Landing a QA job starts with acing the interview. Whether you're a career switcher or a junior tester, these 30 questions cover what interviewers actually ask in 2026.
We've organized them by category and provided detailed answers you can adapt to your own experience. Also check our QA career roadmap for the full preparation plan.
Fundamentals (Questions 1-10)
1. What is the difference between QA, QC, and Testing?
QA (Quality Assurance) is proactive — it focuses on improving processes to prevent defects. QC (Quality Control) is reactive — it identifies defects in the finished product through inspection. Testing is a QC activity — it's the execution of test cases to find bugs.
Think of it this way: QA sets up the factory, QC inspects the products, and testing is one of the inspection methods.
2. What is the software testing lifecycle (STLC)?
The STLC consists of these phases:
- Requirements analysis
- Test planning
- Test case development
- Environment setup
- Test execution
- Test cycle closure
Each phase has entry criteria (what's needed to start), activities (what you do), and exit criteria (what signals completion).
3. Explain the difference between severity and priority.
Severity measures how much damage a bug causes (set by QA). Priority measures how urgently it should be fixed (set by product/business).
Classic example: A typo in the company logo on the homepage is low severity (cosmetic) but high priority (brand impact). A crash in a rarely-used admin feature is high severity but might be low priority.
4. What is regression testing and why is it important?
Regression testing re-runs existing tests after code changes to ensure nothing previously working has broken. It's critical because:
- Code changes have unintended side effects
- It catches regression bugs before users do
- It's the primary candidate for test automation
- It provides confidence to deploy changes
5. What is the test pyramid?
The test pyramid recommends this distribution of automated tests:
- Base (70%): Unit tests — fast, cheap, isolated
- Middle (20%): Integration/API tests — moderate speed
- Top (10%): UI/E2E tests — slow, expensive, realistic
The anti-pattern is the "ice cream cone" — mostly manual testing with few automated tests.
6. Explain equivalence partitioning with an example.
Equivalence partitioning divides input data into groups where all values should behave the same. You test one value from each group instead of every possible value.
Example: Age field (valid range 18-65): - Partition 1 (invalid): less than 18, test with 15 - Partition 2 (valid): 18-65, test with 30 - Partition 3 (invalid): greater than 65, test with 70
Three tests instead of testing every age from 1 to 100.
7. What is boundary value analysis?
BVA tests at the edges of equivalence partitions, where bugs cluster. For the age field (18-65):
- Test: 17, 18, 19, 64, 65, 66
- These boundary values catch the classic "off-by-one" errors
Always combine BVA with equivalence partitioning for comprehensive test design.
8. Describe the bug lifecycle.
New → Open/Assigned → In Progress → Fixed → Retest → Closed
Additional states: Rejected (not a bug), Deferred (fix later), Duplicate, Reopened (fix didn't work).
9. What makes a good bug report?
A good bug report includes:
- Clear, specific title
- Environment details (OS, browser, version)
- Prerequisites and preconditions
- Numbered steps to reproduce
- Expected result vs actual result
- Severity and priority
- Screenshots or video evidence
The most critical element is reproducible steps — without them, developers can't fix the bug.
10. What is exploratory testing?
Exploratory testing is simultaneous learning, test design, and test execution. Unlike scripted testing, the tester uses skill and intuition to explore the software.
It's NOT random clicking — it uses charters, time boxes (60-90 min sessions), and session notes. It finds bugs that scripted tests miss, especially usability and edge case issues.
Automation (Questions 11-15)
11. When should you automate a test?
Automate when: - The test runs repeatedly (regression) - The test is data-driven (many input combinations) - The test is time-consuming manually - The test requires consistency across environments
Don't automate: exploratory testing, one-time tests, tests for frequently changing features, or usability testing.
12. What is the Page Object Model?
POM is a design pattern that creates a class for each web page. Each class encapsulates the page's elements and actions, separating test logic from page structure.
Benefits: maintainability (change locator in one place), reusability (login action used everywhere), and readability (tests read like user stories).
13. Explain the difference between Selenium, Playwright, and Cypress.
- Selenium: Industry standard, multi-language (Java, Python, JS, C#), widest browser support, requires explicit waits
- Playwright: Modern, auto-wait, multi-browser, network interception, trace viewer, by Microsoft
- Cypress: JavaScript-only, runs in browser, time-travel debugging, great DX, single-tab limitation
Choose based on: team language (Selenium/Playwright for Java teams), browser needs (Selenium for Safari legacy), and developer experience (Cypress for JS teams).
14. What is a flaky test and how do you fix it?
A flaky test passes sometimes and fails sometimes without code changes. Common causes: timing issues, shared state, environment differences, race conditions.
Fix by: using explicit waits, making tests independent, mocking external dependencies, and running the test 100 times to verify the fix.
15. What is CI/CD and how does QA fit in?
CI (Continuous Integration) automatically builds and tests code on every commit. CD (Continuous Delivery) automatically deploys passing builds.
QA's role: maintain automated test suites in the pipeline, define quality gates, monitor test results, fix flaky tests, and ensure adequate coverage for deployment confidence.
Process (Questions 16-20)
16. How does QA work in Agile/Scrum?
In Scrum, QA is embedded in the development team: - Sprint Planning: estimate testing effort, identify risks - During Sprint: test stories as they're developed (not at the end!) - Sprint Review: demo tested features - Retrospective: suggest testing improvements
Testing happens throughout the sprint, not as a phase at the end.
17. What are acceptance criteria?
Acceptance criteria define when a user story is "done." They use the Given-When-Then format:
- Given: a registered user with valid credentials
- When: they enter email and password and click Login
- Then: they are redirected to the dashboard
ACs are the QA engineer's primary source of test cases.
18. What is risk-based testing?
Risk-based testing prioritizes testing by risk: Risk = Probability x Impact.
High risk (test more): core business flows, complex logic, recently changed code, areas with bug history. Low risk (test less): stable unchanged code, simple CRUD operations.
This approach is essential when time is limited (which is always).
19. How do you decide what to test first when time is limited?
Apply risk-based testing: 1. Identify critical business flows 2. Focus on recently changed areas 3. Test high-risk integrations 4. Run automated regression suite 5. Perform smoke testing on remaining areas
20. Explain shift-left testing.
Shift-left means performing testing activities earlier in the SDLC. The cost of finding a bug increases 10-100x from requirements to production.
Shift-left practices: requirements review by QA, early test design, static analysis, TDD/BDD, code reviews with QA participation.
Situational (Questions 21-25)
21. You found a critical bug 1 hour before release. What do you do?
- 1.Immediately notify the team (PM, dev lead, QA lead)
- 2.Document the bug clearly with reproduction steps
- 3.Assess the impact — does it affect core functionality?
- 4.Present options: delay release, deploy with known issue, or quick fix
- 5.Let the team decide (not a QA-only decision)
- 6.Whatever is decided, document the decision and rationale
22. A developer says your bug report is invalid. How do you handle it?
- 1.Stay professional — never make it personal
- 2.Verify your reproduction steps are clear and complete
- 3.Re-test to confirm the bug still exists
- 4.If it persists, invite the developer to a screen share — show them live
- 5.If they still disagree, escalate to the team lead for a decision
- 6.Accept the outcome gracefully — sometimes the spec is ambiguous
23. How would you test a login page?
Positive tests: valid credentials, remember me, password visibility toggle. Negative tests: wrong password, non-existent email, empty fields, SQL injection, XSS. Boundary tests: max-length email, max-length password, special characters. Security tests: brute force (account lockout after N attempts), session management, HTTPS. UX tests: error messages are helpful, tab navigation works, mobile responsive. Performance: login response time under load.
24. How do you handle testing when requirements are incomplete?
- 1.Document what's missing and ask the PM/BA for clarification
- 2.Don't wait — start testing what you can
- 3.Use exploratory testing to discover implicit requirements
- 4.Compare with competitor products for industry expectations
- 5.Raise risks for untestable features
- 6.Write test cases with assumptions clearly stated
25. Describe a time you found a critical bug. What happened?
Prepare a real story from your experience (or portfolio practice). Structure it: - What were you testing? - How did you find the bug? - What was the impact? - What did you do about it? - What was the outcome?
API Testing (Questions 26-28)
26. What HTTP status codes should you validate in API testing?
- 200 (OK): successful GET
- 201 (Created): successful POST
- 204 (No Content): successful DELETE
- 400 (Bad Request): invalid input
- 401 (Unauthorized): missing authentication
- 403 (Forbidden): insufficient permissions
- 404 (Not Found): resource doesn't exist
- 500 (Internal Server Error): server failure
27. How do you test a REST API?
Test each endpoint for: - Correct status codes for valid and invalid requests - Response body structure (JSON schema validation) - Response data correctness - Authentication and authorization - Input validation (missing fields, wrong types, edge values) - Performance (response time) - Error handling (meaningful error messages)
28. What is the difference between PUT and PATCH?
PUT replaces the entire resource. PATCH updates specific fields. If a user has name and email, PUT requires sending both fields, while PATCH can send just the email to update.
Advanced (Questions 29-30)
29. What QA metrics do you track?
- Defect density (bugs per module)
- Test coverage (% of requirements tested)
- Defect leakage (bugs found in production)
- Test execution rate (tests run per sprint)
- Automation coverage (% of tests automated)
The most important metric: defects found in production. If that number is low, quality is high.
30. Where do you see yourself in 3-5 years?
Strong answers for QA career growth: - "Moving into automation engineering and building robust test frameworks" - "Becoming a QA lead who improves quality culture across the team" - "Specializing in performance or security testing" - "Contributing to QA strategy and mentoring junior testers"
Show you're invested in the field, not treating QA as a stepping stone.
Interview Preparation Checklist
- Review these 30 questions and customize answers with your examples
- Practice writing test cases on the spot (login form, search, checkout)
- Prepare to walk through your portfolio
- Research the company and their product before the interview
- Prepare 3-5 questions to ask the interviewer about their QA process