrospective, such as late handover.
04
Your team wants to use an AI tool to generate test cases and automation scripts. What benefits and risks do you point out?
AI assistants can draft test cases from requirements, suggest edge cases, generate first versions of scripts and test data, and some tools self-heal locators when the page changes. Risks are confident but wrong output, tests that assert the wrong behaviour, hidden locator changes that mask real bugs and leaking confidential data into external tools. Treat AI output like a junior's draft: review it, run it and keep human judgement on what matters.
05
The app crashes only on one older Android version. What are your steps?
Reproduce it on that exact OS version, using a real device or an emulator image, and note the device model and app build. Capture the crash log and stack trace. Check if the code uses an API or library not supported on that version, or a permission or storage behaviour that changed. Log the bug with logs and the minimum supported version from the requirement, so the team can decide to fix it or raise the minimum version.
06
The test environment is down for two days just before release. What do you do?
Escalate immediately with the impact on the schedule. While it is down, prepare test data, review and update test cases, and test what you can elsewhere: API tests against another environment, UI on a developer machine or a staging copy. Track the lost hours in the status report. When the environment returns, run smoke first, then the prioritised list, and ask whether the release date or scope needs to change.
Entry criteria are conditions that must be met to start testing (build ready, environment set); exit criteria define when testing can stop (pass rate, no critical defects).
08
A manager wants 100 percent test automation. How do you respond?
I agree with the goal of faster and more reliable testing, but explain that 100 percent is neither possible nor useful. Exploratory testing, usability, visual judgement and brand-new features need people, and some flows like real payments or OTP are costly to automate reliably. I would propose clear targets instead, such as automating all critical regression and smoke flows, with metrics like regression time cut from three days to four hours.
09
Tell me about a time you had to push back on a release date.
Model answer: Situation: a loan app release was planned on Friday, but the EMI schedule showed wrong values for some tenures. Task: give an honest recommendation. Action: I presented the failing cases, the number of affected customers and the compliance risk in the go or no-go meeting, and proposed a three-day delay with a fix plan. Result: management agreed, the fix shipped on Monday, and no complaints came in.
10
A feature passed all your test cases, but users say it is confusing. What went wrong?
The tests verified the specification but did not validate the user experience. The test cases probably checked only functional outcomes and missed usability: unclear labels, too many steps or poor error messages. Next time, add usability heuristics to reviews, do exploratory sessions as a real user persona and involve users in UAT or demos. Log the current feedback as improvement items with clear examples.
11
Search works fine in QA but is very slow in production. Could a missing database index be the reason, and how do you check?
Yes, very likely. An index lets the database find rows quickly, like the index of a book. With a small QA table, a full table scan is still fast, but with millions of production rows it becomes slow. Compare indexes on the searched columns in both environments and ask a developer to check the query plan. Test key queries on production-size data in staging, and include data volume in future performance checks.
Turn on the screen reader, for example NVDA with a browser, and listen rather than look. Navigate by headings to check the structure is logical, by landmarks to find main regions and by Tab through controls. Each control should announce a clear name, role and state, such as 'Subscribe, checkbox, not checked'. Check images, form errors, dynamic updates like cart counts and dialogs. Note exactly what was announced in bug reports.
13
What do you check in mobile accessibility testing?
Turn on the screen reader, TalkBack on Android or VoiceOver on iOS, and check every button, image and field has a meaningful label and the reading order is logical. Check text scales with system font size, colour contrast is sufficient and touch targets are large enough, about 48 by 48 density-independent pixels. Make sure information is not shown by colour alone and that the app works without complex gestures.
Cross-site request forgery tricks a logged-in user's browser into sending an unwanted request to a site, such as changing their email, because the browser automatically includes cookies. Prevention includes anti-CSRF tokens in forms, SameSite cookie settings and re-authentication for sensitive actions. Testers check that state-changing requests fail when the token is missing or reused, and that such actions are not done through GET requests.
15
An API returns 200 OK but the body contains an error message. Is that a bug?
Usually yes. Status codes should reflect the result so clients and monitoring can react correctly; an error with 200 can hide failures and break retries. A validation error should return 400 or 422, a missing resource 404 and a server failure 500. Check the API contract first: some legacy APIs document this pattern. If it is not documented, log it as a defect with the request and response attached.
16
A security scan says your login page can be loaded inside a frame on other sites. What is the risk and how do you confirm it?
Clickjacking tricks a user into clicking something on your site while it is hidden inside a frame on an attacker's page, for example a hidden Transfer button under a fake Play button. A tester checks whether sensitive pages can be loaded in an iframe on another site, and inspects response headers for Content-Security-Policy frame-ancestors or X-Frame-Options set to DENY or SAMEORIGIN. If the page loads in the frame, log it.
17
A developer changed a shared header component used on every page. What testing do you plan?
Retest the change itself, then run a focused regression on every page type that uses the header: home, listing, detail, checkout and account. Check navigation links, search, login and logout state, cart count and the mobile menu. Do cross-browser and responsive checks because layout changes affect all sizes. A quick visual comparison against the previous build helps spot alignment issues across many pages.
18
SQL: find rows where mandatory columns are NULL or empty in a customers table.
-- Mandatory fields: name, email, phone
SELECT id, name, email, phone
FROM customers
WHERE name IS NULL OR TRIM(name) = ''
OR email IS NULL OR TRIM(email) = ''
OR phone IS NULL OR TRIM(phone) = '';
-- Expected result: no rows
19
SQL: find orders whose total does not match the sum of their order items.
SELECT o.order_id, o.total_amount,
SUM(i.quantity * i.unit_price) AS items_total
FROM orders o
JOIN order_items i ON i.order_id = o.order_id
GROUP BY o.order_id, o.total_amount
HAVING o.total_amount <> SUM(i.quantity * i.unit_price);
20
What is a go or no-go meeting and what does QA present?
A go or no-go meeting is held before release to decide whether to deploy. QA presents test coverage against scope, pass and fail counts, open defects by severity with their impact, known issues and workarounds, any untested areas and the overall risk. QA gives a recommendation, but the business owner decides. The decision and accepted risks should be recorded in the meeting notes.
Appium is an open-source tool for automating native, hybrid and mobile web apps on Android and iOS using the WebDriver protocol. Tests can be written in Java, Python, JavaScript and other languages, and it uses platform drivers such as UiAutomator2 for Android and XCUITest for iOS. It can run on emulators, simulators, real devices and cloud device farms. Stable accessibility IDs make the best locators for it.
The Page Object Model is a design pattern where each page or major component gets a class that holds its locators and actions, such as LoginPage with a login method. Tests call these methods instead of using locators directly. When the login button changes, you update one place instead of fifty tests. Tests become readable, like steps a manual tester would write, and duplication drops. Keep assertions mostly in tests, not page objects.
23
SQL: verify that row counts and totals match between a source table and a target table after a data load.
-- Compare counts and sums side by side; both columns must match
SELECT
(SELECT COUNT(*) FROM staging_orders) AS src_count,
(SELECT COUNT(*) FROM dw_orders) AS tgt_count,
(SELECT SUM(amount) FROM staging_orders) AS src_amount,
(SELECT SUM(amount) FROM dw_orders) AS tgt_amount;
24
How do you design test cases for role-based access with admin, editor and viewer roles?
Build a permission matrix with roles as rows and actions as columns, such as create, edit, delete, publish and view, marking allowed or denied from the requirement. Write a positive test for each allowed cell and a negative test for each denied one. Test through the UI and also call the APIs directly, because hidden buttons are not security. Check role changes take effect immediately and that users cannot access other users' data by changing IDs.
25
Which accessibility laws and standards matter for products used in India and abroad?
In India, the Rights of Persons with Disabilities Act 2016 requires accessible information and communication technology, and government sites follow the GIGW guidelines, which align with WCAG. Abroad, the US uses the ADA and Section 508, Europe uses EN 301 549, and the European Accessibility Act applies to many digital products and services from June 2025. Most of these point to WCAG AA as the practical testing target.
Save filters for common views such as my open bugs, bugs ready for retest, blockers in the current sprint and bugs by fix version. Add them to a dashboard with gadgets like pie charts by priority, created versus resolved trend and a sprint bug list. Share the dashboard with the team so status is visible without manual reports. Testers start their day from the ready-for-retest filter.
27
What is the difference between DELETE and TRUNCATE?
Internationalisation tests that the product can support many languages and formats; localisation tests that a specific locale is correct for text, currency, date and layout.
29
A security reviewer asks you to confirm that passwords and personal data are stored safely. What do you check in the database?
Query the users table after signup and confirm the password is not stored in plain text or reversible encoding, but as a salted hash from a slow algorithm such as bcrypt or Argon2. Two users with the same password should have different hashes. Check that card numbers are not stored at all or are tokenised, that personal data like Aadhaar numbers is masked or encrypted, and that logs and audit tables do not copy the raw values.
30
You change the order ID in a URL and see another customer's order. What is this and what do you do?
This is an insecure direct object reference, a form of broken access control and a critical security bug, because any user can read other users' data. Stop exploring further beyond what is needed to confirm it, record the request, accounts used and evidence, and log it as a critical bug with restricted visibility. Inform the lead and security contact immediately. The fix is a server-side ownership check on every request.
Collect exact details: user, time, device, browser and request IDs. Compare production with QA for configuration, feature flags, data volume, third-party integrations, versions and caching. Ask for production logs and error traces through the support or dev team. Try to reproduce in QA with production-like data or in a staging environment. Once found, add a test for the gap and fix the environment difference if one caused it.
Find the documented limit, for example 100 requests per minute per key. Send requests just below and above the limit and check that extra requests get 429 Too Many Requests with a Retry-After header. Verify the counter resets after the window and that limits apply per key or per IP as designed. Check that one user hitting the limit does not block others, and that normal traffic is not throttled.
34
Notifications arrive late, and some screens look broken, only on certain Android phone brands. Why can this happen and what do you test?
Android phone makers ship their own skins and settings on top of Android, so the same app can behave differently. Common problems are aggressive battery savers that kill background tasks and delay notifications, different permission screens, custom fonts and display scaling, camera differences and modified WebViews. Pick devices from the brands most used by your audience and test background work, notifications, camera and layout on each.
First query the main users table to see whether the update was saved. If it was, check where the report reads from: a view, a reporting copy, a cache or a nightly ETL table. The report may simply be stale until the next refresh, which may be by design. If the main table still has the old value, check the API request, the update query and any errors in logs, then log a bug with both query results.
37
A load test shows good response times but a 15 percent error rate. How do you interpret it?
The result is a failure, not a pass. Failed requests often return quickly, so they make response times look better than they are. Check which requests fail and with which errors, such as 500, 503 or timeouts, and when errors started relative to the load level. Look at server logs, connection pool and thread limits. Also confirm the script is not wrong, for example expired tokens or bad test data.
38
What automated accessibility tools exist and what are their limits?
Common tools are axe DevTools, Lighthouse in Chrome, WAVE and accessibility linters in CI. They quickly catch missing alt text, low contrast, missing labels and invalid ARIA. Their limit is that they find only roughly a third of WCAG issues. They cannot judge whether alt text is meaningful, focus order is logical, error messages make sense or a custom widget works with a screen reader, so manual testing is still required.
39
A monthly report query runs on millions of rows and takes minutes. How do you test and report its performance?
Test on a database with production-like volume, not a small QA dataset. Measure the run time several times and note the filters used. Ask for or run the execution plan to see whether it does full table scans or uses indexes. Compare with the agreed target, such as under five seconds. Report the query, data volume, timings and plan, and retest after fixes such as indexes, date filters or summary tables.
40
How do you set up and clean test data for database tests without affecting other testers?
Create your own data with a clear prefix or tag, such as emails starting with qa_ravi_, or IDs in a reserved range. Insert data through the app or API where possible so it follows real rules, and keep SQL setup scripts in version control. After testing, delete only your tagged rows, or run inside a transaction and roll back. Never edit shared master data without telling the team.
Tips to crack the Postman Software Testing interview
Learn REST API concepts thoroughly, including HTTP methods, status codes, authentication and how to write API tests in Postman.
Practise DSA problems and be ready to build or debug a small JavaScript or Node.js feature in a practical round.
Show genuine developer empathy by discussing tools you use daily and how you would improve the API development workflow.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; Postman interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the Postman Software Testing interview?
Candidates usually go through 4 stages: Online coding assessment or take-home task; Technical round 1 (DSA or problem solving); Technical round 2 (system design or API design); Hiring manager and culture round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the Postman Software Testing interview?
This practice set leans on Agile, SQL and API Testing (6), Database Testing (6), Accessibility & Usability Testing (5), STLC and Test Planning (5). Revise those first, then practise explaining one or two of your own projects end to end, because most Postman interviewers ask you to walk through real work.
Are these the exact questions asked at Postman?
No. These are curated practice questions that match the skills and difficulty usually tested in product interviews like Postman's. They are not a leaked or verified list of past questions.
Where does Postman hire Software Testing professionals in India?
Postman has large teams in Bengaluru. Openings and locations change often, so check the Postman careers page and filter by city and experience.