Quality Engineering
Crisp definitions + live test-design + metric literacy + own the CI quality gate & evidence-backed go/no-go. STOP before ISTQB cert, TMMi, company-wide QE org strategy.
- Functional test levels (unit / integration / system / E2E)
The four levels a feature is tested at, from a single function up to a full user journey through the deployed system.
'Difference between functional and non-functional testing?' / 'Explain the testing levels.'
- Test pyramid (+ ice-cream-cone anti-pattern)
The proportion model: many fast unit tests, fewer integration, fewest slow E2E — inverted = the ice-cream-cone anti-pattern.
'Explain the test pyramid — where should most tests live and why?'
- Smoke vs Sanity
Smoke = shallow-wide build-acceptance check that core paths work; sanity = narrow-deep check on a specific change/fix.
'Smoke vs sanity — difference? Which runs on a new build?' (single most-asked QE question).
- Regression vs Retesting
Retesting = confirm the specific fixed bug is gone; regression = confirm unrelated existing functionality did not break.
'Regression vs retesting?' + follow-up 'how do you pick regression scope with 2 hours before release?'
- Verification vs Validation
Verification = are we building it right (meets spec); validation = are we building the right thing (meets user need).
'Verification vs validation?'
- Input dimensions: positive, negative, boundary, data-driven
The four ways to vary inputs: valid, invalid, edge values, and parametrised data sets.
'How would you parametrise these cases in Pytest?' (embedded in test-design questions).
- Non-functional family (performance / security / usability / reliability / scalability / compatibility)
The quality attributes beyond correctness: load/stress/soak, security, usability, reliability, scalability, cross-browser/cross-platform compatibility.
'Name non-functional testing types.' / 'How would you approach performance testing?'
- Visual regression testing
Snapshot-comparing rendered UI to catch unintended visual changes.
'Have you done visual regression testing? How?'
- Accessibility testing (WCAG 2.1/2.2, POUR, A/AA/AAA, axe-core/Lighthouse)
Testing that the UI is usable by people with disabilities against WCAG success criteria.
'How would you test for accessibility? What is WCAG / POUR?'
- Exploratory / session-based testing
Unscripted, charter-driven investigation to find what scripted tests miss, time-boxed into sessions.
'What is exploratory testing and when do you use it over scripted?'
- Cross-browser / cross-platform compatibility testing
Verifying the app works across browser engines, OS, viewports/devices.
'How do you handle cross-browser testing?'
- Equivalence Partitioning (EP)
Divide inputs into classes that should behave the same, then test one representative per class.
'Design test cases for an age field 18-60 / a login form / a text box 1-10 chars.'
- Boundary Value Analysis (BVA, 2-value & 3-value)
Test at and just around the edges of each valid range, where bugs cluster.
'What are the boundary test cases for a field valid 18-65?' (canonical answer 17,18,19,64,65,66).
- Test case & bug-report anatomy
What a good test case (preconditions/steps/expected) and bug report (repro steps, expected vs actual, env, severity, evidence) contain.
'What makes a good bug report / test case?'
- Error Guessing
Experience-based guessing of likely defect-prone inputs (nulls, zeros, huge strings, special chars).
'What is error guessing?' / embedded in 'what else would you test here?'
- Test strategy vs test plan
Strategy = org-level, long-lived 'how we test here'; plan = project/release-level scope+schedule+resources.
'Test strategy vs test plan — difference?' (SDET-2 seniority probe).
- Decision Table testing
Tabulate combinations of conditions -> expected actions to cover business-rule logic systematically.
'Design test cases for [feature with multiple conditions].' / 'When would you use a decision table?'
- Acceptance criteria (writing + testing against)
The story-level conditions that define 'done'; QA helps write them and derives tests from them.
'How do you translate a feature/story into test cases and validation criteria?'
- Test plan contents + entry / exit / suspension-resumption criteria
The release/project-level doc: scope, approach, resources, schedule, and the criteria to start/stop/resume a test cycle.
'What goes in a test plan? What are entry and exit criteria?'
- Requirements Traceability Matrix (RTM) + impact analysis
A map of requirement -> test case(s) -> defect used to prove coverage and assess impact when a requirement changes.
'What is an RTM / traceability matrix and why use it?'
- Risk-based test prioritization
Prioritise what to test by probability-of-failure x business-impact when time/resources are limited.
'You have 2 hours before release — what do you test?' / 'How do you decide test scope?'
- State Transition testing
Model a system's states + valid/invalid transitions (e.g. order lifecycle) and test the transitions.
'How would you test a workflow with multiple states?' (occasional).
- Pairwise / combinatorial (all-pairs) testing
When many inputs each have many values, test all PAIRS of values instead of the full cartesian explosion.
'How do you combine pairwise with EP for 5 fields x 4 partitions?' (deeper 2026 follow-up).
- Defect lifecycle (states)
The states a bug moves through: New -> Assigned -> Open -> Fixed -> Retest -> Closed / Reopened / Deferred / Rejected.
'Walk me through the defect / bug life cycle.'
- Severity vs Priority (+ the 4 quadrant examples)
Severity = technical impact of the bug; priority = business urgency to fix. They vary independently.
'Severity vs priority — give a high-sev/low-pri and a low-sev/high-pri example.'
- Defect prevention / 'quality designed in' mindset
Framing quality as preventing classes of bugs upstream (better criteria, contract tests, linting, reviews) rather than only detecting them.
'How do you think about quality beyond finding bugs?'
- Shift-left (defect-cost curve + practices)
Move testing earlier — testability in design, tests in PRs, criteria in refinement — because bug-fix cost rises the later it's found.
'What is shift-left testing and how have you practiced it?'
- PR / code review for testability & test presence
Reviewing developers' PRs to check code is testable and ships with adequate tests.
'How do you ensure code is testable? Do you review PRs?'
- Defect triage
The recurring meeting/process to assess new bugs and assign severity, priority, and owner.
'How does defect triage work? / Have you run triage?'
- Root Cause Analysis (5-Whys, root-cause classification)
Systematically finding WHY a defect occurred (not just fixing it) and classifying the cause to prevent recurrence.
'How do you do root cause analysis on a production defect?'
- Quality metrics (defect leakage/escape rate, defect density, DRE, coverage, pass rate, MTTD/MTTR)
The numbers that quantify quality and let you report trends and make decisions.
'What quality metrics do you track? How do you measure coverage / defect leakage?'
- Test data management + mock services / service virtualization
Providing stable, isolated, repeatable test data and stubbing external dependencies so tests are deterministic.
'How do you manage test data? How do you keep tests isolated/repeatable?'
- AI/LLM output quality: golden datasets + eval quality gates
Testing non-deterministic AI/LLM outputs for accuracy/consistency using golden reference sets and measurable eval thresholds wired as CI gates.
'How do you test a feature whose output is non-deterministic / an LLM?'
- Release / quality gates in CI (what blocks merge/deploy)
Automated pass/fail thresholds in the pipeline that block a merge or release (coverage floor, zero critical defects, green smoke, lint/scan).
'Design a quality gate.' / 'What blocks a merge in your pipeline?'
- Go / no-go release decision (inputs + evidence)
The call on whether a build is releasable, made from quality evidence (open defect severity, coverage, gate status, risk).
'A critical bug is found the night before release — what do you do?' / 'How do you make a go/no-go call?'
- Flaky test rate: detection, quarantine, self-healing/AI
Tests that pass/fail non-deterministically; the discipline to detect, quarantine, root-cause and eliminate them so the suite stays trusted.
'Your suite is flaky — how do you fix it?' / 'How do you handle flaky tests in CI?'
- Ceremonies (standup, planning, review, retro, refinement)
The recurring Scrum meetings and what QA does in each.
'How does QA fit into Agile/Scrum? What do you do in each ceremony?'
- User story + acceptance criteria + Definition of Done / Ready
The unit of Agile work, its 'done' conditions, and the team's shared completion bar (DoD) / start bar (DoR).
'What is Definition of Done? What is a user story / acceptance criteria?'
- Three Amigos
The refinement practice where BA/dev/QA review a story together from three perspectives before build.
'What is the Three Amigos?'
- Continuous testing in CI/CD
Automated tests running on every commit/PR/deploy so quality feedback is continuous, not a phase.
'How is testing integrated into your CI/CD? What is continuous testing?'
- Given / When / Then / And / But
The step keywords: context / action / expected outcome (+ chaining).
embedded in 'write a Gherkin scenario'.
- Gherkin structure (Feature / Scenario / Scenario Outline / Background / Examples)
The Given/When/Then feature-file grammar for expressing behaviour as executable specs.
'Write a Gherkin scenario for [login/checkout].'
- Cucumber (Java/JS) awareness
The dominant BDD tool named in JDs, even though his path is Python.
'Do you have Cucumber experience?'
- Declarative vs imperative scenarios (best practice)
Declarative = business-language steps (what); imperative = UI-detail steps (click X, type Y) which are brittle.
'Gherkin best practices?' / 'Declarative vs imperative steps?'
- When BDD helps vs when it is overhead
The judgment on adopting BDD: worth it for cross-role collaboration on business rules; overhead for pure-engineer suites.
'When would you NOT use BDD?' / 'Is BDD worth the overhead?'
- Step definitions binding Gherkin to code
The code (regex/expression-matched functions) that executes each Gherkin step.
'How does a Gherkin step connect to actual code?'
- pytest-bdd / Behave (his Python path) — hooks, fixtures, tags
The Python-native BDD tools, so his BDD story fits his stack rather than Java Cucumber.
'Which BDD framework do you use in Python?'
- Full ISTQB certification / verbatim syllabus & 7 principles
The formal ISTQB cert grind and memorising exact definitions/principle numbers.
rarely; occasionally 'do you have ISTQB?' (nice-to-have, not gating).
- Test-maturity models (TMMi, TPI Next), Six Sigma / CMMI governance
Org/consulting-level process-maturity and quality-governance frameworks.
not asked at SDET-2.
- Company-wide QE org strategy across teams
Designing quality strategy for a whole engineering org.
not for this level.
- Heavyweight IEEE-829 formal test plans; formal methods / model-based / mutation-tooling internals
Exhaustive formal documentation templates and academic/specialist testing methods.
not asked; teams use lightweight docs.
