Manual and API Testing (Postman) Interview Questions (2026 Master Guide)

Q1. What is the difference between Software Development Life Cycle (SDLC) and Software Testing Life Cycle (STLC)?

Foundation • 0-2 Yrs

SDLC encompasses the complete lifecycle of software creation: Requirements -> Design -> Development -> Testing -> Deployment -> Maintenance. STLC is a subset of SDLC focusing strictly on testing phases: Requirement Analysis -> Test Planning -> Test Case Development -> Test Environment Setup -> Test Execution -> Test Cycle Closure.

Q2. Explain the difference between Quality Assurance (QA) and Quality Control (QC).

Foundation • 0-2 Yrs

QA is process-oriented: proactive activities focused on preventing defects by improving development and testing processes (audits, standards). QC is product-oriented: reactive activities focused on identifying defects in the actual build through test execution before release.

Q3. What is the difference between Verification and Validation (V-Model)?

Foundation • 0-2 Yrs

Verification: 'Are we building the product right?' Static testing activities evaluating documents, architecture, and code without executing it (reviews, walkthroughs, inspections). Validation: 'Are we building the right product?' Dynamic testing executing the actual software build to verify business requirements.

Q4. Explain Boundary Value Analysis (BVA) and Equivalence Partitioning (EP).

Foundation • 0-2 Yrs

EP: Divides input data into valid and invalid partitions, selecting representative test cases from each partition. BVA: Tests boundaries between partitions where defects cluster most frequently: testing Minimum, Just Above Minimum, Nominal, Just Below Maximum, and Maximum values.

Q5. What is the Bug / Defect Life Cycle and its stages?

Foundation • 0-2 Yrs

New -> Assigned (lead assigns to developer) -> Open (developer analyzes) -> In Progress -> Fixed (developer resolves) -> Retest (tester verifies fix) -> Verified -> Closed. If the issue persists, status becomes Reopened. Other statuses include Rejected, Deferred, and Duplicate.

Q6. What is the difference between Severity and Priority in defect tracking?

Foundation • 0-2 Yrs

Severity: Technical impact of the defect on system functionality (Critical, Major, Moderate, Minor). Priority: Urgency of resolving the defect from a business perspective (High, Medium, Low). Example: Company logo missing on homepage is High Priority (brand visibility) but Low Severity (no broken functionality).

Q7. What is the difference between Smoke Testing and Sanity Testing?

Foundation • 0-2 Yrs

Smoke Testing (Build Verification Test): Broad, shallow test run on initial builds to verify critical core functionalities are stable before accepting the build for deep testing. Sanity Testing: Narrow, deep test run on stable builds verifying specific bug fixes or minor code changes without breaking existing modules.

Q8. What is Regression Testing and when is it executed?

Foundation • 0-2 Yrs

Regression Testing re-executes existing test suites to ensure that recent code modifications, bug fixes, or enhancements have not inadvertently broken or degraded pre-existing features. It is executed after every new build, bug fix, or environment change.

Q9. What is an API (Application Programming Interface) and why is API testing critical?

Foundation • 0-2 Yrs

An API is a software intermediary that allows two applications to communicate with each other. API testing validates the business logic layer directly without the UI layer, catching critical functional, security, and performance defects earlier in the sprint (Shift-Left testing) with faster test execution.

Q10. What are the primary HTTP methods in RESTful APIs?

Foundation • 0-2 Yrs

GET (retrieves data, safe and idempotent), POST (creates a new resource, non-idempotent), PUT (replaces an entire existing resource, idempotent), PATCH (partially updates specific fields of a resource), DELETE (removes a resource, idempotent), and HEAD (retrieves response headers only).

Q11. What does it mean for an HTTP method to be Idempotent?

Foundation • 0-2 Yrs

An operation is idempotent if executing it multiple times produces the exact same outcome on server state as executing it once. GET, PUT, DELETE, and HEAD are idempotent. POST is non-idempotent because multiple calls create multiple duplicate records.

Q12. Explain standard HTTP Status Code categories (2xx, 3xx, 4xx, 5xx).

Foundation • 0-2 Yrs

2xx (Success: 200 OK, 201 Created, 204 No Content). 3xx (Redirection: 301 Moved Permanently, 302 Found). 4xx (Client Errors: 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 429 Too Many Requests). 5xx (Server Errors: 500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable).

Q13. What is the difference between 401 Unauthorized and 403 Forbidden?

Foundation • 0-2 Yrs

401 Unauthorized: The request lacks valid authentication credentials (user is unauthenticated or token expired). 403 Forbidden: The server knows the user's identity, but the user does not possess authorization permissions to access the requested resource.

Q14. What is Postman and what are Collections and Environments?

Foundation • 0-2 Yrs

Postman is an API platform for building, testing, and documenting APIs. Collections: Group related API requests into organized folders. Environments: Sets of key-value variables (e.g., base_url, token) that dynamically change based on context (Dev, QA, Staging, Prod).

Q15. What is a Test Case and what are its standard components?

Foundation • 0-2 Yrs

A Test Case is a documented set of steps to verify a specific requirement: Test Case ID, Description, Preconditions, Test Data, Step-by-Step Instructions, Expected Result, Actual Result, Status (Pass/Fail), and Defect ID (if failed).

Q16. How do you write dynamic JavaScript test assertions in Postman?

Experienced • 3-5+ Yrs

In Postman's 'Scripts -> Post-response' tab, use the pm.test() function with Chai assertion library: pm.expect(pm.response.code).to.equal(200); and parse JSON payloads using pm.response.json() to assert schema fields, arrays, and value bounds.

Q17. How do you pass data dynamically between consecutive requests in Postman?

Experienced • 3-5+ Yrs

In the first request's test script, extract data from the response: const token = pm.response.json().access_token; then save it to an environment variable: pm.environment.set('authToken', token);. In the second request, reference it in headers as {{authToken}}.

Q18. What is Newman and how do you execute Postman collections in CI/CD pipelines?

Experienced • 3-5+ Yrs

Newman is Postman's command-line collection runner. It executes exported collection and environment JSON files via CLI: newman run collection.json -e env.json -r cli,htmlextra. It integrates into Jenkins or GitHub Actions to fail builds if API assertions fail.

Q19. How do you perform JSON Schema Validation in Postman?

Experienced • 3-5+ Yrs

Using tv4 or Ajv schema validator inside Postman scripts: Define expected JSON schema (specifying data types, required fields, formats), parse response, and assert: pm.expect(tv4.validate(jsonData, schema)).to.be.true; catching unexpected API contract breaking changes.

Q20. What is the difference between Authentication and Authorization in API security testing?

Experienced • 3-5+ Yrs

Authentication verifies WHO the user is (API Key, OAuth2 token, JWT). Authorization determines WHAT actions the authenticated user is permitted to perform (Role-Based Access Control RBAC). Test for BOLA (Broken Object Level Authorization) by attempting to access another user's data using a valid token.

Q21. Explain OAuth 2.0 Authorization Code Grant Flow for APIs.

Experienced • 3-5+ Yrs

1. Client redirects user to Authorization Server; 2. User consents and server returns Authorization Code; 3. Client exchanges Code + Client Secret with token endpoint; 4. Server validates and returns Access Token; 5. Client attaches Bearer Access Token to API calls.

Q22. What is API Mocking in Postman and when is it utilized?

Experienced • 3-5+ Yrs

Postman Mock Servers simulate backend endpoints before backend developers finish writing code. Frontend and QA teams can build and test against mock servers returning pre-defined sample responses based on examples, unblocking sprint workflows.

Q23. How do you perform API Performance and Load Testing in Postman?

Experienced • 3-5+ Yrs

Postman's Collection Runner includes a 'Performance' tab. Testers configure virtual user counts, ramp-up durations, and load profiles (fixed, ramp-up) to measure API response times, throughput (requests/sec), and error rates under stress.

Q24. What is Exploratory Testing and how does it differ from Scripted Testing?

Experienced • 3-5+ Yrs

Scripted Testing follows pre-written, detailed step-by-step test cases strictly. Exploratory Testing is simultaneous learning, test design, and test execution without formal scripts; experienced testers explore edge cases and unexpected user workflows dynamically based on intuition.

Q25. Explain the Test Pyramid concept (Unit vs Integration vs E2E).

Experienced • 3-5+ Yrs

The Test Pyramid recommends a balanced test portfolio: 1. Unit Tests (Base, largest quantity: fast, cheap, tests isolated functions); 2. Integration / API Tests (Middle: validates inter-module communication and business workflows); 3. End-to-End UI Tests (Top, smallest quantity: slow, brittle, expensive).

Q26. What is API Contract Testing and how does it differ from Functional Testing?

Experienced • 3-5+ Yrs

Functional testing verifies that the API returns the correct calculation or business data. Contract Testing (e.g., Pact) verifies that the API provider and consumer adhere to an agreed-upon schema contract (field names, types, headers) without requiring full end-to-end service deployments.

Q27. How do you test WebSockets and GraphQL in Postman?

Experienced • 3-5+ Yrs

Postman provides dedicated request types for WebSocket (connects to ws:// or wss://, sends text/binary frames, and logs bidirectional messages) and GraphQL (features built-in schema introspection, query builder, and variables tab).

Q28. What is Defect Density and how is it calculated?

Experienced • 3-5+ Yrs

Defect Density measures the number of confirmed defects identified in a software component divided by the size of the module (e.g., Defect Density = Total Defects / Function Points or KLOC), identifying high-risk, bug-prone modules requiring refactoring.

Q29. Explain Traceability Matrix (RTM) and its business purpose.

Experienced • 3-5+ Yrs

A Requirements Traceability Matrix (RTM) maps business requirements to corresponding test cases bidirectionally. It ensures 100% test coverage (no requirement missed) and enables impact analysis when requirements change.

Q30. How do you test Rate Limiting and Throttling in APIs?

Experienced • 3-5+ Yrs

Execute rapid automated loops using Postman Collection Runner or Newman sending bursts of requests exceeding the configured rate limit (e.g., >100 req/min). Verify that the API returns HTTP 429 Too Many Requests with a Retry-After response header.

Q31. Write a Postman test script asserting HTTP 200 status and response time under 500ms.

Live Coding Challenge

Using pm.test and pm.expect on response status and time.

pm.test("Status code is 200", function () {
    pm.response.to.have.status(200);
});

pm.test("Response time is acceptable", function () {
    pm.expect(pm.response.responseTime).to.be.below(500);
});

Q32. Write a Postman test script to parse a JSON response and verify an array contains 5 items.

Live Coding Challenge

Parse pm.response.json() and assert length.

pm.test("Verify user list contains 5 users", function () {
    const jsonData = pm.response.json();
    pm.expect(jsonData.users).to.be.an('array');
    pm.expect(jsonData.users.length).to.eql(5);
});

Q33. Write a Postman script to extract a JWT token from a login response and save it as an environment variable.

Live Coding Challenge

Save extracted property using pm.environment.set().

pm.test("Token extraction", function () {
    const data = pm.response.json();
    pm.expect(data).to.have.property("token");
    pm.environment.set("jwt_token", data.token);
});

Q34. Write a JSON Schema validation script in Postman using tv4.

Live Coding Challenge

Validate response data against a defined schema.

const schema = {
    "type": "object",
    "required": ["id", "email", "status"],
    "properties": {
        "id": { "type": "number" },
        "email": { "type": "string", "format": "email" },
        "status": { "type": "string" }
    }
};

pm.test("JSON Schema Validation", function () {
    pm.expect(tv4.validate(pm.response.json(), schema)).to.be.true;
});

Q35. Write a Newman CLI command to execute a collection with an HTML report.

Live Coding Challenge

Execute newman run with environment and htmlextra reporter.

newman run ./collections/OrderAPI.postman_collection.json \
  -e ./env/Staging.postman_environment.json \
  -r cli,htmlextra \
  --reporter-htmlextra-export ./reports/api_report.html

Q36. Write a Postman pre-request script generating a dynamic timestamp and UUID.

Live Coding Challenge

Using built-in crypto or lodash to populate request variables.

pm.environment.set("current_timestamp", new Date().toISOString());
pm.environment.set("request_uuid", pm.variables.replaceIn('{{$guid}}'));

Q37. Write a test script checking that every user object in an array has a non-empty 'email' property.

Live Coding Challenge

Loop through array and assert string length.

pm.test("Every user has valid email", function () {
    const users = pm.response.json().data;
    users.forEach(function(user) {
        pm.expect(user.email).to.be.a('string').and.not.empty;
    });
});

Q38. Write a Postman script to conditionally branch requests using postman.setNextRequest.

Live Coding Challenge

Skip or jump to next request based on condition.

const status = pm.response.json().status;
if (status === 'COMPLETED') {
    postman.setNextRequest('GenerateReceipt');
} else {
    postman.setNextRequest('CheckStatusAgain');
}

Q39. Write test cases for an e-commerce Coupon Code input field using BVA and EP.

Live Coding Challenge

Valid coupon 6-10 alphanumeric characters giving 10-50% discount.

/* Test Cases */
1. EP Valid: 'SAVE20' (6 chars) -> Pass, apply discount
2. BVA Min-1: 'ABCDE' (5 chars) -> Fail, display error
3. BVA Max: 'TENOFF2026' (10 chars) -> Pass
4. BVA Max+1: 'ELEVENCHARS' (11 chars) -> Fail
5. EP Invalid: Special chars '!@#$%' -> Fail, validation message
6. Empty input: Click submit -> Fail, required field message

Q40. Write a Postman assertion verifying that response header 'Content-Type' is application/json.

Live Coding Challenge

Verify response header using pm.response.to.have.header.

pm.test("Content-Type header is JSON", function () {
    pm.response.to.have.header("Content-Type");
    pm.expect(pm.response.headers.get("Content-Type")).to.include("application/json");
});