API Testing Interview Guide: Preparation for SDET & QA

Summary: This is a practical, interview-focused guide to API testing for SDETs and QA engineers. Learn the fundamentals, testing disciplines, test-case design, tools (Postman, SoapUI, REST Assured), advanced strategies, common pitfalls, error handling, and a ready checklist to ace interviews. First, understand API Testing by view the video below. Then, read on.

1. Why API Testing Matters

APIs are in the core architecture of modern applications. They implement business logic, glue services together, and often ship before a UI exists. That makes API testing critical: it validates logic, prevents cascading failures, verifies integrations, and exposes issues early in the development cycle. In interviews, explaining the strategic value of API testing shows you think beyond scripts and toward system reliability.

What API testing covers

Think in four dimensions: functionality, performance, security, and reliability. Examples: confirm GET /user/{id} returns correct data, ensure POST /login meets response-time targets under load, verify role-based access controls, and validate consistent results across repeated calls.

2. Core Disciplines of API Testing

Show interviewers you can build a risk-based test strategy by describing these disciplines clearly.

Functional testing: 

Endpoint validation, input validation, business rules, and dependency handling. Test positive, negative, and boundary cases so the API performs correctly across realistic scenarios.

Performance testing

Measure response time, run load and stress tests, simulate spikes, monitor CPU/memory, and validate caching behavior. For performance questions, describe response-time SLAs and how you would reproduce and analyze bottlenecks.

Security testing

Validate authentication and authorization, input sanitization, encryption, rate limiting, and token expiry. Demonstrate how to test for SQL injection, improper access, and secure transport (HTTPS).

Interoperability and contract testing

Confirm protocol compatibility, integration points, and consumer-provider contracts. Use OpenAPI/Swagger and tools like Pact to keep the contract in sync across teams.

3. Writing Effective API Test Cases

A great test case is clear, modular, and repeatable. In interviews, explain your test case structure and show you can convert requirements into testable scenarios.

Test case template

Include Test Case ID, API endpoint, scenario, preconditions, test data, steps, expected result, actual result, and status. Use reusable setup steps for authentication and environment switching.

Test case design tips

Automate assertions for status codes, response schema, data values, and headers. Prioritize test cases by business impact. Use parameterization for data-driven coverage and keep tests independent so they run reliably in CI.

4. The API Tester’s Toolkit

Be prepared to discuss tool choices and trade-offs. Demonstrate practical experience by explaining how and when you use each tool.

Postman

User-friendly for manual exploration and for building collections. Use environments, pre-request scripts, and Newman for CI runs. Good for quick test suites, documentation, and manual debugging.

SoapUI

Enterprise-grade support for complex SOAP and REST flows, with built-in security scans and load testing. Use Groovy scripting and data-driven scenarios for advanced workflows.

REST Assured

Ideal for SDETs building automated test suites in Java. Integrates with JUnit/TestNG, supports JSONPath/XMLPath assertions, and fits neatly into CI pipelines.

To get FREE Resume points and Headline, send your resume to  Inder P Singh in LinkedIn at https://www.linkedin.com/in/inderpsingh/

5. Advanced Strategies

Senior roles require architecture-level thinking: parameterization, mocking, CI/CD integration, and resilience testing.

Data-driven testing

Use CSV/JSON data sources or test frameworks to run the same test across many inputs. This increases test coverage without duplicating test logic.

Mocking and stubbing

Use mock servers (WireMock, Postman mock servers) to isolate tests from unstable or costly third-party APIs. Mocking helps reproduce error scenarios deterministically.

CI/CD integration

Store tests in version control, run them in pipelines, generate reports, and alert on regressions. Automate environment provisioning and test data setup to keep pipelines reliable.

6. Common Challenges and Practical Fixes

Show you can diagnose issues and propose concrete fixes:

• Invalid endpoints: verify docs and test manually in Postman.
• Incorrect headers: ensure Content-Type and Authorization are present and valid.
• Authentication failures: automate token generation and refresh; log token lifecycle.
• Intermittent failures: implement retries with exponential backoff for transient errors;
• Third-party outages: use mocks and circuit breakers for resilience.

7. Decoding Responses and Error Handling

Display fluency with HTTP status codes and how to test them. For each code, describe cause, test approach, and what a correct response should look like.

Key status codes to discuss

400 (Bad Request) for malformed payloads; 401 (Unauthorized) for missing or invalid credentials; 403 (Forbidden) for insufficient permissions; 404 (Not Found) for invalid resources; 500 (Internal Server Error) and 503 (Service Unavailable) for server faults and maintenance. Explain tests for each and how to validate meaningful error messages without leaking internals.

8. Interview Playbook: Questions and How to Answer

Practice concise, structured answers. For scenario questions, follow: Test objective, Test design, Validation.

Examples to prepare:

• Explain API vs UI testing and when to prioritize each.
• Design a test plan for a payment API including edge cases and security tests.
• Describe how you would integrate REST Assured tests into Jenkins or GitLab CI.
• Show a bug triage: reproduce, identify root cause, propose remediation and tests to prevent regression.

Final checklist before an interview or test run

• Validate CRUD operations and key workflows.
• Create error scenarios for 400/401/403/404/500/503 codes.
• Measure performance under realistic load profiles.
• Verify security controls (auth, encryption, rate limits).
• Integrate tests into CI and ensure automated reporting.

API testing is an important activity. In interviews, demonstrate both technical depth and practical judgment: choose the right tool, explain trade-offs, and show a repeatable approach to building reliable, maintainable tests.

Send a message using the Contact Us (right pane) or message Inder P Singh (18 years' experience in Test Automation and QA) in LinkedIn at https://www.linkedin.com/in/inderpsingh/ if you want deep-dive Test Automation and QA projects-based Training.

Security Testing Automation Strategies

Security Testing Automation Strategies

To find security vulnerabilities efficiently, you can implement robust security testing automation strategies.

Example: Security Testing Automation Strategies in Action

// Example 1: Vulnerability Scanning
Utilize tools like OWASP ZAP to scan your application for known vulnerabilities
Automate the scanning process to perform regular security checks

// Example 2: Penetration Testing
Automate penetration tests using tools like Metasploit to simulate real-world attacks
Identify weaknesses in your application's defenses and address them proactively

Practical Exercises

• Set up OWASP ZAP or a similar tool to perform vulnerability scans on your application and automate the scanning process.
• Conduct automated penetration tests using Metasploit or a similar tool to identify security vulnerabilities in your application.

FAQ (Interview Questions and Answers)

1. What is the purpose of security testing?
   Security testing aims to identify and mitigate vulnerabilities in an application to protect it from potential security breaches.
   Security testing ensures that an application meets security requirements.
   Security testing focuses solely on the user management functionality of an application.
   
2. What is vulnerability scanning?
   Vulnerability scanning requires manually reviewing the application's source code.
   Vulnerability scanning involves using automated tools to identify known vulnerabilities in an application's code or configuration.
   Vulnerability scanning is not necessary for secure applications.
   
3. What is penetration testing?
   Penetration testing verifies the login functionality of an application.
   Penetration testing only focuses on performance optimization.
   Penetration testing involves simulating real-world attacks on an application to identify security weaknesses and potential entry points for attackers.
   
4. How can automation benefit security testing?
   Automation is not applicable for security testing.
   Automation can streamline repetitive security testing tasks, increase test coverage, and detect vulnerabilities earlier in the development process.
   Automation makes security testing more complex.
   

Your Total Score: 0 out of 4

Remember to just comment if you have any doubts or queries.

Cyber Security Tutorial For Beginners

Security Testing

Great job on starting a new lesson! After reading this lesson, click Next 👉 button at bottom right to continue to the next lesson.

Security testing

Security testing is a test type of software testing that tests the security of a software. Security testing helps to find vulnerabilities and threats that could allow unauthorized access, data manipulation, loss of functionality or other security issues. Security testing finds if the software and its data and resources are protected from possible intruders.

Security testing examples

• You test the security of your mobile app by simulating different network conditions, such as public Wi-Fi, VPN, proxy, etc. You measure the authentication level, and authorization level, and encryption level of the app under different network conditions.
  
• You test the security of your database system by simulating users with different privilege levels running different queries, such as select, insert, update, delete, etc. You measure the access control level, data integrity level, and audit trail level of the system under different privilege levels for different types of queries.
• You test the security of your online banking website by setting up an isolated test environment and simulating different types of attacks, such as SQL injection, cross-site scripting, phishing, etc. in it. You find the vulnerability level, and risk level of each attack.
  
• You test the security of your game application by simulating different user actions, such as login, purchase, chat, logout, etc. You measure the confidentiality level, integrity level, and availability level of the game during different user actions.

Tips for security testing

• Identify the security requirements and technical specifications of your software.
• Design the security test cases that cover the most frequently used and critical scenarios for your software system or application.
• Use safe security testing tools and techniques to define, and automate your security test cases.
• Set up an isolated test environment to execute your security test cases.
  
• Analyze and report the security test results with any security vulnerabilities or issues discovered by you.

FAQ (interview questions and answers)

1. What is the difference between security testing and penetration testing?
   Security testing is a broad term that covers all types of testing that evaluate the security of a software system. Penetration testing (or pen testing) is a specific type of security testing that simulates an attack from a malicious hacker to find vulnerabilities and exploit them.
2. What are some tools for security testing?
   Nmap, Metasploit, Burp Suite, OWASP ZAP, etc.
3. Is security testing a type of non-functional testing?
   Yes, security testing is a type of non-functional testing that tests how secure a system or application is under different workloads and conditions. In fact, security testing is distinct testing domain that focuses specifically on evaluating the security aspects of a software system.
4. How do you perform vulnerability scanning?
   You perform vulnerability scanning by using automated software to scan the software system against known vulnerability signatures or databases.

Remember to just comment if you have any doubts or queries.

How to keep your passwords secure?

Password security is an important part of security of computer systems against unauthorized internal or external access. Therefore, let us consider this topic. Now, what is a password? A password is a string of characters that you give to verify that you are you when you log on to a computer system. In other words, a password is used to authenticate you to a computer system. We will see tips to create a secure password. Next, we will see guidelines for application developers to implement good password security. But first, let us see the different types of passwords.

Testing cross-site scripting (XSS)

We have heard about cross-site scripting (XSS) attacks on major websites and also that a majority of websites are open to XSS attacks. How can we test for XSS vulnerabilities in our own web application? 

Common Security Terms - More terms

In the past, I have written about some important system security terms here. Below is the enhanced list which you may find useful. See my video, Cyber Security Basic Terms and Concepts or read on...

 

1. Allowed IP address list
It is a list of specific external IP addresses that are allowed to connect to and use the system. Generally speaking, the use of this list is more restrictive than allowing users from only specific time zones or only specific geographic locations.

2. Anti-spyware software
It is the software that searches and destroys spyware. Spyware is software that collects information from a system and transmits it to its server(s). Spyware  generally works silently without harming the resources of the host system. Anti-spyware software needs the latest engine and anti-spyware definitions to provide up-to-date protection to the system.

3. Anti-virus software
It is the software that detects and removes virus. Viruses are software that restrict, harm or render the host system resources unusable. Anti-virus software needs the latest engine and virus definitions to provide up-to-date protection to the system.

4. Authentication
It is the process of confirming the genuineness of an entity or data. For example, when a user logs into a website, the website tries to confirm if the user is genuine. That is, he is using the correct login name and password which are active in the site database. There can be other user data involved in authentication e.g. security token, Personal Identification Number (PIN) or finger prints/ retina print.

5. Authorization
It is the grant of permissions to do certain actions. For example on a website, a general user may view their transactions and modify their profile. But, if the general user is inactive, he may only activate his account and not even view his own profile. An admin user may view and modify the settings of the website, but may not view any user's data.

6. Cryptography
It is the use of techniques to assure secure communication. Such techniques include using encryption algorithms and digital signatures. For example, a website may require encrypted data sent from the server to the client browser. This data is decrypted in the client and then rendered to the user.

7. Environmental security
It is the provision of an optimum working environment to the system. Examples of environmental security include providing to the system the correct temperature range, a stable working platform and a dust-free and dehumidified environment.

8. Exploit
An exploit can be a wide range of items e.g. a set of commands, a set of data or even a particular system. It is possible to use an exploit against an insecure information system with the purpose of generating undesirable behavior in the system. Exploits always target a vulnerability (see below) in the system. For example, an attacker places exploit code on a trusted website. A user accesses the site from an insecure client machine which results in the user's browser executing the exploit code. The attacker then runs some attack using the user's machine with user credentials.

9. Firewall
A firewall is a software-based or hardware-based device that can be configured to allow genuine network traffic to go through and stop malicious traffic. For example, a firewall may intercept all network packets sent to an application, such as a browser. If the traffic originates from a known dangerous source, it may drop all the packets preventing harm to the client machine.

10. Identity
It is the set of data that is unique to a person. The digital identity of a person is the identity that is used on-line. For example, the identity of an employee may comprise of attributes such as Employee number, Date of joining, First name and Last name. The employee is then required to use this identity within the organization throughout their stay.

11. Internet security suite
It is the collection of various system security products (like anti-virus, anti-spyware, email spam protector, firewall and backup) all from the same software vendor.

12. Login name
This is the name by which the system identifies a user internally. It may or may not be the same as the user name which is the name displayed by the system and communicated to other users. For example, isingh followed by 30 is my Gmail login name but my user name is Inder P Singh which is displayed in my inbox and in my emails to others.

13. Penetration test
It is a test to check the security of a network while pretending to be an external attacker. It is also called a pentest. The goal of a pentest is to gain access and some level of control over a device within the network. Valuable information is discovered by a pentest e.g. vulnerabilities present in the network and the effectiveness of automatic network scanning software.

14. Physical security
It is the presence of physical barriers to information resources of an organization. Examples include gated access manned by security guards, access card swipes required to enter the premises and logged access to restricted areas within the premises. Physical security works in conjunction with operational security. For example, gated access needs dutiful logging by someone of the persons entering the restricted area.

15. (Web) Proxy server
It is a server through which a user may connect to a web site. The web site gets the user information (e.g. IP address, geographic location, operating system, browser) of the proxy server and not of the user system. Therefore, a proxy server makes the user anonymous to the web site. But, the proxy server may or may not itself log the user system information.

16. Site advisor
It is the software that works within the browser to ensure that the user visits only safe web sites. It warms the user whenever the user clicks on a link pointing to a suspect website (that may contain viruses, malware or spyware).

17. Threat
It is a danger to the information resources of an organization. It can be intentional e.g. an external attacker or accidental e.g. an earthquake. There are usually numerous threats to the information resources e.g. natural catastrophes, power outages, hardware/ software failures and malicious individuals/ organizations. Information resources of different organizations may face the same threats.

18. Updates
These are the new program versions, engine versions, definitions, databases and bug fixes etc. released by software vendors from time to time. Updates are available for software like operating systems, applications, anti-virus software and anti-spyware software. In order to keep a system secure, it is important to keep all software updated.

19. User name
This is the name which is displayed to the user and communicated to other users. See the example in Login name above.

20. Vulnerability
It is a weakness within the information system of an organization. For example, software vulnerability arising from insufficient testing, hardware vulnerability arising from its insecure storage and physical site vulnerability arising from its location within a natural disaster prone area.

SQL Injection

If you have read my earlier article, Code injection attacks, you would have some idea about SQL injection attack. This post explains SQL injection in detail so that you may understand it well.

What is the SQL injection vulnerability? Vulnerability is a weakness in the application software under test that can be attacked to cause the application (or even the underlying operating system) to behave in an undesirable manner. The SQL injection (SQLi in short) vulnerability lives in the middle-layer or the database layer of the application. It exists when the application executes a dynamic SQL query against the database without validating, escaping or rejecting the unexpected inputs given by the attacker. These inputs become a part of the dynamic SQL query and are executed against the database.

What is the SQL injection attack? It occurs when some text or even another SQL query is inserted into the application's SQL query. Attacks can be successful or unsuccessful depending on the application and the underlying database. A successful SQL injection attack may show confidential data to the attacker, allow the attacker to impersonate another user, increase the attacker's privileges to higher levels, insert/ modify/ delete data in the database tables or even perform administrative operations on the database like shutting down the database instance.

With this background, let us see examples showing SQL injection.

Example 1. The application query is

SELECT * from Salaries WHERE EmployeeName = ? AND EmployeeId = ?

The EmployeeName and EmployeeId are strings that are obtained from the client-side application. The intention of the developer is that an EmployeeName, say John, and an EmployeeId, say A100, is sent by the client to the server. After concatenating these values, the query becomes

SELECT * from Salaries WHERE EmployeeName = 'John' AND EmployeeId = 'A100'

The application then shows the salary details of this particular employee. Now, the attacker passes  "name" as the EmployeeName and "Id' OR 'x'='x" for EmployeeId. After concatenating these values, the query becomes

SELECT * from Salaries WHERE EmployeeName = 'name' AND EmployeeId = 'Id' OR 'x'='x'

The result is that the WHERE clause now contains an OR  condition that is always true. Due to operator precedence, this query returns all rows of the Salaries table.

Example 2. The application query on the login page of the application is

SELECT UserName FROM Users WHERE UserName = ? AND Password = ?

As in the previous example, there are two inputs obtained from the client-side application. Here, the developer expects two strings, say John and Smith99, are sent by the client to the server. In such a case, the query becomes

SELECT UserName FROM Users WHERE UserName = 'John' AND Password = 'Smith99'

If this UserName and Password combination exists in the users table, it returns one or more rows. Instead, the attacker passes "Administrator'--" and "password" values. After concatenating these values, the query becomes

SELECT UserName FROM Users WHERE UserName = 'Administrator'--' AND Password = 'password'

After removing the commented part, the query is effectively

SELECT UserName FROM Users WHERE UserName = 'Administrator'

The result is that if there is a user named Administrator, the attacker logs into the application impersonating this user and has all of the user's privileges on which to base further attacks.

Example 3. The application query on the search page of the application is

SELECT * FROM Products WHERE ProductName = ?

If the attacker provides the value "name'; DELETE FROM Products;--", the query becomes

SELECT * FROM Products WHERE ProductName = 'name'; DELETE FROM Products;

If the database allows batch execution (of multiple queries), the latter query delete all rows from the Products table.

I hope that you understand SQL injection now. Few other points to note are

1. SQL injection is further divided into two categories, SQL manipulation and Code injection. Strictly speaking, examples 1 and 2 involve SQL manipulation. Example 3 involves Code injection, because extra SQL code is inserted there.

2. If the attacker knows in advance about the attack SQL, he can devise complex attacks. This is possible if the application throws error messages showing the SQL query text or if it is an Open Source application or if the attacker somehow obtains access to the application source code.

3. Testing SQL injection can be automated. A variety of  tools are available for this. Examples include SQLiX (SQL Injection Scanner) and sqlmap (Open Source Penetration testing tool).

Image: Ambro / FreeDigitalPhotos.net

Code injection attacks

If you are going to do software security testing of applications, you must be aware of possible code injection attacks. This is especially required when testing web applications because they face a hostile environment, the internet. Code injection means adding extra code to an executing application with the purpose of modifying the application behavior. This extra code can be in the form of HTML, Javascript or SQL or even unhandled type of text (e.g. special characters and long strings). Here are the types of code injection attacks.

Common Security Terms

I thought about mentioning some important computer security terms. It would be good if you know and understand these terms which are commonly used in computer security. See my video, Cyber Security Basic Terms and Concepts or read on.

1. Authentication
It is the process of confirming the genuineness of an entity or data. For example, when a user logs into a website, the website tries to confirm if the user is genuine. That is, he is using the correct user name and password which are active in the site database. There can be other user data involved in authentication e.g. security token, Personal Identification Number (PIN) or finger prints/ retina print.

2. Authorization
It is the grant of permissions to do certain actions. For example on a website, a general user may view their transactions and modify their profile. But, if the general user is inactive, he may only activate his account and not even view his own profile. An admin user may view and modify the settings of the website, but may not view any user's data.

3. Cryptography
It is the use of techniques to assure secure communication. Such techniques include using encryption algorithms and digital signatures. For example, a website may require encrypted data sent from the server to the client browser. This data is decrypted in the client and then rendered to the user.

4. Exploit
An exploit can be a wide range of items e.g. a set of commands, a set of data or even a particular system. It is possible to use an exploit against an insecure information system with the purpose of generating undesirable behavior in the system. Exploits always target a vulnerability (see below) in the system. For example, an attacker places exploit code on a trusted website. A user accesses the site from an insecure client machine which results in the user's browser executing the exploit code. The attacker then runs some attack using the user's machine with user credentials.

5. Firewall
A firewall is a software-based or hardware-based device that can be configured to allow genuine network traffic to go through and stop malicious traffic. For example, a firewall may intercept all network packets sent to an application, such as a browser. If the traffic originates from a known dangerous source, it may drop all the packets preventing harm to the client machine.

6. Identity
It is the set of data that is unique to a person. The digital identity of a person is the identity that is used on-line. For example, the identity of an employee may comprise of attributes such as Employee number, Date of joining, First name and Last name. The employee is then required to use this identity within the organization throughout their stay.

7. Penetration test
It is a test to check the security of a network while pretending to be an external attacker. It is also called a pentest. The goal of a pentest is to gain access and some level of control over a device within the network. Valuable information is discovered by a pentest e.g. vulnerabilities present in the network and the effectiveness of automatic network scanning software.

8. Physical security
It is the presence of physical barriers to information resources of an organization. Examples include gated access manned by security guards, access card swipes required to enter the premises and logged access to restricted areas within the premises.

9. Threat
It is a danger to the information resources of an organization. It can be intentional e.g. an external attacker or accidental e.g. an earthquake. There are usually numerous threats to the information resources e.g. natural catastrophes, power outages, hardware/ software failures and malicious individuals/ organizations. Information resources of different organizations may face the same threats.

10. Vulnerability
It is a weakness within the information system of an organization. For example, software vulnerability arising from insufficient testing, hardware vulnerability arising from its insecure storage and physical site vulnerability arising from its location within a natural disaster prone area.

If you are interested to know about many more computer security terms, you can visit the SANS glossary of terms here.

How to do real database testing (10 tips to perform serious database tests)?

Many (but not all) applications under test use one or more databases. The purposes of using a database include long-term storage of data in an accessible and organized form. Many people have only a vague idea about database testing. If you are serious about learning database testing, view the videos, Database Testing and SQL Tutorial for Beginners. Then read on...

Firstly, we need to understand what is database testing? As you would know, a database has two main parts - the data structures (the schema) that store the data AND the data itself. Let us discuss them one by one.

Database testing

The data is stored in the database in tables. However, tables may not be the only objects in the database. A database may have other objects like views, stored procedures and functions. These other objects help the users access the data in required forms. The data itself is stored in the tables. Database testing involves finding out the answers to the following questions:

Questions related to database structure
1. Is the data organized well logically?
2. Does the database perform well?
3. Do the database objects like views, triggers, stored procedures, functions and jobs work correctly?
4. Does the database implement constraints to allow only correct data to be stored in it?
5. Is the data secure from unauthorized access?

Questions related to data
1. Is the data complete?
2. Is all data factually correct i.e. in sync with its source, for example the data entered by a user via the application UI?
3. Is there any unnecessary data present?

Now that we understand database testing, it is important to know about the 5 common challenges seen before or during database testing:

1. Large scope of testing
It is important to identify the test items in database testing. Otherwise, you may not have a clear understanding of what you would test and what you would not test. You could run out of time much before finishing the database test.
Once you have the list of test items, you should estimate the effort required to design the tests and execute the tests for each test item. Depending on their design and data size, some database tests may take a long time to execute. Look at the test estimates in light of the available time. If you do not have enough time, you should select only the important test items for your database test.

2. Incorrect/ scaled-down test databases
You may be given a copy of the development database to test. This database may only have little data (the data required to run the application and some sample data to show in the application UI). Testing the development or test or staging databases may not be sufficient. You should also be testing a copy of the production database.

3. Changes in database schema and data
This is a particularly nasty challenge. You may find that after you design a test (or even after you execute a test), the database structure (the schema) has been changed. This means that you should be aware of the changes made to the database during testing. Once the database structure changes, you should analyze the impact of the changes and modify any impacted tests.
Further, if your test database is being used by other users, you would not be sure about your test results. Therefore, you should ensure that the test database is used for testing purpose only.
You may also see this problem if you run multiple tests at the same time. You should run one test at a time at least for the performance tests. You do not want your database performing multiple tasks and under-reporting performance.

4. Messy testing
Database testing may get complex. You do not want to be executing tests partially or repeating tests unnecessarily. You should create a test plan and proceed accordingly while carefully noting your progress.

5. Lack of skills
The lack of the required skills may really slow things down. In order to perform database testing effectively, you should be comfortable with SQL queries and the required database management tools.

Next, let us discuss the approach for database testing. You should keep the scope of your test as well as the challenges in mind while designing your particular test design and test execution approach. Note the following 10 tips:

1. List all database-specific requirements. You should gather the requirements from all sources, particularly technical requirements. It is quite possible that some requirements are at a high level. Break-down those requirements into the small testable requirements.

2. Create test scenarios for each requirement as suggested below.

3. In order to check the logical database design, ensure that each entity in the application e.g. actors, system configuration are represented in the database. An application entity may be represented in one or tables in the database. The database should contain only those tables that are required to represent the application entities and no more.

4. In order to check the database performance, you may focus on its throughput and response times. For example, if the database is supposed to insert 1000 customer records per minute, you may design a query that inserts 1000 customer records and print/ store the time taken to do so. If the database is supposed to execute a stored procedure in under 5 seconds, you may design a query to execute the stored procedure with sample test data multiple times and note each time.

5. If you wish to test the database objects e.g. stored procedures, you should remember that a stored procedure may be thought of as a simple program that (optionally) accepts certain input(s) and produces some output. You should design test data to exercise the stored procedure in interesting ways and predict the output of the stored procedure for every test data set.

6. In order to check database constraints, you should design invalid test data sets and then try to insert/ update them in the database. An example of an invalid data set is an order for a customer that does not exist. Another example is a customer test data set with an invalid ZIP code.

7. In order to check the database security, you should design tests that mimic unauthorized access. For example, log in to the database as a user with restricted access and check if you can view/ modify/ delete restricted database objects or view or view and update restricted data. It is important to backup your database before executing any database security tests. Otherwise, you may render your database unusable.
You should also check to see that any confidential data in the database e.g. credit card numbers is either encrypted or obfuscated (masked).

8. In order to test data integrity, you should design valid test data sets for each application entity. Insert/ update a valid test data set (for example, a customer) and check that the data has been stored in the correct table(s) in correct columns. Each data in the test data set should have been inserted/ updated in the database. Further, the test data set should be inserted only once and there should not be any other change in the other data.

9. Since your test design would require creating SQL queries, try to keep your queries as simple as possible to prevent defects in them. It is a good idea for someone other than the author to review the queries. You should also dynamically test each query. One way to test your query is to modify it so that it just shows the resultset and does not perform the actual operation e.g. insert, delete. Another way to test your query is to run it for a couple of iteration s and verify the results.

10. If you are going to have a large number of tests, you should pay special attention to organizing them. You should also consider at least partial automation of frequently run tests.

Now you should know what database testing is all about, the problems that you are likely to face while doing database testing and how to design a good database test approach for the scope decided by you.

See also:

What is Database

Database Migration Testing

Sample database test plan

Database testing example

Another database testing example

SQL test

SQL injection

Software Testing Books

Occasionally, people ask me about some good books on Software Testing. I refer them to this list. They say that though these books build up a subject from the beginning, everyone could learn something from them.

Welcome

A very warm welcome to this blog!In order to get things going, please note that in the month of January 2009, I wrote an article about security testing. This article focuses on the SQL injection technique. Please provide your inputs for this article.