QA interview guide
Authentication is a security-critical system, not only a login form. A strong interview answer covers credentials, password rules, account states, MFA, tokens, sessions, refresh, logout, authorization, and abuse prevention.
Write your own answer and compare it with senior QA coverage.
What interviewers expect
Interviewers expect valid and invalid login, password validation, lockout and rate limiting, MFA if supported, token and session handling, refresh and expiry, logout, role access, brute force protection, user enumeration, and security headers.
Checklist
Use these practical prompts to build a complete answer. Strong interview responses usually include functional behavior, negative cases, security, backend/data risks, UX, accessibility, and reliability.
Aim to mention 20-40 concrete checks. This expanded list helps you turn a short answer into a structured senior-style response.
Ready to practice?
Write your own answer and compare it with senior QA coverage.
Answer structure
Common missed areas
Answer template
I would start with login success and failure, then cover password rules, lockout, MFA, token and session handling, refresh and expiry, logout, role access, brute-force protection, user enumeration, security headers, backend failures, accessibility, and performance.
Use it as a structure, then replace the examples with specific checks for the feature you are discussing.
Common weak answer
“I would test valid and invalid cases.”
This is too generic because it does not show risk thinking. A stronger answer names the happy path, negative cases, security risks, backend/data behavior, UX/accessibility, and reliability concerns that matter for this exact scenario.
Examples
“I would test login with correct and wrong password.”
That is a useful start, but authentication also needs password rules, account states, token lifecycle, session handling, MFA, abuse protection, secure storage, authorization, and backend reliability.
“I would test valid login, invalid password, unknown email, empty fields, password rules, locked and disabled accounts, MFA challenge, SSO account, remember me, logout, logout all devices, session timeout, access token expiry, refresh token rotation, reused refresh token rejection, revoked token, generic error messages, rate limiting, brute-force protection, lockout, CAPTCHA after suspicious attempts, user enumeration prevention, secure cookies, SameSite and cache-control headers, token not exposed in URLs, logs, analytics, or client storage, CSRF and XSS protection, open redirect blocked, protected API access, role and tenant authorization, password reset session invalidation, backend timeout, identity provider outage, audit logs, metrics, keyboard navigation, screen reader errors, mobile layout, and high-volume login performance.”
FAQ
Start with valid login, invalid login, password rules, and account states.
Yes. Add invalid inputs, empty states, duplicates, expired states, service failures, and recovery paths.
Error messages do not reveal whether the account exists. Rate limiting, brute-force protection, lockout, CAPTCHA, suspicious attempt handling, and IP/email throttling work.
Refresh token rotation and reused token detection. Security headers and cookie settings. Authorization checks after authentication succeeds. User enumeration and token leakage in logs or URLs.
Use the interactive how would you test authentication? challenge to write your own answer, get checklist-based feedback, and compare your coverage with stronger QA thinking.
What to practice next
Move from reading the guide into interactive practice or a closely related interview topic.
Practice
Write your own answer and compare it with senior QA coverage.