Software Testing Technical Round Questions &amp; Answers

Show answer

Spend five minutes understanding its purpose and main user flows. Then run a quick smoke check of the main flow end to end, test key inputs with valid, invalid and boundary values, check links, buttons and error messages, and try the page on a second browser and a mobile width. Keep short notes and take screenshots as you go. Report the top issues by risk at the end, not every small cosmetic point.

SQL: verify that soft-deleted users do not appear in the active users list.

Show answer

-- the active list query used by the app should return 0 rows here SELECT u.user_id, u.email FROM users u WHERE u.is_deleted = 1 AND u.user_id IN ( SELECT user_id FROM active_users_view );

What is a test closure report?

STLC and Test PlanningEasy

Show answer

A final document summarising what was tested, defects found and open, metrics, lessons learned and the recommendation for release.

What is data integrity and what are its main types?

Database TestingMedium

Show answer

Data integrity means data stays accurate and consistent through its life. Entity integrity: every row has a unique, non-null primary key. Referential integrity: a foreign key always points to an existing parent row, such as every order pointing to a real customer. Domain integrity: values stay within allowed types and ranges, enforced by data types, CHECK and NOT NULL constraints. User-defined integrity covers business rules, such as an order total never being negative.

What goes into a test plan?

STLC and Test PlanningMedium

Show answer

Scope (in and out), objectives, approach, environments, schedule, roles, entry/exit criteria, risks and mitigation, deliverables and tools.

A load test shows good response times but a 15 percent error rate. How do you interpret it?

Performance and Security BasicsHard

Show answer

The result is a failure, not a pass. Failed requests often return quickly, so they make response times look better than they are. Check which requests fail and with which errors, such as 500, 503 or timeouts, and when errors started relative to the load level. Look at server logs, connection pool and thread limits. Also confirm the script is not wrong, for example expired tokens or bad test data.

Write test cases for a calculator app.

Show answer

Basic operations, division by zero, decimals, large numbers, order of operations, clear and backspace, repeated operations and memory keys.

What is the pesticide paradox and how do you counter it?

Show answer

The pesticide paradox says that if you run the same tests again and again, they stop finding new defects, just as pests become resistant to the same pesticide. To counter it, regularly review and update test cases, add new scenarios from recent production bugs, vary test data, and mix scripted runs with exploratory sessions. Rotating testers across modules also brings fresh eyes and new ideas.

What are transaction isolation levels and what is a dirty read?

Database TestingHard

Show answer

Isolation levels control how much one transaction can see of another's uncommitted work. Common levels are Read Uncommitted, Read Committed, Repeatable Read and Serializable. A dirty read is reading data another transaction changed but has not committed; if it rolls back, you acted on data that never existed. Testers check isolation using two database sessions: update without committing in one and query in the other to see what is visible.

Write test cases for a coupon code field at checkout.

Show answer

Apply a valid coupon and check the discount and final amount. Test invalid, expired and not-yet-active coupons. Check minimum order value, maximum discount cap and category restrictions. Verify one-time-use coupons cannot be reused and that only one coupon applies if stacking is not allowed. Check case sensitivity and leading or trailing spaces. Remove the coupon and confirm the total resets. Change cart items after applying and verify the discount is recalculated.

What is SQL injection and how can a tester check for it at a basic level?

Show answer

SQL injection happens when user input is added directly into a database query, letting an attacker change the query to read or modify data. A tester can enter inputs like a single quote or ' OR '1'='1 in login, search and URL parameters and watch for database errors, unexpected results or a login bypass. Only test in approved environments. The real fix is parameterised queries, not input filtering alone.

What are common HTTP status codes?

Show answer

200 OK, 201 Created, 204 No Content, 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 500 Internal Server Error.

What is a performance bottleneck and where do bottlenecks usually occur?

Show answer

A bottleneck is the component that limits the whole system's performance, so adding load beyond it increases response times or errors. Common places are slow database queries or missing indexes, too few database connections or threads, CPU or memory limits on servers, slow third-party APIs, large uncompressed files and chatty code that makes many small calls. Monitoring each layer during a test shows which resource saturates first.

What is a bug bash and how do you run one?

Bug Life Cycle and JiraMedium

Show answer

A bug bash is a short, time-boxed session where people from across the team, including developers, product and support, test the product together to find as many issues as possible before a release. To run one, share a build, scope and test accounts, assign focus areas, give a simple bug template and a shared board, then triage findings at the end. It brings fresh eyes and finds usability issues formal tests miss.

What is a sprint planning meeting and what does QA contribute?

Show answer

The team selects stories for the sprint. QA helps estimate testing effort, clarifies acceptance criteria and flags dependencies and risks.

A security reviewer asks you to confirm that passwords and personal data are stored safely. What do you check in the database?

Database TestingHard

Show answer

Query the users table after signup and confirm the password is not stored in plain text or reversible encoding, but as a salted hash from a slow algorithm such as bcrypt or Argon2. Two users with the same password should have different hashes. Check that card numbers are not stored at all or are tokenised, that personal data like Aadhaar numbers is masked or encrypted, and that logs and audit tables do not copy the raw values.

The test environment is down for two days just before release. What do you do?

STLC and Test PlanningMedium

Show answer

Escalate immediately with the impact on the schedule. While it is down, prepare test data, review and update test cases, and test what you can elsewhere: API tests against another environment, UI on a developer machine or a staging copy. Track the lost hours in the status report. When the environment returns, run smoke first, then the prioritised list, and ask whether the release date or scope needs to change.

What is cross-site scripting (XSS)?

Show answer

XSS is a vulnerability where an attacker's script is injected into a page and runs in other users' browsers, which can steal session data or change the page. It occurs when user input is shown without proper encoding. Testers enter a harmless script tag or an image tag with an onerror alert in comments, profile names and search boxes, then check if it executes when the page is displayed. Output encoding prevents it.

What is the difference between a test suite and a test run?

STLC and Test PlanningMedium

Show answer

A suite is a collection of related test cases; a run is one execution of a set of tests against a build.

How do you capture screenshots, videos and traces when an automated test fails?

Automation Basics for Manual TestersMedium

Show answer

Most frameworks support this through configuration. In Playwright, set screenshot to only-on-failure, video to retain-on-failure and trace to on-first-retry in the config, then open the trace viewer to step through actions, network calls and the page state. In Selenium, call save_screenshot in a teardown hook when a test fails. Store these artefacts in CI so anyone can debug the failure without rerunning it.

What is the difference between a walkthrough and an inspection?

Show answer

Both are static review techniques. A walkthrough is informal and led by the author, who explains the document or code to peers to share knowledge and gather feedback. An inspection is the most formal review: it has defined roles such as moderator, reader and scribe, uses checklists, needs preparation and records defects and metrics. Inspections find more defects but take more effort.

What is Appium at a high level?

Mobile TestingMedium

Show answer

Appium is an open-source tool for automating native, hybrid and mobile web apps on Android and iOS using the WebDriver protocol. Tests can be written in Java, Python, JavaScript and other languages, and it uses platform drivers such as UiAutomator2 for Android and XCUITest for iOS. It can run on emulators, simulators, real devices and cloud device farms. Stable accessibility IDs make the best locators for it.

What is decision table testing?

Show answer

List conditions and actions in a table and cover every combination of conditions (rules) — ideal for business rules like loan approval: salary > X AND credit score > Y → approve.

Write test cases for a shopping cart.

Show answer

Add, remove, update quantity, price and tax calculation, coupon codes, stock limits, cart persistence after login and checkout navigation.

Explain three-point estimation for testing with an example.

STLC and Test PlanningHard

Show answer

Three-point estimation uses an optimistic (O), most likely (M) and pessimistic (P) estimate for each task. The weighted formula is (O + 4M + P) divided by 6. If testing a module would take 4 days at best, 6 days most likely and 14 days at worst, the estimate is (4 + 24 + 14) / 6 = 7 days. It includes uncertainty in a single number and is often combined with a work breakdown of test activities.

What does the absence-of-errors fallacy mean?

Show answer

It means that finding and fixing many defects does not guarantee success if the system itself does not meet user needs. A bug-free product built on wrong or misunderstood requirements is still a failure. For example, a perfectly working report that shows the wrong business metric is useless to the client. This is why testers validate against real user expectations, not just the written specification.

How do you test API error handling for invalid input?

Show answer

Send requests with missing required fields, wrong data types, values beyond limits, invalid formats such as a bad email, unknown fields and an empty or malformed JSON body. The API should return a 4xx code such as 400 or 422, a clear error message that names the field, and no stack trace or database details. Also check that nothing was partly saved in the database after the failed request.

How do you test push notifications?

Mobile TestingMedium

Show answer

Verify notifications arrive when the app is in foreground, background and closed. Check title, text, icon and that tapping opens the right screen with the correct data. Test with notifications disabled at OS level and inside app settings. Check behaviour after logout, reinstall and on multiple devices with the same account. Test grouping of many notifications, time-sensitive ones, and that no notification shows private data on the lock screen.

A page loads slowly only for some users. How do you investigate as a manual tester?

Show answer

Collect details from affected users: location, device, browser, network and time. Try to reproduce with similar conditions using browser network throttling. Use the browser developer tools network tab to find slow requests, large files or failing calls, and compare with a fast user. Check whether those users have more data, like a long order history. Share the slow request, timing and conditions in the bug for the developers.

What is the difference between static and dynamic testing?

Show answer

Static testing reviews documents and code without executing; dynamic testing executes the software to observe behaviour.

Why do performance reports use percentiles like p90 and p95 instead of averages?

Show answer

An average hides slow requests. If 90 requests take 1 second and 10 take 10 seconds, the average is 1.9 seconds, which looks fine, but one user in ten waits 10 seconds. The p95 value means 95 percent of requests were faster than it, so it shows what most users actually experience, including the slow tail. Service level targets are usually written as percentiles, such as p95 under 2 seconds.

What is JSON schema validation in API testing?

Show answer

JSON schema validation checks that a response has the expected structure: required fields are present, data types are correct, formats like email or date are valid and no unexpected fields appear. Instead of checking only one value, it protects against contract changes that break the app. In Postman you can validate a response against a schema in the test script, and run it on every request in a collection.

How do you set up and clean test data for database tests without affecting other testers?

Database TestingMedium

Show answer

Create your own data with a clear prefix or tag, such as emails starting with qa_ravi_, or IDs in a reserved range. Insert data through the app or API where possible so it follows real rules, and keep SQL setup scripts in version control. After testing, delete only your tagged rows, or run inside a transaction and roll back. Never edit shared master data without telling the team.

What is defect clustering?

Show answer

The observation that a small number of modules contain most defects, so testing should focus on those areas.

Write a Postman test script that checks the status is 201 and the response contains an id.

Show answer

pm.test('Status is 201', function () { pm.response.to.have.status(201); }); pm.test('Response has id', function () { const body = pm.response.json(); pm.expect(body).to.have.property('id'); pm.expect(body.id).to.be.a('number'); });

A report shows duplicate rows after a new release. How do you investigate in the database?

Database TestingMedium

Show answer

Run the report query with GROUP BY on the business key and HAVING COUNT(*) > 1 to find which records repeat. Then check whether the duplicates exist in the base table or are created by the query, usually a new join to a one-to-many table such as addresses. Compare the query before and after the release. Include the duplicate keys, the count and the suspected join in the bug report.

A feature passed all your test cases, but users say it is confusing. What went wrong?

Show answer

The tests verified the specification but did not validate the user experience. The test cases probably checked only functional outcomes and missed usability: unclear labels, too many steps or poor error messages. Next time, add usability heuristics to reviews, do exploratory sessions as a real user persona and involve users in UAT or demos. Log the current feedback as improvement items with clear examples.

What do you check in mobile accessibility testing?

Mobile TestingMedium

Show answer

Turn on the screen reader, TalkBack on Android or VoiceOver on iOS, and check every button, image and field has a meaningful label and the reading order is logical. Check text scales with system font size, colour contrast is sufficient and touch targets are large enough, about 48 by 48 density-independent pixels. Make sure information is not shown by colour alone and that the app works without complex gestures.

What is TDD vs BDD?