50 QA Interview Questions (With Answers)

QA interviews test your knowledge of testing principles, defect management, test design, automation tools, and Agile processes. This guide covers the 50 most common questions — with clear answers and real examples.

Quick reference

Testing Fundamentals

1. What is software testing and why is it important?

Software testing is the process of evaluating a system or its components to find defects and verify it meets specified requirements.

Why it matters:

The cost of fixing a bug increases roughly 10× with each phase: development → testing → staging → production.

2. What are the different types of software testing?

3. What are the levels of software testing?

          ┌─────────────────────────────┐
          │   Acceptance Testing (UAT)  │  ← Business / user level
          ├─────────────────────────────┤
          │    System Testing           │  ← Whole system (E2E)
          ├─────────────────────────────┤
          │    Integration Testing      │  ← Component interactions
          ├─────────────────────────────┤
          │    Unit Testing             │  ← Individual functions/classes
          └─────────────────────────────┘

4. What is the difference between SDLC and STLC?

5. What is verification vs validation?

6. What is regression testing and when is it performed?

Regression testing re-runs previously passing tests to confirm that new code changes haven't broken existing functionality.

When to run:

• After every bug fix
• After every new feature addition
• After code refactoring
• Before every release

Types:

Best practice: automate regression tests (faster, reliable, repeatable).

Test Design Techniques

7. What is Equivalence Partitioning?

Equivalence Partitioning (EP) divides input data into valid and invalid partitions where each value in a partition is expected to behave the same way.

Example — Age field (valid: 18–60):

Test one value per partition instead of testing every possible value.

8. What is Boundary Value Analysis?

Boundary Value Analysis (BVA) tests at the edges of partitions, where bugs are most likely.

For an input range 1–100:

BVA and EP are often used together.

9. What is a Decision Table?

A Decision Table maps combinations of input conditions to expected outputs. Used for complex business logic.

Example — Loan approval:

Each column is a test case.

10. What is State Transition Testing?

State Transition Testing is used when a system behaves differently depending on its current state.

Example — ATM PIN:

[Start] → Enter PIN → 
  Correct → [Logged In]
  Wrong (1st) → [1 Attempt Used]
  Wrong (2nd) → [2 Attempts Used]
  Wrong (3rd) → [Card Blocked]

Test cases cover valid and invalid transitions between all states.

11. What is the difference between smoke testing and sanity testing?

Analogy: Smoke test = "Does the car start?" Sanity test = "Is the new brake pad working?"

Defect Management

12. What is the defect/bug life cycle?

New → Assigned → Open → Fixed → Retest → 
  Pass → Closed
  Fail → Reopened → Fixed → Retest → ...

Also possible:
New → Rejected (not a bug / duplicate)
New → Deferred (postponed)

13. What is the difference between severity and priority?

Classic combinations:

14. What makes a good bug report?

A good bug report contains:

1. Bug ID — Unique identifier
2. Title — Clear, concise description
3. Environment — OS, browser, version, device
4. Steps to reproduce — Numbered, precise steps
5. Expected result — What should happen
6. Actual result — What actually happened
7. Severity & Priority
8. Attachments — Screenshots, videos, logs

Example title (bad): "Button broken"
Example title (good): "Submit button on checkout page does not respond on Safari 17 when cart has >10 items"

15. What is a test plan? What does it contain?

A test plan is a document that describes the testing scope, approach, resources, and schedule.

Key sections:

Test Management

16. What is a test case? What makes a good one?

A test case is a documented set of steps to verify a specific functionality.

Structure:

Good test case traits: atomic, independent, clear, traceable to a requirement.

17. What is the difference between test case and test scenario?

One test scenario can have multiple test cases (e.g., valid login, invalid password, locked account).

18. What is test coverage and how is it measured?

Test coverage measures how much of the software has been tested.

Target: 80%+ code coverage is a common industry standard. 100% is unrealistic and often undesirable.

Tools: Istanbul/nyc (JS), pytest-cov (Python), JaCoCo (Java).

19. What are entry and exit criteria in testing?

Entry criteria — conditions that must be met before testing begins:

• Build deployed to test environment
• Test cases reviewed and approved
• Test environment configured and accessible
• All critical dependencies available

Exit criteria — conditions that signal testing is complete:

• 100% test cases executed
• 95% pass rate (adjust per project)
• All P1/P2 bugs closed
• No open critical/high severity defects
• Test summary report approved

20. What is exploratory testing?

Exploratory testing is simultaneous learning, test design, and execution — without pre-written test scripts. The tester explores the application based on intuition, domain knowledge, and creativity.

When to use:

• New feature with unclear requirements
• Time-boxed testing sessions
• Complement to scripted testing
• Discovering edge cases automated tests miss

Session-Based Test Management (SBTM): Organise exploratory testing in time-boxed sessions (e.g., 90 minutes) with a charter (goal).

API Testing

21. What is API testing and why is it important?

API testing validates that APIs work correctly — testing the business logic layer directly, without the UI.

Advantages over UI testing:

22. What HTTP methods do you typically test in API testing?

23. What HTTP status codes do you check in API testing?

24. What do you validate in an API response?

Checklist for every API test:

• Status code — correct for the scenario
• Response time — within SLA (e.g., < 500ms)
• Response body — correct data, correct types
• Schema — response matches expected structure (JSON Schema)
• Headers — Content-Type, Cache-Control, CORS
• Error messages — descriptive and not leaking internals
• Authentication — 401/403 on unauthorised requests
• Pagination — correct metadata (total, page, hasNext)

25. How do you test API authentication?

Tools: Postman, REST Assured, pytest + requests, Insomnia.

Performance Testing

26. What is performance testing and what are its types?

Performance testing validates how a system behaves under various load conditions.

27. What is the difference between response time, throughput, and latency?

28. What is JMeter and how do you use it for performance testing?

Apache JMeter is an open-source performance testing tool.

Key JMeter concepts:

Basic load test setup:

1. Create Thread Group: 100 users, ramp-up 60s, 1 loop
2. Add HTTP Request sampler
3. Add Summary Report listener
4. Run and check response times, error rates

Automation Testing

29. What is a test automation framework?

A test automation framework is a set of guidelines, tools, and libraries that standardise test development.

30. What is the Page Object Model (POM)?

Page Object Model is a design pattern where each web page has a corresponding class that encapsulates its elements and interactions.

# page_objects/login_page.py
class LoginPage:
    def __init__(self, driver):
        self.driver = driver
        self.email_input = (By.ID, "email")
        self.password_input = (By.ID, "password")
        self.submit_btn = (By.CSS_SELECTOR, "button[type='submit']")
    
    def login(self, email, password):
        self.driver.find_element(*self.email_input).send_keys(email)
        self.driver.find_element(*self.password_input).send_keys(password)
        self.driver.find_element(*self.submit_btn).click()

# test_login.py
def test_valid_login(driver):
    page = LoginPage(driver)
    page.login("user@test.com", "password123")
    assert "dashboard" in driver.current_url

Benefits: Maintainable (one place to update), readable, reusable.

31. What are the differences between Selenium, Cypress, and Playwright?

32. What are common challenges in test automation?

Mobile Testing

33. What are the types of mobile applications?

34. What is Appium?

Appium is an open-source mobile automation framework that tests native, hybrid, and mobile web apps on iOS and Android.

Key concepts:

What to test on mobile:

• Touch gestures (swipe, pinch, tap)
• Device rotation (portrait/landscape)
• Push notifications
• Deep links
• Battery, memory usage
• Offline mode
• Different screen sizes

35. What is a device farm and why use it?

A device farm provides cloud access to real physical devices for mobile testing.

Why use real devices vs emulators:

• Catch device-specific bugs
• Accurate performance metrics
• Test sensors (GPS, camera, NFC)
• Real carrier network testing

Agile QA

36. How does QA work in an Agile/Scrum team?

In Agile, QA is continuous — not a phase at the end.

QA activities per Scrum event:

Key principle: QA is everyone's responsibility, not just the QA team's.

37. What is shift-left testing?

Shift-left testing moves testing activities earlier in the SDLC — catching bugs sooner when they're cheaper to fix.

Traditional:  Develop → Develop → Develop → [TEST]
Shift-Left:  [TEST] Develop [TEST] Develop [TEST] Deploy

Shift-left practices:

• Review requirements before development
• TDD (Test-Driven Development)
• Unit and integration tests written by developers
• Static code analysis in CI/CD
• Early performance testing
• Security testing from day one (DevSecOps)

38. What is BDD (Behaviour-Driven Development)?

BDD bridges the gap between business and technical teams using Gherkin syntax (Given/When/Then) for test scenarios.

Feature: User Login

  Scenario: Successful login with valid credentials
    Given the user is on the login page
    When they enter email "user@test.com" and password "Pass123"
    And they click the "Login" button
    Then they should be redirected to the dashboard
    And a welcome message should be displayed

  Scenario: Login fails with wrong password
    Given the user is on the login page
    When they enter email "user@test.com" and password "wrongpass"
    And they click the "Login" button
    Then they should see the error "Invalid email or password"

Tools: Cucumber (Java), Behave (Python), SpecFlow (.NET), Cypress + Cucumber.

39. What is the test pyramid?

The test pyramid describes the ideal distribution of tests:

          /\
         /  \
        / E2E \        ← Few, slow, expensive
       /────────\
      /Integration\    ← Medium
     /────────────\
    /  Unit Tests  \   ← Many, fast, cheap
   /────────────────\

Anti-pattern: Ice cream cone (lots of E2E, few unit tests) — slow, expensive, brittle.

40. What is TDD vs BDD vs ATDD?

Security Testing

41. What is the difference between penetration testing and vulnerability scanning?

42. What are the OWASP Top 10?

OWASP Top 10 (2021) — most critical web application security risks:

QA should include basic security checks: SQL injection, XSS, authentication bypass.

QA Metrics

43. What are the most important QA metrics?

44. What is MTTR vs MTBF?

Goal: High MTBF + Low MTTR = reliable, quickly-recovered system.

Advanced Topics

45. What is usability testing?

Usability testing evaluates how easy and intuitive a product is to use — with real users performing real tasks.

Methods:

Tools: UserTesting, Hotjar, Lookback, maze.

46. What is compatibility testing?

Compatibility testing verifies software works correctly across different environments.

Tools: BrowserStack, CrossBrowserTesting, LambdaTest.

47. What is A/B testing vs multivariate testing?

Tools: Google Optimize (sunset), Optimizely, LaunchDarkly.

48. What is continuous testing in CI/CD?

Continuous testing means running tests automatically at every stage of the CI/CD pipeline.

Code push
  → Unit tests (< 1 min)
  → Integration tests (< 5 min)
  → Build artifact
  → E2E smoke tests (< 10 min)
  → Deploy to staging
  → Full regression (scheduled nightly)
  → Deploy to production
  → Post-deploy smoke

Key practices:

• Fast feedback: unit tests first
• Fail fast: break the build on test failure
• Test in parallel
• Separate nightly regression from PR checks
• Slack/email alerts on failure

49. What is the difference between functional and non-functional testing?

50. How would you design a test strategy for a new e-commerce feature (e.g., cart)?

Scope: Shopping cart — add, remove, update quantity, apply coupon, checkout.

Test types:

Common mistakes

QA vs related roles

FAQ

Q: Should QA know how to code?
It depends on the role. Manual QA doesn't require coding. SDET / automation QA roles require proficiency in at least one language (Python, Java, JavaScript). Knowing coding fundamentals helps any QA understand the system better and communicate with developers.

Q: What's the difference between QA and QC?
Quality Assurance (QA) is process-oriented — preventing defects by improving processes (like code reviews, test planning). Quality Control (QC) is product-oriented — finding defects through testing. QA is proactive; QC is reactive.

Q: How many test cases should I write per requirement?
There's no fixed number. Cover: happy path, alternative flows, error cases, boundary values. A complex requirement might need 10+ test cases; a simple one might need 2–3.

Q: What is the best automation framework for beginners?
For web: Playwright or Cypress (JS/TS, great DX, auto-wait). For Python projects: pytest + Playwright or pytest + Selenium. Start with one framework and master it before learning others.

Q: How do you handle flaky tests?

1. Identify the root cause (timing, shared state, network, data). 2. Add proper waits (not sleep). 3. Fix test isolation (each test owns its data). 4. Quarantine persistently flaky tests while fixing. 5. Monitor flakiness over time.

Q: What certifications are useful for QA?
ISTQB Foundation Level is the most widely recognised. Beyond that: Certified Selenium Professional, AWS Certified DevOps (for CI/CD), CSTE (Certified Software Test Engineer), or tool-specific certifications from BrowserStack/Sauce Labs.