What interviewers expect
What interviewers expect
Interviewers expect file type, size, duplicate, drag-and-drop, cancel, retry, scan pending, rejected malware, storage, signed URL, permissions, metadata, and accessibility coverage.
QA interview guide
How would you test file upload?
File upload questions reveal whether you think about validation, storage, security scanning, network failure, permissions, and user feedback. The risk is not only whether the upload button works.
Write your own answer and compare it with senior QA coverage.
Checklist
Checklist
Use these practical prompts to build a complete answer. Strong interview responses usually include functional behavior, negative cases, security, backend/data risks, UX, accessibility, and reliability.
Functional checks
- Valid PDF, image, CSV, or supported file uploads successfully according to requirements.
- Single file, multiple files, drag-and-drop, browse button, cancel upload, and retry failed upload work.
- Progress, success, preview, download, replace, and delete states behave correctly.
Validation and negative cases
- Unsupported file type, wrong MIME type, wrong extension, empty file, huge file, and max-size boundary are rejected.
- Duplicate file names, long file names, Unicode file names, special characters, and zero-byte files are handled.
- Interrupted network, timeout, backend 500, and partial upload are recoverable.
Security, backend, and data
- Virus scan pending, clean, infected, failed, and timeout states are visible and safe.
- Files are stored in the correct tenant/user scope and cannot be accessed by unauthorized users.
- Signed URLs, metadata, audit logs, storage quota, and cleanup of failed uploads are verified.
UX, accessibility, and performance
- Upload progress, loading, retry, and failure messages are clear.
- Keyboard access, labels, focus states, and screen reader status announcements work.
- Large files and slow networks do not freeze the page or create duplicate uploads.
Complete interview coverage checklist
Aim to mention 20-40 concrete checks. This expanded list helps you turn a short answer into a structured senior-style response.
Valid PDF, image, CSV, or supported file uploads successfully according to requirements.
Single file, multiple files, drag-and-drop, browse button, cancel upload, and retry failed upload work.
Progress, success, preview, download, replace, and delete states behave correctly.
Unsupported file type, wrong MIME type, wrong extension, empty file, huge file, and max-size boundary are rejected.
Duplicate file names, long file names, Unicode file names, special characters, and zero-byte files are handled.
Interrupted network, timeout, backend 500, and partial upload are recoverable.
Virus scan pending, clean, infected, failed, and timeout states are visible and safe.
Files are stored in the correct tenant/user scope and cannot be accessed by unauthorized users.
Signed URLs, metadata, audit logs, storage quota, and cleanup of failed uploads are verified.
Upload progress, loading, retry, and failure messages are clear.
Keyboard access, labels, focus states, and screen reader status announcements work.
Large files and slow networks do not freeze the page or create duplicate uploads.
Structure your answer: Start with supported file upload and expected success state.
Structure your answer: Add validation: type, size, name, duplicate, empty, and boundary cases.
Structure your answer: Add failures: cancel, retry, network interruption, backend error, partial upload.
Structure your answer: Add security and backend: virus scan, storage permissions, signed URLs, quota, cleanup, and audit logs.
Do not miss: MIME type versus extension mismatch.
Do not miss: Virus scan pending and failed scan behavior.
Do not miss: Unauthorized access to uploaded files.
Do not miss: Cleanup of partial or failed uploads.
Ready to practice?
Practice this scenario interactively
Write your own answer and compare it with senior QA coverage.
Answer structure
Strong answer structure
- Start with supported file upload and expected success state.
- Add validation: type, size, name, duplicate, empty, and boundary cases.
- Add failures: cancel, retry, network interruption, backend error, partial upload.
- Add security and backend: virus scan, storage permissions, signed URLs, quota, cleanup, and audit logs.
Common missed areas
Common missed risks
MIME type versus extension mismatch.
Virus scan pending and failed scan behavior.
Unauthorized access to uploaded files.
Cleanup of partial or failed uploads.
Answer template
Use this interview answer template
I would start with a valid file upload, then cover unsupported formats, size limits, file names, duplicate files, drag and drop, cancel and retry, malware scan states, storage permissions, signed URLs, cleanup, UX, accessibility, and performance for large files.
Use it as a structure, then replace the examples with specific checks for the feature you are discussing.
Common weak answer
“I would test valid and invalid cases.”
This is too generic because it does not show risk thinking. A stronger answer names the happy path, negative cases, security risks, backend/data behavior, UX/accessibility, and reliability concerns that matter for this exact scenario.
Examples
Weak answer vs stronger answer
“I would test upload a PDF and invalid file type.”
This is a start, but it misses file size boundaries, network recovery, malware scan states, authorization, storage behavior, metadata, accessibility, and performance.
“I would test valid PDF upload, valid image upload, unsupported file type, MIME mismatch, extension spoofing, 10 MB limit, empty file, huge file, duplicate file name, long and Unicode names, drag and drop, browse upload, cancel upload, retry failed upload, progress state, partial upload, backend error, virus scan pending, infected file rejected, scan failure, storage quota, signed URL access, unauthorized download blocked, tenant isolation, metadata saved, failed upload cleanup, audit log, keyboard navigation, screen reader progress, and slow network performance.”
FAQ
Frequently asked questions
What should I mention first when answering "How would you test file upload?"
Start with supported file upload and expected success state.
Should I include negative and edge cases?
Unsupported file type, wrong MIME type, wrong extension, empty file, huge file, and max-size boundary are rejected. Duplicate file names, long file names, Unicode file names, special characters, and zero-byte files are handled.
Should I include security, API, or backend risks?
Virus scan pending, clean, infected, failed, and timeout states are visible and safe. Files are stored in the correct tenant/user scope and cannot be accessed by unauthorized users.
What are common missed risks?
MIME type versus extension mismatch. Virus scan pending and failed scan behavior. Unauthorized access to uploaded files. Cleanup of partial or failed uploads.
How can I practice this answer?
Use the interactive how would you test file upload? challenge to write your own answer, get checklist-based feedback, and compare your coverage with stronger QA thinking.
What to practice next
Continue with related practice
Move from reading the guide into interactive practice or a closely related interview topic.
Practice
Practice this scenario interactively
Write your own answer and compare it with senior QA coverage.