GK One-Line Question & Answer

Contract testing verifies that a service provider's API matches the expectations of its consumers — solving the problem of integration tests being too slow and brittle by enabling each team to test against consumer-driven contracts independently, without deploying all services

Stub returns hard-coded responses (controls indirect inputs); Mock verifies expected interactions were made (verifies indirect outputs); Spy wraps a real object recording calls for later verification without replacing behaviour by default

Test pyramid (Fowler/Cohn) recommends many fast unit tests at base, fewer integration tests in middle, fewest UI/E2E tests at top; inverted 'ice cream cone' (mostly E2E tests) causes slow CI (hours per run), brittle tests (UI changes break everything), and poor defect isolation

Property-based testing specifies invariant properties that must hold for all inputs (e.g., 'for any list, sorting it twice gives the same result as sorting it once'), then automatically generates hundreds of random inputs to find counterexamples — example tests verify specific cases

Usability testing observes real users attempting real tasks — it reveals whether users can discover features, understand feedback, recover from errors, and achieve goals efficiently; functional tests verify the system works correctly but cannot detect that users cannot figure out how to use it

Security testing identifies vulnerabilities before attackers; methodologies include: SAST (static analysis of source code), DAST (dynamic testing of running application), IAST (instrumented runtime analysis), and penetration testing (expert-driven exploitation attempts)

Chaos engineering deliberately injects failures (network latency, server crashes, disk exhaustion) into production-like environments to proactively discover system resilience weaknesses — addressing the limitation that traditional tests cannot verify distributed system behaviour under partial failure conditions

A traceability matrix maps requirements to test cases bidirectionally — solving the regulated industry problem of proving to auditors that every requirement has been tested and every test corresponds to a requirement, enabling gap analysis and change impact assessment

Shift-left moves testing activities earlier in the development lifecycle — starting testing at requirements (inspections, test planning) and design (design reviews, testability assessment) rather than after implementation, reducing defect cost by catching them at their cheapest fix point

TiP runs tests/experiments against real production traffic using real user data — safe through: canary releases (1% traffic first), feature flags (instant rollback), dark launches (run new code without returning its results), and monitoring/alerting to detect anomalies before full rollout

Test impact analysis instruments the test suite to record which source files each test exercises, then on each commit selects only tests whose coverage intersects with changed files — running only tests that could possibly be affected by the specific code changes

A flaky test non-deterministically passes or fails for the same code — more damaging than a consistently failing test because it trains developers to ignore CI failures ('it's probably flaky') rather than investigate, eroding the entire team's trust in the CI safety net

TDI applies TDD to infrastructure code: tests for server configuration, network policies, and deployment scripts are written first (using tools like ServerSpec, InSpec, Terraform test) — verifying infrastructure behaves as specified before and after changes, exactly as TDD verifies application code

Core dump analysis examines the saved memory state at the moment of a crash — uniquely diagnosing bugs that only manifest in production under specific data/load conditions and disappear when a debugger is attached (Heisenbugs) or the environment is changed

Debuggability is the ease with which failures can be diagnosed — improved by: centralised structured logging, correlation IDs through all layers, explicit error messages with context, health endpoints, observable internal state, and minimal side effects that make execution traceable

In complex multi-session debugging, accumulated stale breakpoints in wrong files cause debuggers to stop at irrelevant points, wasting time — discipline requires: clearing all breakpoints before each debugging session, naming conditional breakpoints, and using focused logpoints instead of code-modifying prints

A debugger trap (INT 3 on x86, BKPT on ARM) halts execution and transfers control to an attached debugger; in production code without a debugger, it causes a crash — anti-debugging techniques (debugger detection) sometimes use this to detect reverse engineering attempts

Software asset management tracks all software licenses, versions, and usage across an organisation — inadequate tracking creates: license compliance violations (fines), paying for unused licenses, or running unsupported/unpatched software creating security liability

Impact analysis determines which system components, tests, documents, and dependent systems will be affected by a proposed change — requiring: design documentation, traceability matrices, dependency maps, and test coverage data to accurately scope change effects

Software forensics applies investigative techniques to analyse software artefacts — applied in: intellectual property disputes (who wrote this code?), security incident response (how was the system breached?), understanding undocumented legacy systems, and malware analysis

Technical obsolescence occurs when a system's technology stack (OS, language, framework) reaches EOL with no vendor support — responses: 1) wrapping (add API layer, extend lifespan), 2) migration (port to modern platform), 3) replacement (rewrite or buy replacement system)

SCA inventories all third-party open-source dependencies and checks them against vulnerability databases (CVE/NVD) — critical because modern applications are 80%+ open-source code, meaning unpatched dependencies are the primary attack vector (Log4Shell, Spring4Shell)

Non-regression strategy selects tests per commit based on: speed (unit tests always; integration/E2E on schedule or pull requests), risk (change-impact analysis selects tests covering modified code), and flakiness (quarantine unreliable tests to avoid false failures)

SPC monitors testing metrics (defect rate per build, test pass rate) over time on a control chart — revealing whether variation is random (common cause, process is stable) or indicates a special cause (process has changed), enabling data-driven process intervention decisions

Divide and conquer debugging bisects the execution path — placing a checkpoint at the midpoint to determine which half contains the fault, then recursing on the faulty half — reducing search space from O(n) to O(log n) versus sequential line-by-line tracing

A watchpoint triggers when a specific memory address or variable is read or written — invaluable for debugging data corruption bugs where a variable is being modified by an unknown code path that is hard to find by reading code

Too little logging: insufficient context to diagnose production issues, forcing blind fixes; too much logging: performance degradation, storage costs, signal buried in noise, potential logging of sensitive data. Optimal: structured logs with configurable levels (ERROR/WARN/INFO/DEBUG) and correlation IDs

Remote debugging attaches a debugger to a process running on a different machine — introducing challenges: network latency making stepping slow, security risks from debug ports exposure, environment differences between local and remote, and inability to use memory-intensive debugging on production

Printf debugging inserts print statements to observe execution state — its key limitation is that it requires code modification and recompilation for each investigation step and cannot interactively explore state at runtime; debuggers allow inspection without code changes

Snapshot debugging captures a complete program state snapshot at the point of failure (variables, call stack, heap) without pausing execution — allowing post-hoc investigation without interrupting service; traditional debugging pauses execution interactively but requires the process to be running

Differential debugging compares two configurations that exhibit different behaviour (buggy vs working, version A vs version B) — systematically varying one factor at a time to identify which difference causes the fault; most effective when a regression is known to exist between two states

Assertion-driven debugging adds runtime assertions that document the discovered invariant violated by the bug — after fixing the bug the assertion remains in the code, forming an executable specification that catches the same fault if it ever recurs

Time-travel debugging records a complete execution trace allowing the debugger to step backwards as well as forwards through the execution history — most beneficial for bugs where the failure point is far removed from the causal fault (corruption happens at step 1, crash at step 10000)

Scientific debugging forms explicit hypotheses, designs a minimal experiment to test each hypothesis, and records results before forming the next — preventing 'shotgun debugging' (making random changes hoping one fixes the bug) which destroys evidence and may mask the real fault

A correlation ID is a unique identifier generated at request entry and propagated through all service calls — solving the problem of matching log entries from Service A, B, C, and D that all processed the same user request across thousands of concurrent requests

Both ASan and Valgrind detect: use-after-free, heap buffer overflows, stack buffer overflows, use of uninitialised memory — ASan is 2x slower than uninstrumented code; Valgrind is 10-50x slower, making ASan more practical for CI use while Valgrind offers more detailed analysis

Preventive maintenance restructures or refactors code to improve future maintainability (reducing technical debt) before failures occur; perfective maintenance adds new functionality or improves performance in response to user requests

Hotfix: emergency fix deployed immediately for critical production issue (bypassing normal release cycle); Patch release: bundled bug fixes following normal testing cycle; Minor release: backward-compatible new features plus bug fixes with full regression testing

EOL planning defines the timeline and process for retiring a software system or version — inadequate planning leaves users on unsupported versions (no security patches), organisations paying maintenance for dead systems, and no migration path — creating compounding security and operational risk

Configuration drift occurs when infrastructure/application configuration diverges from its documented or intended state due to manual changes — prevented by Infrastructure as Code (IaC) with enforced immutable infrastructure and regular compliance scanning