← Fannie Mae Interview Insights
Start by clarifying the goal of each test layer: UI tests validate user-facing behavior and integration, while backend tests validate business logic and data integrity. Then map the test pyramid to the SPA-BFF-payment API architecture, specifying what to mock at each level (e.g., mock payment API in BFF tests, mock BFF in UI tests). Emphasize risk-based testing and the trade-offs between speed, cost, and confidence.
Pro tip: Highlight that payment flows are high-risk, so you should have a few end-to-end tests that hit a sandbox payment API, but keep them minimal to avoid flakiness and cost. Also, mention contract testing (e.g., Pact) to ensure the BFF and payment API stay in sync without full integration tests.
Clarify that UI tests verify user interactions and rendering, while backend tests verify business rules, data transformations, and API contracts. This prevents overlap and ensures each layer tests what it's best at.
Identify the components: SPA (UI), BFF (backend-for-frontend), and payment API. Allocate tests: many unit tests for BFF logic, some integration tests for BFF-payment API, and few UI tests for critical user journeys.
In UI tests, mock the BFF to isolate UI behavior; in BFF unit tests, mock the payment API client; in BFF integration tests, use a sandbox or mock server for the payment API. Avoid mocking the BFF in integration tests unless testing error handling.
Focus more tests on high-risk areas like payment processing, authentication, and error handling. Use fewer end-to-end tests for critical paths (e.g., successful payment) and rely on lower-level tests for edge cases.
Discuss how mocking reduces flakiness and speed but can miss integration issues. Recommend contract testing to validate BFF-payment API interactions without full E2E. Balance test coverage with maintenance cost.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Talked about deterministic time injection and intercepting network calls at the boundary.
Start by acknowledging that flaky tests stem from non-determinism, then describe a layered strategy: isolate and control external dependencies (e.g., mock network calls, use deterministic clocks), and apply robust synchronization patterns for async code. For regression detection, explain how you select and combine test oracles, golden images, and contract tests based on data and model characteristics, emphasizing trade-offs in maintenance and false positives.
Pro tip: Frame flakiness as a signal of hidden system fragility, not just a test problem—show how you use flaky test metrics to drive architectural improvements and set realistic SLAs for test reliability.
Break down flakiness into network, timing, and async causes, and instrument tests to capture failure patterns (e.g., retries, timeouts, race conditions).
Use mocking, stubbing, and dependency injection for network calls; employ fake clocks and deterministic scheduling for timing; and apply proper async patterns like polling with backoff or event-driven waits.
Select oracles based on data type and model output: exact assertions for deterministic outputs, tolerance-based checks for numerical results, and statistical tests for stochastic models.
Use golden images for visual or high-dimensional outputs with versioning and diff thresholds; use contract tests to validate interfaces between services and data pipelines, ensuring backward compatibility.
Track flaky test rates and regression detection metrics, and adjust strategies to balance test reliability, maintenance cost, and coverage—especially in regulated environments like Fannie Mae.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Honestly placed XSS checks in component tests and CSRF at integration level and they pushed back a little.
Start by mapping security checks to the test pyramid: unit tests for input validation and authorization logic, integration tests for CSRF tokens and XSS sanitization across components, and end-to-end tests for full attack scenarios. Then explain idempotency enforcement through idempotency keys, deduplication, and transactional guarantees, emphasizing retry-safe design.
Pro tip: In regulated environments like Fannie Mae, tie security and idempotency to compliance and auditability—show you understand that these aren't just technical concerns but risk management requirements.
Place input validation and authorization logic in unit tests, CSRF/XSS protections in integration tests, and full attack simulations in end-to-end tests. This ensures fast feedback and comprehensive coverage.
Identify operations that must be idempotent (e.g., payments, data updates) and specify expected behavior under retries, including duplicate detection and state consistency.
Use idempotency keys, request deduplication, and transactional outbox patterns to ensure repeated requests don't cause unintended side effects.
Write tests that simulate network failures, timeouts, and duplicate requests to verify idempotency guarantees and error handling.
Log idempotency key usage and security events, and set up alerts for anomalies to maintain compliance and detect issues early.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Short answer from me: requirements traceability matrix, risk-weighted test prioritization, and equivalence partitioning for data.
Start by acknowledging that line/branch coverage is necessary but insufficient, then structure your answer around three dimensions: requirements, risk, and data. For each, describe specific metrics and techniques you've used, and tie them to business impact—especially in a regulated domain like mortgage finance where model risk management and data integrity are critical.
Pro tip: Emphasize that coverage should be tied to business risk and model validation standards (e.g., SR 11-7), not just code. Mention that you prioritize coverage where errors would have the highest financial or compliance impact.
Map each requirement to test cases using a traceability matrix, and measure the percentage of requirements with at least one test. Include edge cases and negative scenarios derived from business rules.
Identify high-risk areas (e.g., data quality, model assumptions, regulatory compliance) and assign risk scores. Measure the proportion of high-risk scenarios covered by tests, and track residual risk.
Assess coverage across data dimensions: schema, value distributions, missingness, outliers, and time periods. Use techniques like data profiling and partition testing to ensure representative data is used.
Aggregate these coverage metrics into a dashboard that shows overall coverage health and highlights gaps. Use thresholds to trigger reviews or additional testing.
Use the coverage insights to prioritize testing efforts based on risk and business impact. Continuously refine coverage criteria as the model and data evolve.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
This was the bulk of the interview and where I felt most exposed.
Start by clarifying the scope and assumptions, then structure your answer around the seven required categories, ensuring each includes specific test cases. Emphasize how you would prioritize tests based on risk and business impact, and tie your approach to data science principles like experimentation and metrics validation.
Pro tip: Frame your test matrix around user journeys and failure modes, and explicitly mention how you would measure the success of the promo code feature using A/B testing and analytics. This shows you think beyond QA and understand the data science implications.
Ask clarifying questions about the promo code rules, BFF behavior, analytics event schema, and target platforms. State your assumptions to ensure alignment before diving into test design.
Outline the seven categories (functional, boundary, accessibility, cross-compatibility, resilience, contract, analytics) and briefly explain what each entails for this feature.
For each category, list concrete test scenarios, covering positive/negative paths, edge cases, and failure modes. Include data validation, UI behavior, and integration points.
Group tests by priority (e.g., critical, high, medium) based on risk and business impact. Suggest a format (e.g., table) for the matrix and mention automation opportunities.
Explain how you would validate the analytics event and use A/B testing to measure the promo code's impact on conversion and order value. Mention metrics, sample size, and statistical significance.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Talked about stubbing the BFF at the component level for 429 and 5xx, and using service workers or network interception for offline.
Start by outlining a layered testing strategy that covers unit, integration, and end-to-end tests for each failure mode, then explain how you simulate these conditions using tools like network throttling, mock servers, and fault injection. Emphasize that the UI should handle errors gracefully and eventually reconcile with server truth through retries, idempotency, and state synchronization mechanisms.
Pro tip: Demonstrate maturity by discussing how you prioritize failure scenarios based on business impact and how you balance resilience with user experience—for example, showing a cached promo code with a clear 'last updated' timestamp rather than blocking the UI.
Enumerate each scenario (offline, timeout, 429, 5xx) and specify how the system should behave: e.g., offline should use cached data with an indicator, timeouts should trigger retries with backoff, 429 should respect Retry-After, and 5xx should fall back to stale data or show an error.
Use tools like Charles Proxy, Toxiproxy, or custom mock servers to inject latency, drop connections, return 429/5xx, and simulate offline mode. For unit tests, mock API clients to throw specific errors.
Write integration and E2E tests (e.g., with Cypress or Playwright) that assert the UI shows appropriate messages, disables actions, and retries automatically. Verify that stale state is eventually replaced when the server recovers.
Ensure the client periodically polls or uses push updates to fetch server truth. Use versioning or timestamps to detect stale data and resolve conflicts, and make promo code application idempotent to avoid double-application.
Set up logging and alerts for these failure modes, track metrics like retry counts and stale data age, and use feature flags to roll out resilience improvements gradually.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.