1. What is Web Application Testing?
Web application testing is the process of validating a web-based system to ensure it works correctly, securely, efficiently, and consistently across browsers, devices, and environments.
For experienced professionals, web application testing is not limited to UI validation. It includes:
- Backend web services and API testing
- Integration between UI, APIs, databases, and third-party systems
- Security and penetration checks
- Performance and scalability validation
- Production defect analysis and root cause analysis (RCA)
In modern architectures (microservices, cloud-native apps), web services are the backbone, making their testing critical.
2. Functional Testing Scenarios for Web Applications (Service-Driven)
Even when your primary role is web services testing, interviewers expect strong understanding of UI-driven scenarios powered by APIs.
Login & Authentication Scenarios
- Login API accepts valid credentials
- Invalid credentials return correct HTTP status codes
- Error messages do not expose sensitive details
- Authentication token/session generated after login
- Concurrent login handling across devices
- Logout API invalidates token/session
Session Timeout Scenarios
- Session/token expires after configured idle time
- Expired token rejected by all secured APIs
- Token refresh flow works correctly
- Session invalidated across browser tabs
- Back-button behavior does not restore session
Cookies & Caching Scenarios
- Cookies created only when required
- Cookies have Secure, HttpOnly, and SameSite attributes
- Tokens not stored in plain text cookies
- Sensitive API responses not cached
- Cache-control headers validated
- CDN caches only static, public responses
API Call Functional Scenarios
- Correct HTTP method usage (GET, POST, PUT, PATCH, DELETE)
- Mandatory headers validation
- Request payload structure validation
- Boundary value handling
- Idempotency validation
- Proper error handling and retries
3. UI + UX + Responsive + Accessibility Test Cases (Service Impact)
Even senior API testers must understand how services affect UI behavior.
UI + API Integration Checks
- UI displays correct data returned by APIs
- Graceful handling of API failures
- No raw API or stack trace errors shown on UI
- Proper loading indicators during API calls
UX with API Failures
- User-friendly error messages for service downtime
- Retry mechanisms for transient failures
- Timeout handling without UI freeze
Responsive & Accessibility Considerations
- Same API behavior on mobile and desktop
- Accessibility tools do not expose sensitive API data
- Keyboard navigation triggers correct API calls
- Screen readers do not read hidden or sensitive responses
4. Web Services Testing Interview Questions for Experienced (with Answers)
Q1. What is web services testing?
Answer:
Web services testing validates backend services that communicate over HTTP to ensure correct functionality, reliability, performance, and security without relying on a UI.
Q2. Difference between web application testing and web services testing?
Answer:
Web application testing focuses on UI and end-user flows, while web services testing focuses on backend logic, data exchange, and integrations.
Q3. What types of web services have you worked with?
Answer:
RESTful services and SOAP services, including internal microservices and third-party integrations.
Q4. What is REST?
Answer:
REST is an architectural style using stateless HTTP communication to manage resources via standard methods.
Q5. What is SOAP?
Answer:
SOAP is a protocol using XML messages and strict standards like WSDL for service communication.
Q6. REST vs SOAP – which do you prefer and why?
Answer:
REST is preferred for its simplicity, performance, and JSON support. SOAP is used where strict contracts and enterprise-level security are required.
Q7. What is statelessness in REST?
Answer:
Each request contains all required information, and the server does not store client state.
Q8. What is idempotency?
Answer:
An API operation that produces the same result even when executed multiple times.
Q9. What is API contract testing?
Answer:
Validating API behavior against agreed specifications to avoid integration failures.
Q10. How do you validate API versioning?
Answer:
By ensuring backward compatibility and verifying responses for different API versions.
Q11. What is schema validation?
Answer:
Ensuring request and response payloads match defined data types, formats, and structure.
Q12. What are common defects in web services?
Answer:
Incorrect status codes, missing validations, insecure endpoints, inconsistent responses, and performance issues.
Q13. What is deep API testing?
Answer:
Testing APIs independently without UI involvement to isolate backend issues.
Q14. How do you test error handling in APIs?
Answer:
By sending invalid inputs and verifying meaningful, consistent error responses.
Q15. How do you test pagination APIs?
Answer:
Validate page size, page number handling, sorting, filtering, and performance.
5. Security & Penetration-Based Interview Questions
Q16. What is API security testing?
Answer:
Testing APIs for vulnerabilities such as injection attacks, broken authentication, and data exposure.
Q17. What is SQL Injection in APIs?
Answer:
Manipulating backend SQL queries through malicious API inputs.
Example:
‘ OR ‘1’=’1
Q18. How do you test SQL Injection?
Answer:
Send malicious payloads and observe error messages, response behavior, or unauthorized data access.
Q19. What is XSS in web services testing?
Answer:
APIs returning unsanitized data consumed by UI can lead to XSS.
HTML Example:
<script>alert(‘XSS’)</script>
Q20. What is CSRF?
Answer:
Forcing authenticated users to execute unwanted API actions.
Q21. How do you prevent CSRF?
Answer:
CSRF tokens, SameSite cookies, and header validation.
Q22. What is authentication abuse?
Answer:
Brute force or credential stuffing attacks on authentication APIs.
Q23. How do you test rate limiting?
Answer:
Send repeated API requests and verify throttling or blocking behavior.
Q24. What is broken object-level authorization?
Answer:
Accessing other users’ data by modifying object IDs in API requests.
Q25. What security headers are important for APIs?
Answer:
Authorization, Cache-Control, Content-Type, CSP-related headers.
6. API + Web Services Validation Examples
Common HTTP Status Codes
- 200 OK
- 201 Created
- 204 No Content
- 400 Bad Request
- 401 Unauthorized
- 403 Forbidden
- 404 Not Found
- 500 Internal Server Error
Sample JSON Request
{
“username”: “experiencedUser”,
“password”: “Secure@123”
}
Sample JSON Response
{
“token”: “eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9”,
“expiresIn”: 3600
}
Sample XML (SOAP) Request
<loginRequest>
<username>experiencedUser</username>
<password>Secure@123</password>
</loginRequest>
Postman Usage
- Validate headers and tokens
- Assert response body and schema
- Measure response time
- Automate collections
SOAPUI Usage
- Validate WSDL
- XML schema validation
- SOAP fault handling
- Load and stress testing
7. Web Performance Checkpoints (Experienced Level)
Key Performance Metrics
- TTFB (Time to First Byte)
- API response time
- Throughput
- Concurrent request handling
- Error rate under load
CDN & Caching
- Cache static responses only
- Validate cache-control headers
- Sensitive APIs not cached
- Compression enabled
8. Browser & Device Compatibility Scenarios (API Impact)
- Same API behavior across browsers
- Mobile and desktop parity
- JavaScript clients handle API responses consistently
- Network fluctuation handling
9. Real-Time Defects with RCA
Defect 1: Login API Returns 200 for Invalid Credentials
- Severity: High
- Priority: High
- Root Cause: Missing backend validation
- Fix: Enforce credential validation and correct status codes
Defect 2: Token Remains Valid After Logout
- Root Cause: Token not revoked server-side
- Fix: Implement token revocation or blacklist
Defect 3: Slow API Response in Production
- Root Cause: Unoptimized database queries
- Fix: Query optimization and indexing
10. Defect Logging Format + RCA
Defect Template
- Defect ID
- Summary
- Steps to Reproduce
- Expected Result
- Actual Result
- Severity
- Priority
- Root Cause
- Environment
Severity vs Priority
- Severity: Business or security impact
- Priority: Urgency of fix
11. Quick Revision Sheet
- Validate HTTP methods and payloads
- Check authentication and authorization
- Test negative and boundary scenarios
- Validate status codes
- Perform security checks
- Monitor performance metrics
- Perform RCA for production issues
12. FAQs + CTA
FAQ 1: What level of API knowledge is expected from experienced testers?
Strong understanding of REST/SOAP, security, performance, and integration is expected.
FAQ 2: Is automation mandatory for experienced web services testers?
Not mandatory, but knowledge of API automation and CI pipelines is a strong advantage.