Software Testing Guide

What is the difference between Conventional Testing and Unconventional Testing?

noreply@blogger.com (Jerry Ruban) — Sat, 24 Dec 2011 11:00:00 +0000

Conventional Testing is done by Test Engineers to check whether the developed application is working fine as per the requirements.

Unconventional Testing is done by Quality Assurance team with the reference of each and every documents starting from initial stage of SDLC. This process involves verification through walkthrough and inspections to check whether the development happened as per the company process guidelines or not.

Explain Agile Testing.

noreply@blogger.com (Jerry Ruban) — Mon, 11 Jul 2011 12:14:00 +0000

Agile Testing is a testing practice done from the customer perspective, it doesn’t follow test procedures and the delivery would happen as early as possible.

Agile testing is useful whenever the customer requirements are changing frequently.

Define CVS.

noreply@blogger.com (Jerry Ruban) — Mon, 30 May 2011 10:11:00 +0000

CVS is Concurrent Versioning System which is a version control system, where the history of sources files can be recorded.

The main advantages of CVS are,

• You can save each file of every version.

• After modifications in source, if u detect a bug, you can easily retrieve the old version to check which change caused that bug.

• CVS can be used to merge the work done by all the developers.

Explain the different types of Severity.

noreply@blogger.com (Jerry Ruban) — Fri, 24 Sep 2010 11:11:00 +0000

User Interface Defects – Low
Boundary Related Defects – Medium
Error Handling Defects – Medium
Calculation Defects – High
Interpreting Data Defects – High
Hardware Failures & Problems - High
Compatibility and Intersystem defects- High
Control flow defects – High
Load Conditions (Memory Leakages under load testing) – High

What is Bucket Testing?

noreply@blogger.com (Jerry Ruban) — Tue, 13 Jul 2010 05:02:00 +0000

Bucket Testing (also known as A/B Testing) is mostly used to study the impact of various product designs in website metrics, two simultaneous versions were run in a single or set of web pages to measure the difference in click rates, interface and traffic.

What is Entry and Exit Criteria in Software Testing?

noreply@blogger.com (Jerry Ruban) — Wed, 30 Jun 2010 07:13:00 +0000

The Entry Criteria is the process that must be present when a system begins, like,
SRS – Software
FRS
Usecase
Test Case
Test Plan

The Exit Criteria ensures whether testing is completed and the application is ready for release, like,
Test Summary Report
Metrics
Defect Analysis Report.

What is Concurrency Testing?

noreply@blogger.com (Jerry Ruban) — Fri, 11 Jun 2010 12:16:00 +0000

Concurrency Testing (also commonly known as Multi User Testing) is used to know the effects of accessing the Application, Code Module or Database by different users at the same time.

It helps in identifying and measuring the problems in Response time, levels of locking and deadlocking in the application.

Ex.
Load runner is widely used for this type of testing, Vugen (Virtual User Generator) is used to add the number of concurrent users and how the users need to be added like Gradual Rampup or Spike Stepped.

What is the difference between Functional Requirement and Non – Functional Requirement?

noreply@blogger.com (Jerry Ruban) — Fri, 16 Apr 2010 12:32:00 +0000

The Functional Requirement specifies how the system or application SHOULD DO where in Non – Functional Requirement it specifies how the system or application SHOULD BE.

Some Functional Requirements are,
Authentication
Business Rules
Historical Data
Legal and Regulatory Requirements
External Interfaces

Some Non Functional Requirements are,
Performance
Reliability
Security
Recovery
Data Integrity
Usability

Explain Statement Coverage / Code Coverage / Line Coverage.

noreply@blogger.com (Jerry Ruban) — Wed, 27 Jan 2010 12:22:00 +0000

Statement Coverage or Code Coverage or Line Coverage is a metric used in White Box Testing where we can identify the statements executed and where the code is not executed cause of blockage. In this process each and every line of the code needs to be checked and executed.

Some advantages of Statement Coverage / Code Coverage / Line Coverage are,
· It verifies what the written code is expected to do and not to do.
· It measures the quality of code written.
· It checks the flow of different paths in the program also ensure whether those paths are tested or not.

To Calculate Statement Coverage,
Statement Coverage = Statements Tested / Total No. of Statements.

Explain Branch Coverage / Decision Coverage.

noreply@blogger.com (Jerry Ruban) — Tue, 29 Dec 2009 09:55:00 +0000

Branch Coverage or Decision Coverage metric is used to check the volume of testing done in all components. This process is used to ensure whether all the code is executed by verifying every branch or decision outcome (if and while statements) by executing atleast one time, so that no branches lead to the failure of the application.

To Calculate Branch Coverage,

Branch Coverage = Tested Decision Outcomes / Total Decision Outcomes.

What is the difference between High level and Low level test cases?

noreply@blogger.com (Jerry Ruban) — Wed, 25 Nov 2009 09:17:00 +0000

High level Test cases are those which covers major functionality in the application (i.e. retrieve, update display, cancel (functionality related test cases), database test cases).

Low level test cases are those related to User Interface (UI) in the application.

Explain Localization Testing with examples.

noreply@blogger.com (Jerry Ruban) — Mon, 26 Oct 2009 09:37:00 +0000

Localization is the process of changing or modifying an application to a particular culture or locale. This includes change in user interface, graphical designs or even the initial settings according to their culture and requirements.

In terms of Localization Testing it verifies how correctly the application is changed or modified into that target culture and language.

In case of translation required of the application on that local language, testing should be done on each field to check the correct translation. Other formats like date conversion, hardware and software usage like operating system should also be considered in localization testing.

Examples for Localization Testing are,
· In Islamic Banking all the transactions and product features are based on Shariah Law, some important points to be noted in Islamic Banking are,
1.In Islamic Banking, the bank shares the profit and loss with the customer.
2.In Islamic Banking, the bank cannot charge interest on the customer; instead they charge a nominal fee which is termed as “Profit”.
3.In Islamic Banking, the bank will not deal or invest in business like Gambling, Alcohol, Pork, etc.
In this case, we need to test whether these Islamic banking conditions were modified and applied in the application or product.

· In Islamic Lending, they follow both the Gregorian Calendar and Hijiri Calendar for calculating the loan repayment schedule. The Hijiri Calendar is commonly called as Islamic Calendar followed in all the Muslim countries according to the lunar cycle. The Hijiri Calendar has 12 months and 354 days which is 11 days shorter than Gregorian Calendar. In this case, we need to test the repayment schedule by comparing both the Gregorian Calendar and Hijiri Calendar.

Explain Risk Analysis in Software Testing.

noreply@blogger.com (Jerry Ruban) — Fri, 25 Sep 2009 07:27:00 +0000

In Software Testing, Risk Analysis is the process of identifying risks in applications and prioritizing them to test.

In Software Testing some unavoidable risk might takes place like,
· Change in requirements or Incomplete requirements.
· Time allocation for testing.
· Developers delaying to deliver the build for testing.
· Urgency from client for delivery.
· Defect Leakage due to application size or complexity.

To overcome these risks, the following activities can be done,
· Conducting Risk Assessment review meeting with the development team.
· Profile for Risk coverage is created by mentioning the importance of each area.
· Using maximum resources to work on High Risk areas like allocating more testers for High risk areas and minimum resources for Medium and Low risk areas.Creation of Risk assessment database for future maintenance and management review.

What is the difference between Two Tier Architecture and Three Tier Architecture?

noreply@blogger.com (Jerry Ruban) — Fri, 11 Sep 2009 01:28:00 +0000

In Two Tier Architecture or Client/Server Architecture two layers like Client and Server is involved. The Client sends request to Server and the Server responds to the request by fetching the data from it. The problem with the Two Tier Architecture is the server cannot respond to multiple requests at the same time which causes data integrity issues.

The Client/Server Testing involves testing the Two Tier Architecture of user interface in the front end and database as backend with dependencies on Client, Hardware and Servers.

In Three Tier Architecture or Multi Tier Architecture three layers like Client, Server and Database are involved. In this the Client sends a request to Server, where the Server sends the request to Database for data, based on that request the Database sends back the data to Server and from Server the data is forwarded to Client.

The Web Application Testing involves testing the Three Tier Architecture including the User interface, Functionality, Performance, Compatibility, Security and Database testing.

What is the difference between Static Testing and Dynamic Testing?

noreply@blogger.com (Jerry Ruban) — Thu, 02 Jul 2009 08:51:00 +0000

Static Testing

Static Testing is a White Box testing technique where the developers verify or test their code with the help of checklist to find errors in it, this type of testing is done without running the actually developed application or program. Code Reviews, Inspections, Walkthroughs are mostly done in this stage of testing.

Dynamic Testing

Dynamic Testing is done by executing the actual application with valid inputs to check the expected output. Examples of Dynamic Testing methodologies are Unit Testing, Integration Testing, System Testing and Acceptance Testing.

Some differences between Static Testing and Dynamic Testing are,
· Static Testing is more cost effective than Dynamic Testing because Static Testing is done in the initial stage.
· In terms of Statement Coverage, the Static Testing covers more areas than Dynamic Testing in shorter time.
· Static Testing is done before the code deployment where the Dynamic Testing is done after the code deployment.
· Static Testing is done in the Verification stage where the Dynamic Testing is done in the Validation stage.

Explain Use case diagrams. What are the attributes of use cases?

noreply@blogger.com (Jerry Ruban) — Mon, 01 Jun 2009 10:31:00 +0000

Use Case Diagrams is an overview graphical representation of the functionality in a system. It is used in the analysis phase of a project to specify the system to be developed.
In Use Case Diagrams the whole system is defined as ACTORS, USE CASES and ASSOCIATIONS, the ACTORS are the external part of the system like users, computer software & hardware, USECASES is the behavior or functionality of the system when these ACTORS perform an action, the ASSOCIATIONS are the line drawn to show the connection between ACTORS and USECASES. One ACTOR can link to many USECASES and one USECASE can link to many ACTORS.

What is Web Application Testing? Explain the different phases in Web Application Testing.

noreply@blogger.com (Jerry Ruban) — Thu, 16 Apr 2009 01:48:00 +0000

Web Application Testing is done on a website to check its load, performance, Security, Functionality, Interface, compatibility and other usability related issues.

In Web application testing, three phases of testing is done, they are,

Web Tier Testing
In Web tier testing, the browser compatibility of the application will be tested for IE, FireFox and other web browsers.

Middle Tier Testing
In Middle tier testing, the functionality and security issues were tested.

Database Tier Testing
In Database tier testing, the database integrity and the contents of the database were tested and verified.

What is the difference between Priority and Severity?

noreply@blogger.com (Jerry Ruban) — Tue, 03 Mar 2009 15:17:00 +0000

The terms Priority and Severity are used in Bug Tracking to share the importance of a bug among the team and to fix it.

Severity
1. The Severity status is used to explain how badly the deviation is affecting the build.
2. The severity type is defined by the tester based on the written test cases and functionality.

Ex : If an application or a web page crashes when a remote link is clicked, in this case clicking the remote link by an user is rare but the impact of application crashing is severe, so the severity is high and priority is low.

Priority
1. The Priority status is set by the tester to the developer mentioning the time frame to fix a defect. If High priority is mentioned then the developer has to fix it at the earliest.
2. The priority status is set based on the customer requirements.

Ex : If the company name is misspelled in the home page of a website, then the priority is high and the severity is low to fix it.

Explain Unit Testing, Interface Testing and Integration Testing. Also explain the types of Integration Testing in brief.

noreply@blogger.com (Jerry Ruban) — Sun, 22 Feb 2009 15:11:00 +0000

Unit Testing

Unit Testing is done to check whether the individual modules of the source code is working properly. i.e Testing each and every unit of the application separately by the developer in developers environment.

Interface Testing

Interface Testing is done to check whether the individual modules are communicating properly one among other as per the specifications.

Interface Testing is mostly used in testing the user interface of GUI applications.

Integration Testing

Integration Testing is done to check the connectivity by combining all the individual modules together and test the functionality.

The types of Integration Testing are,

1) Big Bang Integration Testing

In Big Bang Integration Testing, the individual modules are not integrated until all the modules are ready. Then they will run to check whether it is performing well.

In this type of testing, some disadvantages might occur like,

Defects can be found at the later stage.

It would be difficult to find out whether the defect arouse in Interface or in module.

2) Top Down Integration Testing

In Top Down Integration Testing, the high level modules are integrated and tested first. i.e Testing from main module to sub module. In this type of testing, Stubs are used as temporary module if a module is not ready for integration testing.

3) Bottom Up Integration Testing

In Bottom Up Integration Testing, the low level modules are integrated and tested first i.e Testing from sub module to main module. Same like Stubs, here drivers are used as a temporary module for integration testing.

Explain Alpha, Beta, Gamma Testing.

noreply@blogger.com (Jerry Ruban) — Sat, 07 Feb 2009 06:51:00 +0000

Alpha Testing
Alpha Testing is mostly like performing usability testing which is done by the in-house developers who developed the software or testers. Sometimes this Alpha Testing is done by the client or an outsider with the presence of developer and tester. The version release after alpha testing is called Alpha Release.

Beta Testing
Beta Testing is done by limited number of end users before delivery, the change request would be fixed if the user gives feedback or reports defect. The version release after beta testing is called beta Release.

Gamma Testing
Gamma Testing is done when the software is ready for release with specified requirements, this testing is done directly by skipping all the in-house testing activities.

Explain the methods and techniques used for Security Testing.

noreply@blogger.com (Jerry Ruban) — Sun, 18 Jan 2009 10:59:00 +0000

Security testing can be performed in many ways like,
· Black Box Level
· White Box Level
· Database Level

Black Box Level

· Session Hijacking
Session Hijacking commonly called as “IP Spoofing” where a user session will be attacked on a protected network.

· Session Prediction
Session Prediction is a method of obtaining data or a session ID of an authorized user and gets access to the application. In a web application the session ID can be retrieved from cookies or URL.
The Session Prediction happening can be predicted when a website is not responding normally or stops responding for an unknown reason.

· Email Spoofing
Email Spoofing is duplicating the email header (“From” address) to look like originated from actual source and if the email is replied it will land in the spammers inbox. By inserting commands in the header the message information can be altered. It is possible to send a spoofed email with information you didn’t write.

· Content Spoofing
Content spoofing is a technique to develop a fake website and make the user believe that the information and website is genuine. When the user enters his Credit Card Number, Password, SSN and other important details the hacker can get the data and use if for fraud purposes.

· Phishing
Phishing is similar to Email Spoofing where the hacker sends a genuine look like mail attempting to get the personal and financial information of the user. The emails will appear to have come from well known websites.

· Password Cracking
Password Cracking is used to identify an unknown password or to identify a forgotten password
Password cracking can be done through two ways,
1. Brute Force – The hacker tries with a combination of characters within a length and tries until it is getting accepted.
2. Password Dictionary – The hacker uses the Password dictionary where it is available on various topics.

White Box Level

· Malicious Code Injection
SQL Injection is most popular in Code Injection Attack, the hacker attach the malicious code into the good code by inserting the field in the application. The motive behind the injection is to steal the secured information which was intended to be used by a set of users.
Apart from SQL Injection, the other types of Malicious code injection are XPath Injection, LDAP Injection, and Command Execution Injection. Similar to SQL Injection the XPath Injection deals with XML document.

· Penetration Testing
Penetration Testing is used to check the security of a computer or a network. The test process explores all the security aspects of the system and tries to penetrate the system.

· Input Validation
Input validation is used to defend the applications from hackers. If the input is not validated mostly in web applications it could lead to system crashes, database manipulation and corruption.

· Variable Manipulation
Variable manipulation is used as a method for specifying or editing the variables in a program. It is mostly used to alter the data sent to web server.

Database Level

· SQL Injection
SQL Injection is used to hack the websites by changing the backend SQL statements, using this technique the hacker can steal the data from database and also delete and modify it.

Explain IEEE 829 standard and other software testing standards.

noreply@blogger.com (Jerry Ruban) — Mon, 22 Dec 2008 02:02:00 +0000

IEEE 829 Standard is used for Software Test Documentation, where it specifies format for the set of documents to be used in the different stages software testing.

The documents are,

Test Plan – Test Plan is a planning document which has information about the scope, resources, duration, test coverage and other details.

Test Design – Test Design document has information of test pass criteria with test conditions and expected results.

Test Case – Test case document has information about the test data to be used.

Test Procedure – Test Procedure has information about the test steps to be followed and how to execute it.

Test Log – Test log has details about the run test cases, test plans & fail status, order, and the resource information who tested it.

Test Incident Report – Test Incident Report has information about the failed test comparing the actual result with expected result.

Test Summary Report – Test Summary Report has information about the testing done and quality of the software, it also analyses whether the software has met the requirements given by customer.

The other standards related to software testing are,

IEEE 1008 is for Unit Testing

IEEE 1012 is for Software verification and validation

IEEE 1028 is for Software Inspections

IEEE 1061 is for Software metrics and methodology

IEEE 1233 is for guiding the SRS development

IEEE 12207 is for SLC process

What is Test Harness?

noreply@blogger.com (Jerry Ruban) — Wed, 17 Dec 2008 01:50:00 +0000

Test Harness is configuring a set of tools and test data to test an application in various conditions, which involves monitoring the output with expected output for correctness.

The benefits of Test Harness are,
Productivity increase due to process automation.
Quality in the application.

What is SEI? CMM? CMMI? ISO? IEEE? ANSI?

noreply@blogger.com (Jerry Ruban) — Sun, 23 Nov 2008 03:10:00 +0000

SEI refers to Software Engineering Institute of Carnegie Mellon University in Pittsburgh, it helps to improve software development process. SEI offers technical guidance for advanced practice in software engineering.

CMM refers to 'Capability Maturity Model', presently called as CMMI 'Capability Maturity Model Integration’; it was developed by SEI and used to understand the processes followed in as organization. CMMI ratings were given to organizations after review by auditors.

CMMI has five levels of process maturity for quality software delivery, they are,

Level 1 – In this level only few processes were used and to rely on individual efforts for successful completion of projects.

Level 2 – In this level there will be realistic planning like project tracking, requirements analysis, configuration management.

Level 3 – In this level a proper software development and maintenance are incorporated throughout the organization. Training programs are exercised for better understanding of the process.

Level 4 – In this level various metrics are used to follow the process and products. The delivery quality is high.

Level 5 – In this level new process and technology were used and implemented efficiently. The objective will be for consistence process development.

ISO refers to 'International Organization for Standardization', the ISO 9001:2000 standard is used for quality systems audited by outside auditors. This standard is applicable for manufacturing companies not only for software. This standard is given based on the documentation, design, production, testing, servicing and other processes.

IEEE refers to 'Institute of Electrical and Electronics Engineers', which has members from many technical professional organizations around the world. IEEE 829 is the standard followed for software test documentation.

ANSI refers to 'American National Standards Institute', which manages the development of standards for products, services, personnel, processes, and systems in U.S. This organization also works with other international standards to make use of American products worldwide.

What is Scalability Testing?

noreply@blogger.com (Jerry Ruban) — Tue, 14 Oct 2008 10:04:00 +0000

Scalability Testing is used to check whether the functionality and performance of a system are capable to meet the volume and size change as per the requirements.

Scalability testing can be done using load test with various software and hardware configurations changed, where the testing environment settings unchanged.