Quick interview answer
Cover positive flows, negative credentials, boundary and format validation, security (lockout, SQL/XSS payloads, masked password), session behaviour, accessibility and cross-browser rendering.
Detailed explanation
Start from requirements and derive equivalence classes for username and password, then boundary values for length limits. Add negative cases (wrong password, unregistered user, locked, expired password), security cases (rate limiting, brute force lockout, no credentials in URL, password masked, injection payloads), state cases (remember me, back button after logout, concurrent sessions) and non-functional cases (response time, localisation, screen reader labels).
Real-world example
On a banking portal this test design caught that lockout counters reset when the user switched devices — a real security defect missed by automation.
Interview tip
Group cases as functional / negative / security / non-functional — it shows structured thinking, not random ideas.