Scenario-Based Software Testing Interview Questions

Assess impact and risk, discuss with product and dev, decide to fix, defer with a workaround or delay release, and document the decision.

Re-check the requirement, reproduce with clear steps and evidence (screenshots, logs), discuss with the BA/PO and record the final decision.

Success, failure and pending flows, timeouts, refunds, double-click payments, every method (UPI, cards, net banking), rounding, security (no card data stored) and reconciliation with bank reports.

Talk to developers and users, explore the product, review similar systems, create notes and mind maps, confirm assumptions and write test cases as you learn.

Risk-based testing: cover critical user flows, recent changes and high-defect areas first. Clearly communicate the untested risks and get stakeholder sign-off.

Use mocks or stubs from the API contract such as Swagger, write test cases early and validate again when the real service is available.

Keep tests modular, prioritise by risk, use exploratory testing, automate stable parts and keep close contact with product owners.

Reproduce and assess impact, inform stakeholders, help developers fix and verify in staging, run regression and check monitoring after the hotfix, then do a post-mortem.

Check SQL injection, brute-force lockout, password masking, session timeout, HTTPS, cookie flags, error messages not revealing users and password reset flow.

Re-check environment, data, browser and steps; check the logs; try the reporter's setup; add video and console logs; mark it 'cannot reproduce' only after discussing with the developer, and keep monitoring.

Login is a blocker because no other testing can proceed. Confirm it quickly: retry with valid test accounts, check another browser and confirm the right environment and build number. Then log a blocker bug with steps, screenshot and console or network errors, inform the developer and lead immediately, and mark the build as rejected in smoke testing. Meanwhile, prepare test data or review test cases until a fixed build arrives.

First ask the product owner or business analyst for the expected behaviour and write down the answers as draft acceptance criteria. Meanwhile, explore the feature, compare it with similar existing features and list assumptions. Share the assumptions in the story so everyone agrees before you sign off. Raise the missing criteria in the next refinement so future stories are not picked up without them.

Use data, not opinion. Show defects caught before release by severity, production incidents and their cost, and defect leakage trends. Explain what risk increases if testing is cut, then offer options: risk-based testing of critical flows, more automation for regression, and developers owning unit tests. Agree on which risks the business accepts in writing. This turns the discussion into a trade-off decision instead of a conflict.

The tests verified the specification but did not validate the user experience. The test cases probably checked only functional outcomes and missed usability: unclear labels, too many steps or poor error messages. Next time, add usability heuristics to reviews, do exploratory sessions as a real user persona and involve users in UAT or demos. Log the current feedback as improvement items with clear examples.

Check the state list is empty or disabled until a country is selected. Select a country and verify the correct states load. Change the country and confirm the old state selection is cleared and the new list loads. Test countries with no states, a long list with scrolling and search, and default values on page load. Submit the form and verify the saved values, then reload and check both dropdowns keep the saved selection.

Export the cases and group them by module and requirement. Mark duplicates, merge them into one well-written case, and retire cases for removed features. Check which cases have not been executed or failed in months and confirm whether they are still valid. Link the remaining cases to requirements so gaps are visible. Do it module by module with peer review, and set a rule that every story update also updates its test cases.

The word fast is not testable, so ask the product owner for a measurable target, for example the page loads within 3 seconds on a 4G network for 95 percent of requests. Agree on the conditions: device, network, data size and whether it is first load or cached. Then write the test with those conditions and expected time. Record the agreed number in the story so the expected result is not open to opinion.

Use the wireframes and the user story as the test basis. Write test scenarios and high-level cases for the flows, field validations, navigation and error states shown in the design. Note open questions, such as missing empty states or error messages, and clarify them with the designer. Keep exact UI text and steps light so they are easy to update. Once the build arrives, refine the cases and add any missing details.

Build a permission matrix with roles as rows and actions as columns, such as create, edit, delete, publish and view, marking allowed or denied from the requirement. Write a positive test for each allowed cell and a negative test for each denied one. Test through the UI and also call the APIs directly, because hidden buttons are not security. Check role changes take effect immediately and that users cannot access other users' data by changing IDs.

Test both states: flag on and flag off, so existing users are not affected. Verify the targeting rule assigns the right users and that a user stays consistently in the same group. Test switching the flag on and off in a live session and confirm data created with the flag on still works after it is turned off. Check analytics events for both groups and confirm the flag can be rolled back quickly.

Reopen the bug when the same issue, with the same steps and expected result, still fails after the fix. Log a new bug when the fix works but a different problem appears, even in the same screen, or when the original bug has already been closed in a past release. Link the new bug to the old one. Mixing different problems in one reopened ticket confuses tracking and metrics.

Collect exact details: user, time, device, browser and request IDs. Compare production with QA for configuration, feature flags, data volume, third-party integrations, versions and caching. Ask for production logs and error traces through the support or dev team. Try to reproduce in QA with production-like data or in a staging environment. Once found, add a test for the gap and fix the environment difference if one caused it.

First confirm you are testing the right build, which contains the fix, and clear the cache. Repeat the exact steps and data from the bug. If it still fails, reopen the bug with a comment stating the build number, what you did and the actual result, with a fresh screenshot or video. Talk to the developer directly if the steps differ from what they tested, so the fix is not tested on a different scenario.

Stop the retest loop and call a short session with the developer, lead and product owner. Check whether the fix addresses the root cause or only the symptom, whether everyone agrees on the expected behaviour and whether different environments or data are involved. Run a root cause analysis and agree on clear acceptance tests before the next fix. Add an automated regression check so it cannot silently return.

Run a backlog grooming session with the product owner. Close bugs that are obsolete, no longer reproducible or for retired features. Merge duplicates. Group the rest by module and user impact, and ask whether a few related bugs can be fixed together as one story. Agree to reserve a small share of each sprint for bug fixes. Set an ageing rule, for example review any bug older than 90 days.

Keep it short and decision-oriented. Show open bugs by severity, the created versus resolved trend, blockers with owners and dates, defect leakage from the last release and modules with the most defects. Give a clear recommendation, such as ready, ready with known issues or not ready, with reasons. Use a shared dashboard for detail, and one slide or email summary for leaders who need only the risk picture.

Yes, very likely. An index lets the database find rows quickly, like the index of a book. With a small QA table, a full table scan is still fast, but with millions of production rows it becomes slow. Compare indexes on the searched columns in both environments and ask a developer to check the query plan. Test key queries on production-size data in staging, and include data volume in future performance checks.

Find the documented limit, for example 100 requests per minute per key. Send requests just below and above the limit and check that extra requests get 429 Too Many Requests with a Retry-After header. Verify the counter resets after the window and that limits apply per key or per IP as designed. Check that one user hitting the limit does not block others, and that normal traffic is not throttled.

Note the order ID and compare the UI value, the API response and the database value to find where they differ. Check if the UI calculates the total on the screen instead of using the saved value, whether taxes, discounts or rounding are applied at different layers and whether a later update job changed the record. Log the bug with all three values, because invoices and reports will use the database figure.

Tell the Scrum Master and product owner today, not at the review. Focus testing on the acceptance criteria and the riskiest paths of the story with the most value, and ask a developer to help with test data or simple checks. If a story cannot be finished with quality, it should be carried over, not marked done with untested parts. Raise the cause in the retrospective, such as late handover.

Usually yes. Status codes should reflect the result so clients and monitoring can react correctly; an error with 200 can hide failures and break retries. A validation error should return 400 or 422, a missing resource 404 and a server failure 500. Check the API contract first: some legacy APIs document this pattern. If it is not documented, log it as a defect with the request and response attached.

Start small. Agree on a definition of ready and definition of done that include acceptance criteria and testing. Join refinement and run Three Amigos for every story. Set up a simple bug workflow and severity guide in the tracker, a shared test case repository and a smoke checklist for each build. Then add API checks and automated regression for stable flows. Review what works in each retrospective and adjust.

QA does not decide which version wins, but makes sure the experiment is trustworthy. Verify both variants work end to end, users are split in the agreed ratio, each user sees the same variant consistently across sessions, and analytics events fire correctly for each group. Also check that turning the experiment off returns everyone to the default. A broken tracking event can make the whole experiment's result wrong.

Compare record counts per table before and after. Check field mapping, data types, formats, encodings and default values for a sample of records, including edge cases like nulls, special characters and very old records. Verify relationships are kept, such as each order still linked to its customer. Run key business reports in both systems and compare totals. Test the rollback plan and confirm the new application works with migrated data.

Retest the change itself, then run a focused regression on every page type that uses the header: home, listing, detail, checkout and account. Check navigation links, search, login and logout state, cart count and the mobile menu. Do cross-browser and responsive checks because layout changes affect all sizes. A quick visual comparison against the previous build helps spot alignment issues across many pages.

Ask the developer which code, services and database tables changed. Map them to impacted flows: all payment methods, refunds, partial payments, failed payment retries, invoices and order status updates. Add high-risk areas from past defects and anything that calls the same service. Run full payment regression because the business risk is high, plus a smoke test of the rest of the application before release.

Explain the risk: system testing proves the software matches the specification, but only users confirm it fits real business work. Propose a lighter option instead of none: a short, focused UAT on critical flows with two or three key users, or a staged rollout to a small user group with monitoring and quick rollback. If they still skip it, record the decision and the accepted risks with the product owner.

Read the hotfix ticket to know exactly what changed. First verify the fix with the original reproduction steps and data. Then check the directly connected flows, for example if the fix is in coupon calculation, test applying, removing and paying with a coupon. Finish with a quick smoke of login and the main business flow. Report the result immediately, mentioning what was and was not covered.

Rank test cases by business risk and usage: critical flows like login, payment and data saving first, then new features, then high-risk regression from past defects, and cosmetic checks last. Run smoke testing immediately to avoid wasting time on a broken build. Share the reduced plan with the lead and product owner so they know what will not be covered, and get agreement on the remaining risk.

Escalate immediately with the impact on the schedule. While it is down, prepare test data, review and update test cases, and test what you can elsewhere: API tests against another environment, UI on a developer machine or a staging copy. Track the lost hours in the status report. When the environment returns, run smoke first, then the prioritised list, and ask whether the release date or scope needs to change.

Identify the integration points and the service's sandbox, limits and test data. Plan to test with a mock or stub early for our logic and error handling, then against the real sandbox for integration. Include failure scenarios: timeout, slow responses, invalid data and the service being down. Add the dependency to the risk list, with contacts and a fallback plan, and confirm production credentials and monitoring before go-live.

Do not copy raw production data into test environments. Use synthetic data generated for the test cases, or masked production data where names, phone numbers, emails, ID numbers and card details are replaced while formats and relationships are kept. Restrict access to test databases and record the data rules in the test plan. This keeps testing realistic and follows India's data protection law and company policy.

Spend the first day learning the scope: read the release notes, user stories and test plan, and ask the lead what is at risk. Get access to the environment, tracker and test repository. Pick up a clearly defined module, run its existing test cases to learn the application and note gaps. Ask questions early in stand-up. Within a few days, take ownership of retesting and regression for that module.

Use the app's analytics, or market data if it is a new app, to find the top devices, OS versions and screen sizes. In India, cover a strong share of budget and mid-range Android phones with low RAM, a few manufacturers' custom Android skins, the two or three latest Android versions, and recent iPhones if iOS is supported. Add a tablet if relevant. Review the matrix each quarter and use a cloud device lab for wider coverage.

Reproduce it on that exact OS version, using a real device or an emulator image, and note the device model and app build. Capture the crash log and stack trace. Check if the code uses an API or library not supported on that version, or a permission or storage behaviour that changed. Log the bug with logs and the minimum supported version from the requirement, so the team can decide to fix it or raise the minimum version.

Use the platform's sandbox or test accounts so no real money is charged. Test a successful purchase, cancellation, payment failure, pending payment, refund and restoring purchases on a new device. For subscriptions, test free trial, renewal, upgrade, downgrade, expiry and grace period, often with shortened test durations. Verify the server records the purchase and unlocks features, and that killing the app mid-purchase does not lose it.

Turn off the network and perform supported actions, such as creating, editing and deleting records, and check they are saved locally with a pending status. Reconnect and verify everything syncs once, in order, with no duplicates. Test conflicts, where the same record is changed on two devices, and confirm the agreed rule applies. Test sync after app restart, on a slow network and when the server rejects a change.

Check that the form data is still there when the user returns after a few seconds and after a longer time. Test when the OS kills the app in background due to low memory, which you can force with developer options, and confirm the app restores state or at least warns the user. Also check session timeout behaviour and that sensitive screens are hidden in the recent apps view if required.

Collect details from reviews and support: devices, OS versions and app version when it started. Compare battery usage of the current and previous versions on the same devices over a typical session and while idle in background. Use profiling tools to look for background location, wake locks, frequent sync or network polling. Share measurements with developers, verify the fix with the same method, and add a battery check to release testing.

Explain that daily users are not concurrent users. Of 50,000 users a day, only a fraction are active at the same moment, and even they pause between actions because of think time. Use analytics to find the real peak concurrency and request rate, for example 1,500 concurrent users at peak hour, and model that with a safety margin. Running 50,000 users clicking at once tests a load that never happens and wastes effort.

Collect details from affected users: location, device, browser, network and time. Try to reproduce with similar conditions using browser network throttling. Use the browser developer tools network tab to find slow requests, large files or failing calls, and compare with a fast user. Check whether those users have more data, like a long order history. Share the slow request, timing and conditions in the bug for the developers.

The result is a failure, not a pass. Failed requests often return quickly, so they make response times look better than they are. Check which requests fail and with which errors, such as 500, 503 or timeouts, and when errors started relative to the load level. Look at server logs, connection pool and thread limits. Also confirm the script is not wrong, for example expired tokens or bad test data.

This is an insecure direct object reference, a form of broken access control and a critical security bug, because any user can read other users' data. Stop exploring further beyond what is needed to confirm it, record the request, accounts used and evidence, and log it as a critical bug with restricted visibility. Inform the lead and security contact immediately. The fix is a server-side ownership check on every request.

Treat it as a high-severity security defect, because storing full card numbers in logs breaks payment card security rules and creates a data leak risk. Do not copy the card numbers into the bug; use masked examples and the log location instead. Log the bug with restricted visibility and inform your lead and the security contact right away. After the fix, verify new logs are masked and confirm old logs are cleaned.

Start with low-cost steps. Add an OWASP-based security checklist to the definition of done for stories touching login, payments or personal data. Train testers on access control, injection and session checks. Add automated dependency and vulnerability scans to the CI pipeline. Include negative authorization tests in API suites. Arrange a penetration test before major releases and track security bugs separately with clear severity rules.

A deadlock happens when two transactions each hold a lock the other needs, so neither can continue. The database detects it and kills one transaction with an error. During testing it usually appears under concurrent load, for example two users booking the last seats at once, as random failures or 'deadlock detected' entries in logs. Testers report the exact actions and timing, and developers fix it with consistent lock order or shorter transactions.

Open the same record in two sessions, change different fields and save both, then change the same field and save both. Check the database to see which value won and whether data was silently lost. A good design uses optimistic locking, where the second save fails with a 'record changed, please reload' message because a version column changed. Also repeat with API calls fired together to catch timing issues the UI hides.

First query the main users table to see whether the update was saved. If it was, check where the report reads from: a view, a reporting copy, a cache or a nightly ETL table. The report may simply be stale until the next refresh, which may be by design. If the main table still has the old value, check the API request, the update query and any errors in logs, then log a bug with both query results.

Run the report query with GROUP BY on the business key and HAVING COUNT(*) > 1 to find which records repeat. Then check whether the duplicates exist in the base table or are created by the query, usually a new join to a one-to-many table such as addresses. Compare the query before and after the release. Include the duplicate keys, the count and the suspected join in the bug report.

This suggests the input is not handled safely, possibly string-built SQL, which is also a SQL injection risk. Test names with apostrophes, double quotes, Hindi and other Unicode text, emojis, leading spaces and maximum length. Query the database to confirm the exact stored value and character encoding. Then check the value displays correctly everywhere it is read back. Log a high-severity bug and mention the possible injection risk.

Query the users table after signup and confirm the password is not stored in plain text or reversible encoding, but as a salted hash from a slow algorithm such as bcrypt or Argon2. Two users with the same password should have different hashes. Check that card numbers are not stored at all or are tokenised, that personal data like Aadhaar numbers is masked or encrypted, and that logs and audit tables do not copy the raw values.

Take a backup of a test database with known data, record row counts and a few checksums, then restore it to a separate server. Compare counts, sample records, constraints and users. Measure how long restore takes against the recovery time objective, and check that point-in-time restore loses no more data than the recovery point objective allows. A backup that has never been restored is not proven, so this test should run regularly.

Check how timestamps are stored, ideally in UTC with a time zone aware type. Create a record from a user in IST and another in a different zone, then query the raw value and compare it with what each user sees on screen. Test boundaries such as orders placed just before midnight IST, which fall on the previous UTC date, and daylight saving changes for foreign users. Reports grouped by date are a common bug area.

Test on a database with production-like volume, not a small QA dataset. Measure the run time several times and note the filters used. Ask for or run the execution plan to see whether it does full table scans or uses indexes. Compare with the agreed target, such as under five seconds. Report the query, data volume, timings and plan, and retest after fixes such as indexes, date filters or summary tables.

Fill the device storage close to the limit, then install or update the app and confirm a clear message if it cannot proceed. Inside the app, try downloads, photo capture, caching and saving drafts. The app should show a helpful error, not crash or corrupt data. Also check what happens to the local database when a write fails, and whether the app recovers after space is freed.

A memory leak happens when an application keeps holding memory it no longer needs, so usage grows the longer it runs. A manual tester may notice the app getting slower over a long session, a browser tab using more and more memory in Task Manager or the browser's memory panel, or a mobile app crashing after repeatedly opening and closing a screen. Report the steps, duration and memory readings over time.

Check that prerecorded videos have accurate, synchronised captions, not just auto-generated ones with errors, and that audio-only content like podcasts has a transcript. Important visual information that is not spoken should have audio description or be covered in the transcript. Media should not autoplay with sound, and player controls must work by keyboard and be announced by screen readers. Also check that nothing flashes more than three times per second.

Log it as a high-severity accessibility bug because it fully blocks a group of users from signing up. An image-only CAPTCHA fails WCAG unless an alternative is offered. Recommend options such as invisible or risk-based bot checks, an email or OTP verification step, an audio alternative plus another modality, and rate limiting on the server. Retest the full signup with NVDA and TalkBack after the change.

This relies on colour alone to give information, which fails WCAG criterion 1.4.1. Users with red-green colour blindness, which affects a noticeable share of men, cannot tell the states apart, and screen readers announce nothing. Recommend adding text or icons such as a tick and a cross with labels like 'Passed' and 'Failed', and accessible names for the dots. Test with a colour blindness simulator in browser developer tools.

The toolbar uses icon-only buttons without accessible names, so users hear the role but not the purpose. Report it with the page, the screen reader and browser versions, the exact announcement and the expected one, such as 'Bold, toggle button, not pressed'. Reference WCAG 4.1.2 Name, Role, Value. The fix is an aria-label or visually hidden text on each button, plus a tooltip that also helps sighted users.

Not necessarily. Automated tools catch only a part of WCAG issues, such as missing labels and contrast. A clean scan still needs manual checks: keyboard-only navigation, focus order, a screen reader pass, meaningful alt text and link names, error handling, zoom and reflow and dynamic content. Report the result as 'no automated violations found' and add the manual checklist outcome before claiming conformance.

First look at what step three asks: maybe address entry, a surprise delivery charge or forced signup. Check analytics for errors, rage clicks and time spent, and watch session recordings if available. Test it yourself on mobile and slow networks. Then run a quick usability test with five users on that step. Present evidence with likely causes and options, such as guest checkout or showing charges earlier, and measure after the change.

Agree on scope: key user journeys and page templates, not every page. Day one, run automated scans on all templates to fix easy issues fast. Then do manual checks of each journey with keyboard, NVDA, VoiceOver on mobile, zoom and contrast. Log issues with WCAG references and severity, and get blockers fixed first. Retest fixes and deliver a conformance summary with known issues. Be honest if full compliance is not realistic.

Testing is complete when agreed exit criteria are met, not when the bug count is zero. Check that planned tests ran, critical and high bugs are fixed or formally accepted, and remaining open bugs have workarounds and low user impact. Present the list with risk to the product owner, who decides on release. Record accepted bugs as known issues, so nothing is hidden and they are planned for a later release.

Android phone makers ship their own skins and settings on top of Android, so the same app can behave differently. Common problems are aggressive battery savers that kill background tasks and delay notifications, different permission screens, custom fonts and display scaling, camera differences and modified WebViews. Pick devices from the brands most used by your audience and test background work, notifications, camera and layout on each.

Clickjacking tricks a user into clicking something on your site while it is hidden inside a frame on an attacker's page, for example a hidden Transfer button under a fake Play button. A tester checks whether sensitive pages can be loaded in an iframe on another site, and inspects response headers for Content-Security-Policy frame-ancestors or X-Frame-Options set to DENY or SAMEORIGIN. If the page loads in the frame, log it.

Check the CI logs, screenshots, video or trace to see exactly where it failed. Then compare the environments: headless versus headed browser, screen size, browser version, time zone, environment URLs and secrets, test data and network speed. Run the test locally in headless mode with the CI settings. Common causes are timing, missing data in the CI environment and tests depending on run order. Fix the cause, not with a sleep.

Pull request checks must be fast, usually under ten to fifteen minutes, and highly reliable, so they include unit tests, API tests for changed services and a small UI smoke set of critical flows. The full UI regression, cross-browser runs, long data-driven suites and performance checks run nightly or before release. Tag tests by suite, measure run times and flakiness, and move tests between suites based on value and speed.

Compare cost and savings over time. Cost includes building scripts, framework setup, tools, CI infrastructure and ongoing maintenance, often a large share of total effort. Savings include manual execution hours saved per run multiplied by runs per year, earlier bug detection and faster releases. For example, a 40-hour manual regression run every two weeks saves about 1000 hours a year. Tests that run rarely or break often may never pay back.

Do not automate all 500. First clean the suite: remove duplicates and outdated cases. Rank the rest by business risk, run frequency and stability. Start with a smoke set of 20 to 30 critical journeys and move rule-heavy checks to the API level. Choose a tool that fits the team's skills, build a simple framework with page objects and CI runs, then expand in batches while tracking time saved and flakiness.

Stop using the dynamic ID. Look for a stable alternative: the element's role and visible name, its label, a stable attribute, or a relative locator based on a nearby fixed element. The best long-term fix is asking developers to add a data-testid attribute. Avoid partial matches on random strings, which can break again. Then update the locator in the page object so every test using it is fixed at once.

A useful report shows total tests run, passed, failed and skipped, the run time, the environment, build number and browser. For each failure it should show the test name, the failing step, the error message, and a screenshot, video or trace, plus logs. Trends across runs help spot flaky tests. Linking failures to Jira bugs or manual case IDs helps managers see real product risk, not just numbers.

I agree with the goal of faster and more reliable testing, but explain that 100 percent is neither possible nor useful. Exploratory testing, usability, visual judgement and brand-new features need people, and some flows like real payments or OTP are costly to automate reliably. I would propose clear targets instead, such as automating all critical regression and smoke flows, with metrics like regression time cut from three days to four hours.

Each test should create the data it needs, usually through an API or database helper, use unique values such as an email with a timestamp, and clean up afterwards. Avoid tests that depend on data made by another test or on a shared account other tests change. For fixed reference data, seed it before the suite runs. Independent data allows tests to run in parallel and in any order without random failures.

AI assistants can draft test cases from requirements, suggest edge cases, generate first versions of scripts and test data, and some tools self-heal locators when the page changes. Risks are confident but wrong output, tests that assert the wrong behaviour, hidden locator changes that mask real bugs and leaking confidential data into external tools. Treat AI output like a junior's draft: review it, run it and keep human judgement on what matters.