Performance, security and other non-functional testing

Functional testing asks what the system does. Non-functional testing asks how well it does it: how fast, how secure, how easy to use, on which devices and for how long. You do not need to be a specialist to answer these interview questions, but you need the vocabulary, the meaning of a percentile, and a few checks you can run yourself. Interviewers ask them because slow pages and data leaks hurt a business as much as wrong results.

The quality characteristics

The ISTQB syllabus takes its list from the ISO/IEC 25010 quality model: performance efficiency, compatibility, usability, reliability, security, maintainability, portability and safety. Most interview questions are about performance and security, with some on usability, accessibility and compatibility.

Four kinds of performance test

The kinds differ in the shape of the load over time. "Load" here means the number of virtual users (pretend users that a tool creates), or requests per second, that a tool sends. A request is one call from a browser or app to the server.

• A load test runs the expected and peak traffic and checks that the targets are met.
• A stress test goes past the expected limit to find where the system breaks, how it fails, and whether it recovers.
• A spike test jumps suddenly, like a sale that opens at noon.
• A soak test, also called an endurance test, holds normal load for many hours to find slow problems such as a memory leak (memory that a program takes and never gives back, so its use keeps growing until it slows down or crashes).

Reading the results

Response times are reported as percentiles. "p95 is 800 ms" (ms means milliseconds, thousandths of a second) means 95% of requests took 800 ms or less and the slowest 5% took longer. p50 is the median, the middle value: half the requests were faster. Averages hide slow requests: an API can average 300 ms while its p99 is 4 seconds, so about one request in a hundred is very slow. That is why targets look like "p95 under 1 second at 300 requests per second, with under 1% errors". Also watch throughput (requests per second), the error rate, and server resources such as CPU (processor), memory and database time. In a soak test, memory that keeps climbing under steady load is the warning sign.

A basic JMeter test

Apache JMeter is a common open-source load tool. A test plan has a thread group (the number of virtual users, the ramp-up time, which is how long JMeter takes to start all of them, and the loop count or duration), samplers such as HTTP requests, a CSV data set for varied data, assertions that check responses, timers for think time (the pause a real user takes between actions), and listeners such as the Aggregate Report, which shows the 90%, 95% and 99% lines. Run real load from the command line, not the GUI:

jmeter -n -t checkout.jmx -l results.jtl -e -o report

This runs the plan without the GUI, saves the results and builds an HTML dashboard. Ramp-up matters: with a ramp-up of 0, all users start at once and you get a spike you did not plan.

Security checks every tester can run

Penetration testing is a specialist job, but testers catch many common problems. The OWASP Top 10 is a widely used list of the most serious web application risks. In its 2025 edition, broken access control (users can do or see things they should not) is first. Injection is still on the list: this is when input typed into a field is run as code, as in SQL injection (input that changes a database query) and cross-site scripting (input that runs as a script in other users' browsers).

• Access control: change an order ID in the URL or API to another user's, and call admin endpoints (web addresses meant only for administrators) as a normal user. The server must refuse.
• Login and sessions (a session is the period when you stay logged in): lockout or delay after failed logins, logout really ending the session, idle timeout (automatic logout after no activity).
• Injection: SQL-like input and script tags in text fields are treated as plain text.
• Sensitive data: HTTPS (the secure, encrypted form of web traffic) everywhere, and no passwords, tokens or card numbers in URLs, logs or error messages.

Use only test accounts and data, and report security findings privately.

Usability, accessibility and compatibility

Usability testing checks how easy the product is to learn and use, ideally by watching real users. Accessibility checks use by people with disabilities: keyboard-only navigation, screen reader labels, colour contrast. Compatibility checks the product across browsers, devices and operating systems; choose the list from real usage data.

How to answer in an interview

Define the test in one sentence, say what it finds, and name one metric or tool. If asked to plan a load test, give the steps: numbers from past traffic, agreed targets, realistic user flows and data, a production-like environment, staged runs, monitoring, and a report against the targets.

Common mistakes

• Mixing up load and stress testing.
• Judging performance by the average alone.
• Running heavy load from the JMeter GUI.
• Thinking a hidden button means the action is secure.

Recap

Load, stress, spike and soak tests differ in the shape of the load. Read percentiles, not averages. Every tester can check access control, sessions, injection and sensitive data.