Test Case Interview Questions and Answers

Positive

• A valid email and password logs in and opens the dashboard
• "Remember me" keeps the session after the browser restarts
• The Enter key submits the form
• Email is not case-sensitive ([email protected] works)

Negative

• Wrong password or unknown email: show one general error ("Invalid email or password"). Do not say which one is wrong
• Empty email, empty password, or both empty: show a message at each field
• Wrong email format (abc@, no @)
• Spaces at the start or end, very long input, SQL or script characters: handled safely
• Account locked or disabled after N failed attempts

Edge and non-functional

• Password is hidden, no autocomplete leak, paste is allowed
• HTTPS only, and the password is never in the URL
• The Back button after logout does not show private pages
• Works on Chrome, Safari and mobile; tab order and screen reader labels are correct
• Response time is under 2 seconds

What they are checking: A clear plan with positive, negative, edge and security cases

Authentication

• A valid card and PIN opens the menu
• Wrong PIN once, twice and three times: the card is blocked or kept after the limit
• An expired, damaged or non-bank card is rejected; the card is removed during a transaction

Withdrawal

• Amount that fits the available notes, is within the balance and is within the daily limit
• Amount above the balance, above the daily limit, not a multiple of the note value, zero, or negative
• The machine does not have enough cash
• The receipt is printed with the right details; the balance goes down only once

Other functions

• Balance check, mini statement, PIN change, deposit, transfer
• Timeout when no one uses it: the card is returned
• Power or network failure during a withdrawal: the transaction is reversed and no money is lost
• Cancel at any step; privacy (PIN is hidden); access for people with poor sight

What they are checking: Testing a real-world device, including failures

Add

• Add a task with valid text; the Enter key and the Add button both work
• An empty task or a task with only spaces is rejected
• Very long text, emojis, HTML tags (shown safely), duplicate names

Complete, edit and delete

• Mark a task done and undo it; the strike-through and the counter update
• Edit the text, cancel the edit, save an empty edit
• Delete a task, ask for confirmation, undo if the app has it
• Clear completed tasks

List behavior

• The filters All / Active / Completed show the right items
• Task order, drag to reorder, priority and due date if present
• Tasks stay after a refresh and show in another tab (local storage or server)
• 500+ items still run well

Other

• Keyboard use, mobile layout, text direction, page title and counters

What they are checking: The whole create, read, update, delete flow plus saved data

Positive

• A registered email gets a reset link; the link opens the reset form; the new password works; the old password stops working
• The user is logged out of other sessions after the reset

Negative

• Unknown email: show the same neutral message ("If an account exists...") so no one can find out which emails exist
• Expired link (for example after 15 minutes), a link that was already used, a changed token
• New password breaks the rules; confirm password does not match; same as the old password, if that is blocked
• Many requests in a row: the system limits them

Security

• The token is random, works once, and cannot be guessed; the link uses HTTPS
• The email does not contain the password; the reset does not show account details

Other

• The email arrives in a reasonable time, with the right branding and link
• Two reset requests: only the latest link is valid

What they are checking: Testing a flow with security in mind

1. Look around (3 minutes): browse the pages and find the main flows (browse, search, product, cart, checkout, account).
2. Write scenarios first (5 minutes), by area: registration and login, product list and filters, product detail, cart, checkout, order history, responsive layout.
3. Explore each flow...

• First 2 minutes: use the happy path (add, complete, delete) to learn how the app works.
• Next, attack the input: empty, spaces, 1,000 characters, emoji, <b>bold</b>, <script>alert(1)</script>, duplicates.
• State and saved data: refresh, open a second tab, clear storage, go offline.
• Controls: filters...

Stop exploring, reproduce the issue, cut the steps to the fewest, then write one bug per report.

Valid: [email protected], [email protected], uppercase letters, numbers, subdomain. Invalid: no @, two @, missing domain (a@), missing user (@x.com), spaces inside. Also invalid: no dot in the domain if required, dot at the end, comma instead of dot, Unicode spaces. Boundary: very short...

Show that you can test an object with no spec by asking questions first (purpose, type: ball point, gel, fountain; users).

Ask first: capacity, number of floors, single lift or a group of lifts.

• A valid name, email, subject and message submit; a success message shows; the email reaches the support inbox
• Each required field empty on its own, and all empty together
• Wrong email; phone with letters; message at the minimum and maximum length (and over)
• HTML or script input is made safe; emoji and...

• Update name, phone, address and profile photo: saved, and shown after a refresh and on other pages
• Required fields empty; wrong phone or email format; maximum length
• Photo: allowed types and size, very large dimensions, cropping
• An email change needs verification; the new email is already used
• A password...

• Basic operations: 2+3, 9-12 (negative result), 6x7, 8/2
• Division by zero: show an error and do not crash; 0/0
• Decimals: 0.1+0.2 shows 0.3 (rounding is handled); long decimals; zeros at the start; more than one dot is rejected
• Very large numbers and overflow, scientific notation, negative numbers
• Chained...

• A valid 10-digit number is accepted (for example 9812345678)
• 9 digits and 11 digits are rejected (boundary); exactly 10 digits is the boundary
• Letters, symbols, spaces, + and country code, zero at the start: follow the spec
• Paste with spaces or dashes: cleaned or rejected
• Empty field when it is required;...

• The first page loads with the expected number of items; Previous is disabled on the first page, and Next is disabled on the last
• Next, Previous, a page number, and First/Last go to the right page
• Exactly one page of data, zero results, N+1 items (the last page has one item)
• Changing the page size (10, 25, 50)...

• Pick a date from the calendar and by typing; the format matches the locale (DD/MM/YYYY vs MM/DD/YYYY)
• Boundaries: minimum and maximum allowed date, today, tomorrow, yesterday
• Invalid dates: 31 Feb, 30 Feb, 00/00/0000, letters, empty
• Leap day (29 Feb 2024 is valid, 29 Feb 2023 is invalid)
• Month and year...

• Logout goes to the login or home page and clears the session cookie or token
• The Back button does not show protected pages; pages ask for login again
• The token is not valid on the server after logout (call an API with the old token: 401)
• Logout in one tab logs out the other tabs; logout on one device vs on all...

• Star rating from 1 to 5, submit with and without text; the average rating and count update
• Rating 0, 6, or half-stars if not supported; empty review
• Only verified buyers can review; one review per user per product; edit and delete your own
• Review length limits, bad-word filter, HTML and links made safe -...

• The default value or placeholder shows; the list opens and closes; choosing an option updates the field
• All options are there, in the right order, with no repeats and with the right labels
• Keyboard: arrow keys, Enter, type to jump, Escape
• Search inside long dropdowns; multi-select adds and removes chips -...

• All fields valid: the address is saved; choosing a saved address fills the form
• Required fields: name, street, city, postcode, country, phone
• Postcode formats for each country; the state list changes with the country
• Phone: country code, letters, spaces and dashes
• Maximum lengths; apostrophes and non-English...

• The balance equals the ledger or database value after deposits, withdrawals and pending transactions
• The difference between available and current balance when money is on hold
• After a transaction, the refresh updates within the SLA (agreed time)
• Currency format and rounding; a negative balance shows for an...

Assume these fields: name, email, password, confirm password, terms checkbox.

Positive

• Valid data creates the account and sends a verification email
• The verification link turns the account on

Negative and validation

• Each required field left empty
• Wrong email formats; an email that is already registered (show a clear message, but follow the policy on not revealing which emails exist)
• Password shorter than the minimum, or missing an uppercase letter, number or symbol that the rules need
• Confirm password does not match
• Terms box not ticked: submit is blocked
• Name with digits, emoji or very long input

Boundary

• Password at exactly the minimum length, and one less; at the maximum length, and one more
• Name with 1 character, and with the maximum length

Other

• Double click on Submit creates only one account
• Expired or already used verification link
• Password is stored as a hash (check the database) and is not in the logs

What they are checking: Field-level validation and boundary thinking

Positive

• An exact keyword returns the right results; a partial keyword works (if the product supports it)
• Search is not case-sensitive; multiple words work; the best matches come first
• Result count and pagination are correct; clicking a result opens the right item
• Suggestions (autocomplete) show while typing

Negative

• Empty search or only spaces: show a message or do nothing
• No match: show a friendly "no results" page with suggestions
• Special characters, quotes, %, <script>, SQL pieces: no error and no injection
• Very long text (1,000 characters)

Other

• Filters and sorting work together with search; the URL can be shared
• Search with a typo or accented letters
• Performance: results come in under 2 seconds for a large catalog
• Recent searches, a clear button, and the "Search" key on a mobile keyboard

What they are checking: Covers both normal use and hard cases

• Add one item; adding the same item again raises the quantity (or adds a second line, as the spec says)
• Change the quantity: 1, the maximum allowed, 0 (removes the item), negative, decimal, not a number
• Remove an item; an empty cart shows a message and checkout is disabled
• Price math: line total, subtotal, tax, shipping and discount, rounded to 2 decimals
• Item goes out of stock or stock drops after adding: show a warning at the cart or checkout
• Price changed since the item was added: the cart shows the latest price
• The cart stays after a refresh, after logout and login, and across devices for logged-in users
• A guest cart joins the account cart after login
• Apply a valid, expired and invalid coupon; a coupon used with sale items
• Update the cart in two tabs at the same time
• Mobile layout and quantity buttons

What they are checking: Thinking about business rules and calculations

Flow: cart -> address -> shipping -> payment -> review -> confirmation.

• Happy path as a guest and as a logged-in user; order number and confirmation email
• Address checks: required fields, postcode format, saved addresses, different billing and shipping address
• Shipping options change the total and the delivery estimate
• The order summary matches the cart (items, tax, discount, shipping)
• Payment methods: card, wallet, cash on delivery
• Back button or refresh in the middle of checkout keeps the data and does not create a second order
• Double click on "Place order" creates one order
• Stock drops to zero during checkout: show a clear error and do not charge
• Session expires on the payment page
• The order shows in "My orders", stock goes down, and the invoice is correct
• Failure paths: payment declined, gateway timeout, email service down

What they are checking: The full flow from start to end, with failures handled

Positive

• Valid card, expiry and CVV: payment succeeds, and the receipt and status update
• Different card types (Visa, Mastercard) are found from the number

Negative

• Wrong card number (fails the Luhn check), expired card, wrong CVV length, past expiry date
• Not enough money, card declined, 3-D Secure failed or cancelled
• Empty fields, letters in number fields

Edge

• Gateway timeout: the user is not charged twice, and the order stays "pending" until it is checked against the bank record
• Double click or refresh after submit: the request is idempotent (running it twice gives the same result), so there is one charge
• Amount and currency sent to the gateway match the order
• Browser Back after success does not send the payment again

Security

• Card details are not logged or stored, the page uses HTTPS, the CVV is hidden
• Changing the amount in the request is rejected on the server

What they are checking: Handling money safely, idempotency and security

Positive

• Upload allowed types (jpg, png, pdf) within the size limit; preview and download work
• Many files, drag and drop, replace a file and delete a file

Negative

• Types that are not allowed, a renamed extension (.exe renamed to .jpg), a file with zero bytes
• A file 1 byte over the limit, and a file exactly at the limit
• A very long file name or one with special characters; the same name twice
• Cancel the upload half way, network drops, resume or retry

Security

• Files with harmful content, a script inside an SVG, path traversal in the file name (../../x): all rejected
• File links cannot be guessed; downloads need permission

Other

• Progress bar and error messages
• Upload on a slow network; upload from a mobile camera; a large file does not freeze the screen

What they are checking: Limits, checks and security of uploads

• Positive: the correct OTP within its valid time (for example 5 minutes) completes the login
• Wrong OTP: an error shows, attempts are counted, and the user is locked out after the limit (say 3 or 5)
• Expired OTP: rejected, with a "Resend" option
• Resend: the new OTP makes the old one invalid; the...

Positive

• Valid receiver and an amount within the balance: debit and credit happen once, with a reference number and an SMS or email confirmation

Use test design techniques to cut the number of tests:

• Equivalence partitioning and BVA (boundary value analysis) for each field: one valid group, invalid groups, and the boundaries.
• Group fields by type: use one reusable checklist for all text fields, all number fields, all date fields.
• **Decision...

• Each filter alone (category, brand, price range, rating) shows only matching products and the right count
• Different filters combine with AND; values in the same group (two brands) combine with OR
• Price range: min greater than max, min equal to max, negative, empty, not a number
• Clear filters resets the list;...

• A valid code lowers the total correctly (percentage and fixed amount), rounded to 2 decimals
• Wrong code, expired, not active yet, already used, wrong letter case, spaces around the code
• Minimum cart value, only some categories or products, sale items left out
• One use per user vs unlimited use; total usage...

• Search by date or route, choose seats, pay, and get a ticket with a unique ID or QR code
• Seat map: booked seats cannot be chosen; a maximum number of seats per booking; select and unselect
• Two users choose the same seat at the same time: one succeeds and the other sees a clear message
• A seat hold timer (for...

• Send and receive text in real time; delivery ticks (sent, delivered, read)
• An empty message is blocked; a very long message; emoji, links, code, text in many languages
• Media: image, file, voice; size limits; preview and download
• Group chat: add or remove members, admin rights, messages seen only by members -...

• Set pickup and drop; fare estimate; choose a vehicle type; a driver is assigned with a live arrival time
• Invalid location, same pickup and drop, location not available, outside the service area
• GPS permission denied; poor accuracy; the map and driver position update
• Cancel before and after a driver is...

• 200 and a token for valid credentials; the response has no password hash
• 400 for missing or bad JSON or empty fields; 401 for a wrong password or unknown user, with the same message
• 415 or 400 for the wrong content type; extra or unexpected fields are ignored
• Token expiry, format and claims are correct; the...

Build a table of roles and actions, and test each cell.

• Admin: create, edit and delete users, change settings. Editor: edit content but cannot manage users. Viewer: read only
• A direct URL or API call to a forbidden action returns 403, even if the button is hidden in the UI
• A role change works without a new login...

• Download for a chosen date range; the file opens correctly; the file name has the date range
• Contents match the screen and the database: totals, dates, currency format, order
• An empty range gives a file with only a header, or a message
• A very large range (100,000 rows): it finishes, or runs as a background job...

• An event triggers the notification once, with the right content, link, time and user
• Channels: push, email, SMS, in-app badge; each follows user preferences and opt-out
• Read and unread state, mark all as read, the badge count is right
• An offline device gets it later; old notifications are dropped
• Repeated...

• Scan a valid code: the right merchant and amount show, and payment is confirmed
• Invalid, damaged, blurred, expired, or non-payment QR: show a clear message
• Low light, angle, distance; flashlight button; scan from a gallery image
• Camera permission denied or blocked: guide the user to settings
• Static QR with...