Scenario-Based Testing Interview Questions and Answers (1970)

Reproduce on the exact Safari version + macOS/iOS combo. Compare console errors (Safari's stricter CSP, missing polyfills, unsupported CSS). Inspect Network tab for blocked requests. Check user-agent-specific code paths. File a bug with browser matrix, screen recording, and the failing console line — assign severity based on Safari's traffic share for the product.

Not necessarily. Verify (1) the deployed build number on QA vs prod, (2) the CDN cache TTL, (3) any feature flag. If QA is behind because the pipeline promoted prod first, log a process defect, not a product bug. Always compare build numbers before filing a UI regression.

Assess severity + priority + reachability. If P1/P2 or affects paid users, escalate to PO for a same-day hotfix. If cosmetic and low-traffic, log with severity/priority and evidence, add to next sprint. Never silently sit on a defect because the sprint is closing — log it and let the PO decide.

Reproduce with Chrome DevTools Performance panel — capture Long Tasks, layout thrashing, memory heap. File as performance defect (high severity, medium priority) with metrics: initial render time, TTI, memory used. Suggest fixes: virtualised list, server-side search, pagination. Add a regression test that fails if render > 500ms.

Yes — file it as a UI/visual defect against the story's acceptance criteria. Attach side-by-side screenshots + pixel measurements. Severity depends on user impact (spacing off by 2px = low; wrong CTA colour on paid button = high). Confirm the Figma version matches the story before filing.

Ask for device, OS, browser, network, time-of-day, and a screen recording. Check backend logs / APM (Datadog, New Relic) for that user's session ID. Reproduce with throttled network + CPU in DevTools. Never close as 'not reproducible' before checking server-side traces.

File a defect — a successful 2xx must carry the expected schema or explicitly return 204 No Content. Attach the request, response headers, and expected schema. Add a contract test asserting the response schema so regression catches this earlier.

Use provider test cards (Stripe 4242 4242 4242 4242, Razorpay sandbox tokens), sandbox endpoints, and webhook simulators. Cover: valid card, decline, insufficient funds, 3-D Secure challenge, network timeout, idempotency-key replay, refund, partial refund. Never test with production credentials.

Stub the downstream with WireMock / MSW / Playwright route interception. Simulate 5xx, timeouts, and slow responses. Assert your app shows a graceful error (not a blank screen), retries with backoff, and does not corrupt local state. Add a chaos test in staging that kills the dependency for 30s.

Check token expiry, clock skew between client/server, and race conditions between token refresh and request send. Capture the failing request's Authorization header and the token's exp claim. Fix at the client (proactive refresh 60s before expiry) or server (bigger clock skew tolerance).

Send N+1 requests in a burst where N = the documented limit. Assert the (N+1)th returns 429 with a Retry-After header. Test window reset: wait the window, retry, assert 200. Test per-user vs per-IP limits separately.

No — webhooks must be treated as at-least-once. The bug is if the consumer processes it twice. Test idempotency: send the same webhook payload twice with the same event ID and assert the DB state changes only once. File a defect if you see duplicate rows or double charges.

Depends on the compliance profile. Verify: (1) GDPR/CCPA soft-delete + purge job runs on schedule, (2) PII removed but audit logs retained, (3) related rows (orders, comments) anonymised or cascaded correctly, (4) user cannot log in with old credentials, (5) email is released for re-registration only per policy.

Send classic payloads (' OR 1=1--, '; DROP TABLE users;--) in every input, URL param, and JSON field. Verify DB error messages don't leak to the UI, parameterised queries are used (check code), and WAF/ORM filters. Automate with OWASP ZAP as part of the pipeline.

Depends on the product policy. If concurrent sessions are allowed (Netflix-style), assert all 5 work. If limited to N, assert the (N+1)th kicks the oldest session and shows a clear message. Test session-hijack via stolen token and confirm the server invalidates on logout-everywhere.

Never seed via UI. Use SQL scripts, DB snapshots, or a data-factory API to create representative fixtures. Cover: empty state, small (10s), medium (1K), large (100K), max (1M+). Reset via transaction rollback or a nightly restore — not manual cleanup.

Yes — file as high-severity data-integrity defect. Attach both call sites' code paths. Root cause is usually mixed rounding modes (HALF_UP vs HALF_EVEN) or float vs decimal. Fix requires a single rounding policy library + regression tests with edge inputs (0.5, -0.5, 0.05, ₹0.005).

Yes — it's an information-leak security defect (OWASP A05). Verify in dev + staging + prod. Assign high priority. Fix: generic 500 message to the user, full stack in server logs only. Add an automated test that scrapes error responses for column/table names.

Reproduce inside the same Docker image CI uses. Compare env vars, browser version, screen resolution, timezone, and parallel-worker count. Capture Playwright trace or Selenium video from CI. Never mark 'flaky' before you've reproduced the failure at least once with evidence.

(1) Parallelise across shards (Playwright --shard, TestNG parallel classes). (2) Move low-value UI tests down to API layer. (3) Cache dependencies + browser binaries. (4) Reset state via API/DB, not UI. (5) Quarantine chronically slow tests. Measure per-test wall time first — 20% of tests usually eat 80% of runtime.

Diagnose first — never blanket-retry. If root cause is timing (fix with explicit wait), test data (isolate per-run), or order-dependence (add fixture), fix it. If root cause is unknown after 30 minutes, quarantine with an owner + due date, not indefinitely. Blanket retries hide real regressions.

Test flag ON: full happy + edge path. Flag OFF: legacy behaviour intact. Flag mid-rollout: 50% of test users see new, 50% see old, no leak between them. Test flag flip: users mid-session don't crash. Automate with a config-override fixture that pins the flag per test.

Coverage gap. Common causes: test data doesn't match prod scale, environment-only feature flags off in CI, external dependency stubbed in CI but real in prod, flaky test silently ignored, or CI tests one region but bug is region-specific. Do a post-mortem, add the missing test, and audit the CI matrix.

Use a cloud device farm (BrowserStack, Sauce Labs, LambdaTest) with parallel sessions. Build a device matrix by traffic share, not exhaustively. Run smoke on all 100, full regression on top-20 by traffic. Nightly full-matrix, PR-time smoke-only, to balance cost and feedback speed.

Never a flat no. Quantify the risk: 'skipping regression on module X exposes flows A, B, C — historical defect rate 12%'. Offer a middle path — targeted regression on changed modules + P0 flows in 90 minutes vs full 4-hour suite. Let the PO make the call with data.

Escalate privately first — most merges without sign-off are process ignorance, not malice. Reiterate the DoD in the next standup. Add a branch-protection rule requiring a QA approval on the target repo. Track 'merged-without-QA' as a team-health metric, not to blame individuals.

Not your call alone — ship decisions belong to the PO/release manager. Your job: present the two defects with severity, priority, reachability, workaround, and blast-radius. Recommend hotfix, rollback, or ship-with-known-issue. Whatever the call, log it in the release notes.

Ask for their reasoning first — often experience surfaces a constraint you missed. If you still disagree, propose a spike: run both approaches on a small feature, compare defect find-rate, runtime, and cost. Let data pick the winner, not seniority.

Own it — don't hide behind 'devs missed it'. Post-mortem: root cause (missing test, environment gap, unclear requirement), what test would have caught it, add it to the suite, share learning with the team. No blame; systemic fix. Track escape rate over time to show improvement.

Reverse-engineer: (1) talk to the developer for 15 mins, (2) explore the UI + API traffic to build a mental model, (3) list assumptions and share back for confirmation, (4) write a lightweight charter (feature, risks, coverage), (5) run exploratory sessions, log findings and questions as you go. Refuse to 'test blind' without a shared charter.