Backend Interview Questions
Databases, APIs, caching, distributed systems, security, and scalability — language-agnostic backend engineering questions, basic to senior-level, with diagrams and animations wherever code alone won't explain it. For deep Kotlin/Spring content, see the Backend Kotlin & Spring guide and the Kotlin + Spring Boot 4 course.
- Databases
- Basic
SQL vs NoSQL — how do you actually decide for a new service?
Forget the marketing slogans — the real decision comes down to your data's shape, your consistency requirements, and your query patterns, not which one is "more modern."
View question - Basic
Normalization vs denormalization — what's the real tradeoff?
It isn't a style choice — normalization buys you write-time integrity, denormalization buys you read speed, and knowing which layer of your architecture each belongs in is the actual skill.
View question - Advanced
How do B-tree and hash indexes actually work, and why does that determine which queries they speed up?
A hash index and a B-tree both answer "where's this row?" but their internal shape decides, with mathematical certainty, which queries each one can and can't accelerate.
View question - Intermediate
What makes a composite index effective, and what is index selectivity?
Column order in a composite index isn't a style preference — it's dictated by the leftmost-prefix rule and by putting equality predicates before range predicates.
View question - Basic
Explain ACID — and give a real example of a transaction that would break each property if violated
Anyone can recite the acronym; a senior engineer can produce one concrete transaction and show exactly how it breaks if Atomicity, Consistency, Isolation, or Durability is dropped.
View question - Advanced
Walk through the transaction isolation levels — Read Uncommitted to Serializable — and the anomaly each one fixes
Isolation levels are a trade knob between consistency and concurrency — learn which anomaly each level closes off and what it costs you in throughput.
View question - Intermediate
Optimistic vs pessimistic locking — when does each one win?
Both stop two transactions from clobbering the same row — they just disagree on whether to pay the coordination cost up front or only when there's an actual conflict.
View question - Advanced
How does database replication actually work — leader-follower vs multi-leader, and what can go wrong?
One copy of your data is a single point of failure — replication buys resilience and read scale, but forces you to decide what happens when the copies disagree.
View question - Advanced
What are the main database sharding strategies, and how do you pick a shard key?
Sharding scales writes by splitting data across nodes — but the one decision that shapes every query and every future headache is the key you split on.
View question - Advanced
Explain the CAP theorem with a concrete example of what happens during a network partition
Partitions aren't optional in a distributed system — CAP is really about what you're forced to give up the instant one actually happens.
View question - Basic
When does a document store like MongoDB fit better than a relational database — and when does it bite you?
Document databases trade joins and rigid schemas for embedded, read-optimized shapes — a great fit until your data's relationships outgrow a single document.
View question - Basic
Key-value stores like Redis or DynamoDB — what are they actually good for beyond caching?
Caching is the on-ramp, not the destination — key-value stores double as session storage, rate limiters, leaderboards, locks, and the backbone of single-table designs at massive scale.
View question - Intermediate
What is a wide-column store like Cassandra, and how is its data model different from a relational table?
Cassandra tables look like tables until you notice the primary key is really two different jobs — one picks the machine, the other picks the order — and that split is the whole model.
View question - Intermediate
When does a relational model break down enough that you'd reach for a graph database?
Relational joins get slower the deeper a relationship goes; graph databases store the relationship itself as a first-class, indexed pointer, so traversing five hops costs about the same as traversing one.
View question - Advanced
How do you read a query execution plan (EXPLAIN/EXPLAIN ANALYZE) and find the actual bottleneck?
A query plan reads bottom-up and inside-out — the real skill is spotting the one node where estimated and actual rows diverge, or where a scan touches far more than it returns.
View question - Basic
What is the N+1 query problem, and how do you actually fix it?
One list endpoint, one innocent-looking loop, and suddenly your database is answering a thousand queries for a page that should have needed two.
View question - Basic
How does database connection pooling work, and how do you size a pool correctly?
Opening a database connection is expensive enough that doing it per request will bottleneck you long before the database's actual query capacity does.
View question - Advanced
How do you run a schema migration on a large production table without downtime?
A migration that locks a 200-million-row table for a full table rewrite isn't a schema change, it's an outage — the fix is to never make the old and new shape incompatible at the same instant.
View question - Intermediate
What makes a time-series database different, and when do you actually need one?
Metrics and events are append-only, always queried by time range, and grow forever — a general-purpose OLTP database can hold them, but it wasn't built to hold them well.
View question - Intermediate
How does full-text search work under the hood (inverted indexes), and when do you reach for Elasticsearch vs. Postgres full-text search?
A LIKE '%term%' scan reads every row every time; an inverted index flips the question from 'does this row contain the word' to 'which rows does this word point to,' answered in microseconds.
View question - Intermediate
What does a solid database backup and disaster-recovery strategy actually look like? (RPO/RTO, point-in-time recovery)
Backups are easy to take and surprisingly easy to get wrong — the real design work is in RPO/RTO targets, PITR, and rehearsed failover, not just a nightly pg_dump.
View question - Intermediate
How do read replicas and read/write splitting work, and what's the catch (replication lag)?
Sending SELECTs to replicas multiplies your read capacity almost for free — until replication lag makes a user's own write disappear from their next read.
View question - Advanced
How do you design a multi-tenant database — shared schema vs. schema-per-tenant vs. database-per-tenant?
The multi-tenancy decision is really a decision about where you want isolation to live — in a column, in a schema boundary, or in a whole separate database — and each answer trades cost for blast radius.
View question - Advanced
A table has grown to hundreds of millions of rows — how do you partition it?
Partitioning splits one unmanageable table into many manageable ones behind a single logical name — the entire craft is picking a partition key that matches how the table is actually queried.
View question - Basic
How do you choose a primary key strategy — UUID vs. auto-increment vs. a Snowflake-style distributed ID?
The 'obvious' choice — an auto-increment integer — quietly breaks the moment you shard, replicate across regions, or need to generate an ID before a row ever touches the database.
View question - APIs & Protocols
- Basic
What separates a well-designed REST API from a mediocre one?
Great REST APIs read like a map of your domain — nouns for resources, verbs for actions, and status codes that tell the truth.
View question - Basic
REST vs GraphQL vs gRPC vs SOAP — how do you actually choose?
Four ways to shape a request over the wire, each optimized for a different failure mode — pick the one whose failure mode you can live with.
View question - Intermediate
What makes an API endpoint idempotent, and how do idempotency keys work for non-idempotent operations like payments?
Idempotency is what lets a client retry blindly after a timeout without double-charging anyone: the guarantee HTTP gives you for free, and the one you have to build yourself.
View question - Basic
What are the main API versioning strategies (URI, header, content negotiation) and their tradeoffs?
Every API eventually breaks a contract with someone — versioning is simply deciding, in advance, how loudly and how often that happens.
View question - Advanced
Explain the main rate-limiting algorithms — token bucket, leaky bucket, fixed window, sliding window log/counter
Rate limiting is a question about bursts, not averages — each algorithm is really just a different answer to "how much burst do I allow, and how do I remember the recent past?"
View question - Basic
Offset pagination vs. cursor/keyset pagination — what breaks with offset at scale?
LIMIT/OFFSET reads like the obvious way to paginate a list, until page 500 makes your database scan half a million rows just to throw them away.
View question - Basic
Walk through HTTP status codes an API should actually use correctly (not just 200 and 500)
Most APIs use maybe six status codes correctly and paper over everything else with 200 or 500 — here's the vocabulary interviewers actually expect you to know.
View question - Intermediate
Webhooks vs. polling vs. long-polling vs. Server-Sent Events vs. WebSockets — when does each fit?
Five different answers to the same question — how does the client find out something changed — and interviewers use it to see whether you reach for WebSockets by habit or actually weigh the trade-offs.
View question - Advanced
How does gRPC actually work under the hood — Protocol Buffers, HTTP/2 streaming, and why is it faster than REST+JSON?
gRPC's reputation for speed is really three separate mechanisms stacked together — pull them apart and you have a genuinely senior answer instead of a benchmark you memorized.
View question - Advanced
What is the GraphQL N+1 problem, and how does DataLoader (batching + caching) fix it?
One GraphQL query can silently trigger hundreds of database calls when nested resolvers run independently — DataLoader batches and caches them away.
View question - Intermediate
What does an API gateway actually do, and why put one in front of your microservices?
An API gateway is the single front door for your services — routing, auth, rate limiting and aggregation live there so clients stay simple.
View question - Intermediate
API authentication: API keys vs. OAuth2 vs. JWT — what's actually different, and when do you combine them?
API keys, OAuth2 and JWT get treated as competitors, but each answers a different question about identity, delegation, and token shape.
View question - Advanced
Walk through the OAuth2 authorization code flow with PKCE, step by step
Public clients like SPAs and mobile apps cannot keep a secret, so PKCE binds the flow's start to its finish instead.
View question - Basic
What does CORS actually protect against, and what's the real difference between simple and preflighted requests?
CORS looks like a firewall rule but it's a browser-enforced contract between origins — knowing what it blocks, and what it never touches, prevents costly misconfigurations.
View question - Intermediate
What is API contract testing, and how does an OpenAPI/Swagger spec fit into your development and testing workflow?
Integration tests catch drift only after two teams collide in a shared environment — contract testing catches it in each team's own CI, against a spec both sides already agreed on.
View question - Intermediate
How do you evolve an API without breaking existing clients?
Every field you add is free; every field you remove, rename, or retype is a promise broken to someone you've probably never met — evolving an API well means treating the contract as public even when it isn't.
View question - Basic
How does HTTP compression (gzip/brotli) work, and when does it actually help vs. hurt?
Compression trades CPU for bandwidth via content negotiation — get the trade wrong and you'll burn cycles re-compressing a JPEG, or worse, open a side channel that leaks secrets over TLS.
View question - Intermediate
HTTP/2 vs HTTP/3 (QUIC) — what problem does each one actually solve?
Both promise a faster web, but they attack completely different bottlenecks — one lives in the browser's connection pool, the other lives inside TCP itself.
View question - Intermediate
Walk through the WebSocket protocol handshake, and when do you actually need a persistent connection?
A WebSocket starts life as a normal HTTP request and only becomes something else after both sides agree to stop speaking HTTP — the handshake tells you exactly what you're trading away.
View question - Basic
How should an API return errors — what does a good standardized error response look like (e.g. RFC 7807 Problem Details)?
An error response is still part of your API's contract — 'it broke, here's a stack trace' is not a design, and RFC 7807 gives every client the same shape to parse.
View question - Intermediate
How do you design an API endpoint for a long-running operation (e.g. video processing) — sync, polling, or webhooks?
Making the client wait on an open connection for a two-minute video transcode is how you get gateway timeouts — the fix is to accept the work immediately and let the client check back.
View question - Advanced
What does it take to design a public API that third-party developers will actually want to use?
A correct API and a lovable one are different projects — the gap is closed by documentation, SDKs, a sandbox to fail safely in, and a deprecation policy developers can actually plan around.
View question - Caching
- Basic
Cache-aside vs. write-through vs. write-behind — how do these caching patterns actually differ?
Three ways to keep a cache and a database in sync, each trading off latency, consistency, and blast radius on failure differently.
View question - Basic
What are the main cache invalidation strategies (TTL, explicit invalidation, event-based) and why is cache invalidation famously hard?
Phil Karlton's line about "only two hard things in computer science" is a cliché because every invalidation strategy trades staleness for complexity somewhere.
View question - Basic
How does CDN/edge caching work, and which HTTP headers control it?
CDNs push responses to servers near the user, but only the response headers decide whether they're allowed to, for how long, and for whom.
View question - Intermediate
Redis isn't just a key-value store — what data structures does it offer and what real problems do they solve?
Hashes, sorted sets, lists, and streams each carry their own complexity guarantees and durability trade-offs — picking the right one is the actual skill.
View question - Advanced
What is a cache stampede (thundering herd), and how do you prevent it when a hot key expires?
When a single popular cache entry expires, thousands of requests can pile onto your database in the same instant — here's how to stop that pile-up before it starts.
View question - Intermediate
Local (in-process) caching vs. distributed caching — what's the real tradeoff?
Both keep data close to the reader, but one lives and dies with a single process while the other lives and dies with the network — the choice changes your consistency, latency, and failure story.
View question - Basic
How do LRU and LFU eviction policies actually work, and when would you pick one over the other?
Both LRU and LFU decide what to throw away when a cache fills up, but they bet on completely different signals — and each has a workload that quietly breaks it.
View question - Basic
Walk through HTTP caching headers — Cache-Control, ETag, Last-Modified, If-None-Match — and how a conditional request actually works
Freshness and validation are two separate jobs in HTTP caching — one skips the network entirely, the other still asks but can answer with almost nothing.
View question - Advanced
How do you keep a cache consistent when you have multiple application instances writing to it?
When several app instances write the same data, only disciplined invalidation — not copying the new value everywhere — keeps every cache in sync.
View question - Basic
What is the write-around cache pattern, and when does it beat write-through?
Write-around skips the cache on writes entirely, trading a guaranteed first-read miss for a simpler, faster write path on data nobody rereads right away.
View question - Intermediate
How does multi-level caching work — in-process L1 + Redis L2 + CDN — and why layer them?
Stacking an in-process cache, a shared Redis layer, and a CDN turns one hit-rate problem into three, each catching what the last one missed.
View question - Basic
What is cache warming, and when is it worth the operational complexity?
Cache warming pre-loads the hot keys before traffic arrives, trading extra operational moving parts for immunity to cold-start stampedes.
View question - Basic
What is negative caching (caching ‘not found’ results), and why does it matter for protecting your backend?
A cache that only remembers hits still lets attackers or bugs hammer your database with lookups for keys that will never exist — negative caching closes that gap.
View question - Advanced
How does consistent hashing work, and why do distributed caches like Memcached/Redis Cluster need it instead of simple modulo hashing?
When you add or remove a server, modulo hashing reshuffles almost every key at once — consistent hashing keeps the disruption to a tiny, predictable slice.
View question - Intermediate
Sticky sessions vs. a shared session cache — how do you handle user session state behind a load balancer?
Pin a user to one server and you inherit its uptime problems; move sessions to a shared cache and you trade a bit of latency for real horizontal scaling.
View question - Intermediate
How does query result caching work in an ORM or database layer, and what invalidates it?
Query result caching promises to skip expensive round-trips to the database — until a single UPDATE statement quietly leaves half your users staring at yesterday's data.
View question - Basic
What makes a good cache key, and what goes wrong when you get key design wrong (collisions, missing version/tenant scoping)?
A cache key is a promise that 'this exact input produces this exact output' — break that promise and you serve someone else's data, or someone else's tenant's data, without a single error in the logs.
View question - Intermediate
When should you NOT reach for a cache? What are the real risks of over-caching?
Caching is often sold as a free performance win, but every cache you add is a second source of truth, a new failure mode, and a bet that staleness is cheaper than the query you're avoiding.
View question - Microservices & Distributed Systems
- Basic
When does splitting a monolith into microservices actually pay off, and when is it a costly mistake?
Microservices trade one hard problem (a tangled codebase) for another (a tangled network) — the question is whether your organization is bigger than the problem you're solving.
View question - Intermediate
How does service discovery work — client-side vs. server-side discovery?
Every dynamic deployment needs an answer to 'which address do I call right now?' — the interesting design decision is who asks the registry and where the load-balancing happens.
View question - Advanced
How do distributed transactions work across microservices — walk through the saga pattern, orchestration vs. choreography
When one logical operation spans four databases you don't control jointly, atomicity gives way to a sequence of local commits plus compensating actions when something downstream fails.
View question - Advanced
What is two-phase commit, and why do most distributed systems avoid it at scale?
Two-phase commit buys real atomicity across services by making every participant promise to commit before anyone does — and that promise is exactly what can freeze the system solid.
View question - Intermediate
Explain the circuit breaker pattern — what are its states and when does each transition happen?
Named after the fuse in your wall for a reason: a circuit breaker stops a caller from hammering a failing dependency, failing fast instead of piling up threads that never come back.
View question - Intermediate
What is the bulkhead pattern, and how does it stop one failing dependency from taking down your whole service?
A slow payment provider shouldn't be able to freeze your whole checkout flow — bulkheads wall off each dependency's resources so one failure stays contained.
View question - Intermediate
What problem does a service mesh (Istio/Linkerd) actually solve that you couldn't already do in application code?
Istio and Linkerd don't invent new capabilities — they move mTLS, retries, and observability out of every service's code and into shared, centrally governed infrastructure.
View question - Advanced
How do you handle a query that needs data from 5 different microservices — API composition vs. CQRS with a read model?
Fan out five parallel calls and merge them, or maintain a pre-joined read model built from events — the right choice depends on latency, consistency, and query shape.
View question - Intermediate
How does distributed tracing work — what's a trace, a span, and how does context propagate across service calls?
A trace is the story of one request across a dozen services; a span is one chapter of it — and a header called traceparent is what keeps the story connected.
View question - Advanced
Give the intuition behind consensus algorithms like Raft — how do distributed nodes agree on a single value?
No single node can be trusted to decide alone — Raft shows how a majority of unreliable machines agree on one truth, even as leaders crash and networks split.
View question - Intermediate
What makes a message consumer idempotent, and why does at-least-once delivery force you to design for it?
Message brokers redeliver. Networks retry. If processing a message twice changes the outcome, your system isn't broken by chance -- it's broken by design.
View question - Advanced
What is event sourcing — storing events instead of state — and what do you gain and lose?
Instead of overwriting a row, event sourcing appends what happened and rebuilds current state by replaying history -- a full audit log becomes the source of truth itself.
View question - Intermediate
How does the strangler fig pattern let you migrate a monolith to microservices incrementally?
Named after a vine that envelops a tree and eventually replaces it, the strangler fig pattern routes traffic through a facade so you can peel capabilities off a monolith one route at a time -- never a big-bang rewrite.
View question - Advanced
How does distributed locking work — Redis Redlock vs. ZooKeeper — and what can go wrong?
A mutex only protects one process's memory -- coordinating multiple machines around a single critical section needs a lock that lives outside all of them, and every implementation trades safety for latency somewhere.
View question - Advanced
What is the transactional outbox pattern, and how does it solve the dual-write problem between a database and a message broker?
Writing to your database and publishing to a broker are two separate systems with no shared transaction -- the outbox pattern turns that into a single atomic write plus a reliable relay, so a crash between the two can never happen.
View question - Intermediate
How do services authenticate to each other in a microservices mesh — mTLS vs. service accounts/tokens?
Two services calling each other over the network need to prove who they are without a human in the loop — mTLS and token-based identity solve that in very different ways.
View question - Intermediate
What is backpressure in a distributed system, and how do you actually implement it?
When a consumer can't keep up, someone has to slow the producer down deliberately — otherwise the JVM or the kernel will do it for you, at the worst possible moment.
View question - Basic
Eventual consistency vs. strong consistency — what's the real-world tradeoff and how do you pick per use case?
Every replicated data store has to promise something about staleness — the skill isn't picking one model forever, it's matching the model to what a stale read would actually cost.
View question - Advanced
What are the common distributed-system failure modes — network partitions, split-brain, clock skew — and how do you defend against them?
A single machine either runs or crashes; a distributed system can have two nodes each behaving correctly in isolation while together producing a silently corrupted result.
View question - Basic
How do health checks and readiness/liveness probes actually work, and why are they different?
"Should this container be restarted" and "should traffic go here right now" are different questions with different remedies, and conflating them is how a database blip becomes a fleet-wide crash loop.
View question - Basic
Blue-green vs. canary deployments — how do they actually differ and how do you choose?
Both strategies promise safer releases, but blue-green swaps entire environments instantly while canary trickles traffic gradually — the choice changes what breaks and how fast.
View question - Intermediate
How do domain-driven design bounded contexts help you draw microservice boundaries correctly?
Splitting services by database table or org chart produces a distributed monolith — bounded contexts split along meaning, not infrastructure.
View question - Intermediate
gRPC vs. a message queue for service-to-service communication — when do you pick sync RPC vs. async messaging?
Both move data between services, but one blocks the caller waiting for an answer while the other doesn't care if it takes a minute.
View question - Advanced
How do cascading failures happen in a distributed system, and how do you actually stop one from taking down everything?
A single slow dependency deep in the call chain can quietly exhaust every thread pool above it until the whole system looks down.
View question - Advanced
Design the backend architecture for an e-commerce order flow across microservices — walk through the services and how they communicate
One order touches five services and two communication styles — walk through the flow and the sagas that keep it correct without a distributed transaction.
View question - Concurrency & Async
- Basic
How do you size a thread pool correctly, and what goes wrong when you get it wrong?
Thread pool sizing looks like a config knob, but the wrong number silently turns a healthy service into a queue that never drains.
View question - Basic
Async/await vs. callbacks vs. promises/futures — what's actually different under the hood?
They all solve the same problem — do this after that finishes — but each one changes where control returns, how errors propagate, and what the call stack looks like when something breaks.
View question - Intermediate
What is a race condition, and what's your actual process for finding one in a codebase?
Race conditions rarely announce themselves with a stack trace — they show up as a support ticket that says "sometimes the count is wrong" and vanish the moment you attach a debugger.
View question - Intermediate
What causes a deadlock, and how does lock ordering prevent it?
A deadlock needs four conditions to hold at once, and lock ordering breaks exactly one of them — the trick in an interview is showing you can spot where real code violates it.
View question - Intermediate
How do you implement the producer-consumer pattern correctly with a bounded queue?
A bounded queue is the whole point of the pattern — it turns "the producer is faster than the consumer" from an eventual out-of-memory crash into deliberate, visible backpressure.
View question - Advanced
How does backpressure work in reactive streams (Reactive Streams spec, Project Reactor/RxJava)?
When a fast producer meets a slow consumer, something has to give — backpressure is the protocol that lets the consumer say "not yet" instead of drowning.
View question - Intermediate
How does Node.js's single-threaded event loop actually handle concurrency — walk through its phases
Node runs your code on one thread, yet serves thousands of connections at once — the event loop's six phases and its microtask queue are the whole trick.
View question - Advanced
What are virtual threads (Project Loom) and how are they different from OS threads or green threads in older runtimes?
Virtual threads look exactly like ordinary Java threads, cost almost nothing to create by the millions, and quietly unmount from the OS thread underneath whenever they'd block.
View question - Intermediate
What is the actor model (Akka-style), and how does it sidestep shared-memory concurrency problems?
Actors trade shared mutable state for private state and a mailbox — each one processes exactly one message at a time, so races within an actor become structurally impossible.
View question - Intermediate
How does optimistic concurrency control (version columns) work in application code, and when does it beat pessimistic locking?
A version column turns a plain UPDATE into a database-native compare-and-swap — no lock held, just a retry when someone else got there first.
View question - Advanced
How do you implement rate limiting that's correct across multiple server instances, not just one process?
In-memory counters lie the moment you scale horizontally — a correct limiter needs shared, atomic state and a well-chosen window algorithm.
View question - Advanced
What is structured concurrency, and how does cancellation actually propagate through a coroutine/task tree?
Structured concurrency ties every child task's lifetime to its parent scope, so cancellation, errors, and cleanup flow predictably instead of leaking orphaned work.
View question - Advanced
What does 'happens-before' mean in the Java Memory Model, and why can code without synchronization see stale values across threads?
The JMM doesn't just govern instruction order — it decides whether a write from one thread is ever guaranteed to become visible to another at all.
View question - Intermediate
What happens when many worker processes all start up and hit the same resource (database, cache) at once, and how do you prevent that thundering herd?
Synchronized startups turn a routine scale-up or deploy into a self-inflicted outage unless the demand hitting the shared resource is spread out in time.
View question - Intermediate
How do you orchestrate multiple async calls that need to fan out and then fan back in (like `Promise.all`)?
Fan-out dispatches independent async calls at once; fan-in waits for and combines them — and the real design question is what happens when only some of them succeed.
View question - Intermediate
How does Python's Global Interpreter Lock (GIL) actually limit concurrency, and how do you work around it?
The GIL is the single most misunderstood line item on a Python backend's performance profile — it blocks CPU parallelism but barely touches I/O concurrency.
View question - Advanced
How do work-stealing schedulers (like Go's or Java's ForkJoinPool) balance load across threads?
A single shared task queue becomes the bottleneck the moment you add cores; work-stealing gives every worker its own queue and only borrows when idle.
View question - Basic
How do you implement debouncing and throttling on the backend (not just in frontend JS) — e.g. rate-limiting noisy retries or writes?
Debounce and throttle are not just click-handler tricks — on a backend they coalesce noisy write bursts and cap how hard a client can hammer a downstream dependency.
View question - Basic
How do you implement a graceful shutdown that drains in-flight requests instead of dropping them?
A process that dies the instant it gets SIGTERM turns every rolling deploy into a small wave of dropped connections and 502s for whoever was mid-request.
View question - Basic
How do you choose a concurrency model for a given workload — CPU-bound vs. I/O-bound?
Thread-per-request, event loop, and worker pool are not competing 'best practices' — they are different trade-offs, and the wrong one for your workload becomes an outage under load.
View question - Security
- Basic
What's the actual difference between authentication and authorization, and where do systems commonly conflate them?
Authentication proves who you are; authorization decides what you're allowed to do — conflating the two is how 'logged in' quietly becomes 'allowed to do anything.'
View question - Basic
Session-based auth vs. token-based (JWT) auth — what are the real tradeoffs?
Sessions keep state on the server and can be revoked instantly; JWTs keep state on the client and scale beautifully until you need to take one back.
View question - Intermediate
What are the common JWT pitfalls — algorithm confusion (alg:none), no revocation, storing it insecurely?
A JWT is only as safe as the verification code that checks it — and the three most common ways to check it wrong all lead to full authentication bypass.
View question - Basic
How should you actually hash passwords, and why is SHA-256 alone wrong?
SHA-256 is a fast, general-purpose hash built for integrity checks, not for secrets — which is exactly why attackers can try billions of guesses per second against it.
View question - Basic
How does SQL injection actually work, and how do parameterized queries stop it?
SQL injection happens the instant untrusted input is allowed to change the shape of a query, not just its values — parameterized queries fix that by construction.
View question - Basic
How do stored, reflected, and DOM-based XSS actually differ, and how do you prevent each on the backend?
Cross-site scripting isn't one bug — it's three different delivery mechanisms for the same payload, and each one demands a different fix in a different layer of your stack.
View question - Basic
How does CSRF actually work, and how do tokens plus SameSite cookies stop it?
CSRF weaponizes the browser's own trust in a logged-in session — the attacker never sees your cookie, they just get your browser to spend it.
View question - Basic
Walk through the OWASP Top 10 from a backend engineer's perspective — which ones do you actually see in real code reviews?
The OWASP Top 10 isn't a compliance checklist to skim once — it's a ranked list of the mistakes that show up again and again in real pull requests.
View question - Intermediate
How should you actually manage secrets — env vars vs. a vault (HashiCorp Vault/AWS KMS/Secrets Manager)?
Environment variables solve the 'don't hardcode it' problem and stop there — a vault solves the much harder problems of rotation, audit, and blast radius.
View question - Basic
Encryption at rest vs. in transit — what actually protects what, and what's the failure mode if you only have one?
TLS and at-rest encryption defend against two completely different attackers, and having only one leaves the other's favorite attack wide open.
View question - Intermediate
How does mutual TLS (mTLS) work, and when do you need certificate-based auth instead of just a bearer token?
In mTLS both sides prove their identity with X.509 certificates during the TLS handshake itself, closing gaps bearer tokens alone can't cover.
View question - Intermediate
How do you actually prevent brute-force and credential-stuffing attacks against a login endpoint?
Login endpoints need layered rate limiting, lockouts, and adaptive CAPTCHA challenges, because no single control stops both brute force and distributed credential stuffing.
View question - Intermediate
RBAC vs. ABAC — how do these access-control models differ, and when do you need attribute-based rules?
RBAC grants access by job role while ABAC evaluates user, resource, and context attributes at request time — most real systems eventually need both.
View question - Intermediate
How do you implement TOTP-based multi-factor authentication from scratch?
TOTP turns a shared secret and the current time into a rotating six-digit code using HMAC — understanding HOTP first makes every design detail obvious.
View question - Basic
What do the important HTTP security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options) actually protect against?
Each security header closes one specific attack — clickjacking, MIME sniffing, downgrade attacks, injected scripts — none of them substitutes for fixing the real vulnerability.
View question - Advanced
What is insecure deserialization, and how can deserializing untrusted data lead to remote code execution?
Turning bytes back into an object can silently call constructors and special hooks — enough, in the wrong hands, to hand an attacker a shell.
View question - Advanced
What is Server-Side Request Forgery (SSRF), and how do you defend an endpoint that fetches a user-supplied URL?
A server that fetches a user-supplied URL can be tricked into fetching your own cloud credentials instead — SSRF turns your network position into the attacker's.
View question - Intermediate
How do you manage supply-chain and dependency security — SCA scanning, lockfiles, and SBOMs?
Most of the code running in your service was written by strangers you never vetted — supply-chain security is the discipline of managing that trust deliberately.
View question - Basic
What does good audit logging for security-sensitive actions actually look like?
A debug log helps engineers understand the system; an audit log must convince a human, after the fact, exactly who did what.
View question - Advanced
Design a secure authentication system from scratch — walk through registration, login, session/token issuance, and password reset
The highest-yield senior interview question here — a strong answer walks every stage in order, naming the exact decision and failure mode at each one.
View question - Scalability & System Design
- Basic
Vertical vs. horizontal scaling — what are the real limits of each?
Every system eventually hits a wall — the question is whether you hit it with a bigger machine or with more of them, and what breaks first.
View question - Basic
What are the main load-balancing algorithms — round robin, least connections, consistent hashing — and when does each fit?
Load balancing isn't one algorithm — it's a family of trade-offs, and picking the wrong one for your traffic shape causes real incidents.
View question - Basic
L4 vs. L7 load balancing — what's the actual difference in what they can see and do?
Both answer 'which backend handles this?' — but one reads only IP and port, and the other reads the entire HTTP request. That gap changes everything they can do.
View question - Advanced
Design a URL shortener — walk through the full architecture
A URL shortener looks trivial until you have to generate a billion unique codes without a single counter becoming your bottleneck.
View question - Advanced
Design a rate limiter as a standalone service that multiple APIs can call
Rate limiting done separately in every service drifts out of sync fast — a shared, atomic, Redis-backed limiter is the pattern that actually holds a quota across a whole platform.
View question - Advanced
Design a social media news feed or timeline — how do fan-out-on-write and fan-out-on-read compare?
Push a post to millions of followers immediately, or merge everyone you follow at read time — the choice sets your write cost and celebrity-account failure mode.
View question - Advanced
Design a distributed job scheduler that runs millions of scheduled tasks reliably — how would you build it?
Cron doesn't survive a second replica or a million rows — a real scheduler needs time-bucketed storage, leader election, and a queue that separates 'due' from 'done'.
View question - Intermediate
How does a CDN's architecture actually work — origin, edge PoPs, cache hierarchy, and invalidation?
A CDN is a globally distributed caching layer that intercepts requests before your origin ever sees them — its tiers explain both its speed and its invalidation headaches.
View question - Intermediate
How does auto-scaling actually decide when to add or remove instances — which metrics and policies matter?
CPU utilization is the default scaling metric, but it's often the wrong one — the real question is which signal actually predicts user-facing pain before it happens.
View question - Advanced
How do you scale reads and writes independently at the infrastructure level using CQRS?
CQRS isn't just a read replica — it lets your read side use a completely different data model and storage engine, kept in sync through events instead of tables.
View question - Advanced
Design a chat/messaging backend — walk through message delivery, ordering, and online presence
One feature request — "send a message" — hides three separate hard problems: durable delivery, per-conversation ordering, and presence at scale.
View question - Advanced
Design a file storage service like S3 or Dropbox — walk through the architecture
Behind "upload a file" sits a metadata service, a chunking pipeline, content-addressed deduplication, and a replication strategy that has to survive losing an entire data center.
View question - Intermediate
How do you do capacity planning and back-of-the-envelope estimation for a new system?
The interviewer isn't grading your arithmetic — they're watching whether your assumptions are explicit, your units are consistent, and your numbers would actually change the design.
View question - Advanced
How do you handle a hot key or hot partition that's overwhelming a single shard?
One viral product, one celebrity account, or one popular counter can send all your traffic to a single shard no matter how many nodes the rest of your cluster has.
View question - Advanced
Design a notification system that fans out a single event to push, email, and SMS
One "order shipped" event needs to become three very different downstream calls — each with its own provider, its own failure mode, and its own idea of an acceptable retry.
View question - Advanced
How do you architect a multi-region / geo-distributed backend, and what breaks first when you go multi-region?
Latency and availability push you toward different architectures — conflating them is the most common mistake in this design question.
View question - Advanced
Active-active vs. active-passive disaster recovery — how do they differ and what's the actual RTO/RPO tradeoff?
RTO and RPO, not the topology name, are what a disaster-recovery design should actually be judged against.
View question - Intermediate
Design a real-time leaderboard/ranking system for millions of users
Redis sorted sets turn rank, top-N, and score updates into logarithmic operations instead of full-table scans.
View question - Intermediate
Design a search autocomplete/typeahead service — how do you return suggestions in milliseconds?
The trick is precomputing top-K suggestions per trie node offline, so a live query is just an O(L) walk, not a ranked search.
View question - Intermediate
Design a distributed unique ID generator (like Twitter Snowflake) — how do you guarantee uniqueness without coordination?
Encode timestamp, machine identity, and a local sequence into one 64-bit integer, and uniqueness falls out with zero network calls per ID.
View question - Intermediate
What is a Bloom filter, and what real backend problems does it solve?
A probabilistic set that trades a small false-positive rate for constant-time, constant-space membership checks — perfect for guarding an expensive lookup behind a cheap one.
View question - Advanced
Design a web crawler that can scale to billions of pages
A web crawler is a distributed graph traversal with one hard rule: cover billions of pages without ever looking like a denial-of-service attack against any single site.
View question - Intermediate
How do you handle large file uploads reliably — chunked and resumable uploads?
Split the file into chunks the client can retry independently, track exactly which ones the server already has, and resuming becomes a lookup instead of a restart.
View question - Advanced
Design a payment processing system — walk through the architecture and where idempotency and consistency matter most
Money can never be double-charged or silently lost, which means every hop between your service and the bank needs an idempotency key and a reconciliation job as its safety net.
View question - Advanced
Capstone: design a scalable e-commerce checkout system end to end — inventory, cart, payment, order confirmation
The hardest part of checkout isn't charging the card — it's guaranteeing two shoppers can't both buy the last unit, and rolling back cleanly when a step fails.
View question - DevOps & Observability
- Basic
How does Docker actually isolate a process — what's really different from a VM?
Containers get called "lightweight VMs," but they share the host kernel — real isolation comes from Linux namespaces and cgroups, not virtualized hardware.
View question - Basic
What does Kubernetes actually do for you that plain Docker doesn't?
Docker packages and runs one container; Kubernetes is the orchestration layer that schedules, heals, and networks a fleet of them across many machines.
View question - Basic
Walk through the stages of a real CI/CD pipeline, from commit to production
A pipeline orders its checks from cheapest to most expensive, so a bad change dies as early as possible — commit, build, test, scan, package, deploy, verify, and only then release.
View question - Basic
What is Infrastructure as Code, and why does immutable infrastructure matter?
Defining infrastructure in version-controlled config instead of manual clicks makes changes reviewable and reproducible — immutability then removes config drift entirely by replacing instances instead of patching them.
View question - Basic
What are the three pillars of observability — logs, metrics, and traces — and how do they complement each other?
Metrics tell you something is wrong and how badly, traces tell you where in the system, and logs tell you exactly why — a single trace_id is what lets you correlate all three during an incident.
View question - Basic
What does good structured logging actually look like, and why does it beat printf-style logs at scale?
Printf-style logs work fine with one service and ten users; once you have a dozen services and a real incident, only structured, correlatable JSON logs let you reconstruct what happened.
View question - Basic
What are the main metric types — counters, gauges, histograms — and when do you use each?
Picking the wrong metric type is why half of production dashboards lie: a gauge that only goes up, or a counter you tried to average, both quietly produce nonsense.
View question - Intermediate
How do you design alerting that doesn't cause alert fatigue — what does SLO-based alerting look like?
Paging someone for every CPU spike trains them to ignore pages; SLO-based, burn-rate alerting only wakes someone up when users are actually being hurt, and fast.
View question - Intermediate
How does distributed tracing sampling actually work — why can't you trace 100% of requests at scale?
At 50,000 requests per second, tracing every single one would multiply your storage and network bill many times over just to keep spans nobody will ever look at.
View question - Intermediate
What are SLIs, SLOs, SLAs, and error budgets — and how do they actually change engineering decisions?
These four terms aren't reliability trivia; an exhausted error budget is the mechanism that turns 'we should probably slow down and fix things' into an actual, enforced decision.
View question - Basic
How do feature flags enable progressive delivery, and how do you actually implement one cheaply?
Feature flags decouple deploying code from releasing it to users, and a solid percentage-rollout flag is nothing more than a deterministic hash and a comparison.
View question - Intermediate
What is configuration drift, and how does immutable infrastructure prevent it?
Servers that start out identical quietly stop being copies of each other as manual patches accumulate — immutable infrastructure fixes this by making a running instance impossible to edit.
View question - Intermediate
What are the actual techniques for a zero-downtime deployment?
Zero-downtime deploys rest on a precise mechanical promise — no dropped request, no severed connection — delivered through rolling replacement, health gates, connection draining, and schema compatibility.
View question - Advanced
What is chaos engineering, and why would you deliberately break production-like systems?
Chaos engineering is not random destruction — it's a falsifiable experiment against a measurable steady-state hypothesis, run with a controlled blast radius and an abort switch.
View question - Basic
What does a good incident response process and blameless postmortem actually look like?
Detect, triage, mitigate, resolve, postmortem — a five-stage lifecycle where blameless doesn't mean nobody's accountable, it means the analysis targets the process instead of the person.
View question - Intermediate
How does a log aggregation architecture like ELK or Grafana Loki actually work end to end?
Trace a single log line's journey from a container's stdout to a searchable dashboard, and see why every stage — shipping, buffering, parsing, indexing — earns its place in the pipeline.
View question - Intermediate
Why and how do you scan container images for vulnerabilities before they reach production?
Every container image is a frozen stack of someone else's dependencies, and any layer in it can carry a known, disclosed CVE nobody on your team has ever read about.
View question - Basic
Infrastructure monitoring vs. application performance monitoring (APM) — what's the real difference in what each one tells you?
One tells you whether the machine is healthy, the other tells you whether the request is healthy — confusing them is a classic mistake during an incident.
View question - Intermediate
What is GitOps, and how does managing infrastructure declaratively through git actually work?
A commit isn't a record of what happened to your infrastructure — it's the instruction for what should exist, continuously enforced by an operator running inside the cluster.
View question - Advanced
You're standing up a brand-new service — design its observability stack from scratch
Logs, metrics, and traces are three separate purchases until you connect them with a trace_id and an SLO — this is the capstone question that tests whether you can do that.
View question - Message Queues & Event-Driven Architecture
- Basic
What real problem does a message queue solve that a direct synchronous call doesn't?
It's not about speed — it's about what happens when the callee is slow, down, or overwhelmed, and the caller can't afford to block on that.
View question - Basic
Point-to-point queues vs. pub/sub topics — what's the actual difference in delivery semantics?
Same broker, two opposite contracts: a queue splits work across competing consumers, while a topic gives every subscriber its own full copy of the stream.
View question - Intermediate
At-most-once vs. at-least-once vs. exactly-once delivery — what does each guarantee actually mean, and is exactly-once really possible?
Each semantic trades a different failure for another — loss, duplication, or neither — and 'exactly-once' turns out to be at-least-once wearing an idempotency disguise.
View question - Intermediate
How does message ordering work in a partitioned system like Kafka, and what breaks that ordering guarantee?
Kafka only promises order within a single partition, so the partitioning key you choose is the real mechanism deciding whether related events stay in sequence.
View question - Basic
What is a dead letter queue, and how do you handle a 'poison message' that keeps failing?
Infinite retries waste consumer capacity; silent drops lose data. A DLQ gives failing messages a bounded number of tries before flagging one for a human.
View question - Intermediate
Walk through Kafka's architecture — brokers, partitions, and consumer groups — and how they achieve both scale and ordering
Kafka scales by splitting topics into partitions across brokers, then uses consumer groups to parallelize reads — but ordering is only guaranteed inside a single partition, not across a topic.
View question - Basic
What are RabbitMQ's exchange types — direct, topic, fanout, headers — and when do you use each?
RabbitMQ routes every message through an exchange, and the exchange type — direct, topic, fanout, or headers — decides which queues actually receive it.
View question - Intermediate
Event-driven architecture vs. request-response — what changes in how you design a system?
Request-response couples services through direct calls and shared availability; event-driven architecture couples them only through the shape of events, trading immediate consistency for resilience and independent scaling.
View question - Advanced
How do CQRS and event sourcing combine in a real event-driven system?
CQRS splits writes from reads into separate models, and event sourcing makes the write model's source of truth a log of events instead of current state — together they let you rebuild any view of the past and scale reads independently.
View question - Intermediate
What causes consumer lag in a message queue, and how do you handle backpressure when consumers can't keep up?
Consumer lag is the gap between the latest produced offset and what a consumer group has actually processed — and left unchecked, it either explodes memory on the consumer or silently delays every downstream effect.
View question - Intermediate
Kafka vs. RabbitMQ vs. SQS — how do you actually choose for a given use case?
Three battle-tested messaging systems solve overlapping but distinct problems — picking the wrong one means fighting the tool for years.
View question - Advanced
How do you design an event schema and handle schema evolution over time (Avro/Protobuf + a schema registry)?
The event you publish today will be read by consumers you haven't written yet — schema evolution is the discipline that keeps that possible without a synchronized deploy.
View question - Advanced
How do you handle fan-out event processing at scale — one event triggering many downstream consumers?
One business event can have ten independent consequences — fan-out done right means adding the eleventh without touching the producer or any sibling consumer.
View question - Intermediate
How does Change Data Capture (CDC) with something like Debezium work, and what problem does it solve?
CDC turns every row-level change already happening in your database into a stream of events, without touching application code or risking the dual-write problem.
View question - Advanced
Design an event-driven order processing pipeline from order placement to fulfillment
A single order touches four independently-deployed services and no distributed transaction — this is the interview question that tests whether you actually understand sagas, not just message brokers.
View question - Testing Strategy
- Basic
What is the testing pyramid, and why do most senior engineers say too many teams get the ratio backwards?
The testing pyramid is a claim about cost and feedback speed, not a rulebook — and most teams that struggle with slow, flaky CI have quietly inverted it without noticing.
View question - Intermediate
What is contract testing between services (e.g. using Pact), and how does it avoid the need for a full integration environment?
Consumer-driven contract testing lets two independently deployed services prove they agree on an interaction using nothing but a shared file — no shared environment, no both-services-running requirement.
View question - Basic
Mocks vs. stubs vs. fakes vs. spies — what's actually different, and when do you reach for each?
The four types of test double split cleanly into two families — those that control input and those that verify interactions — and confusing them is the most common cause of brittle tests.
View question - Intermediate
How do you reliably test async/concurrent code without flaky sleeps?
Fixed sleeps in tests are a coin flip that wastes time on fast machines and fails on slow ones — virtual clocks and deterministic polling replace the guess with an actual guarantee.
View question - Intermediate
What does a real load/performance testing methodology look like — what do you actually measure and how do you design the test?
Load testing isn't 'hit the API a lot and see what happens' — it's a designed ramp with explicit pass/fail targets, tail-latency percentiles, and a careful eye on the workload model itself.
View question - Advanced
What does chaos and resilience testing look like when it's baked into CI instead of a one-off game day?
GameDays prove resilience once a quarter; chaos-in-CI proves it on every commit, automatically, with a steady-state hypothesis, a blast radius, and a rollback.
View question - Intermediate
How do you test database-dependent code — real test containers, mocks, or an in-memory database?
Mocks are fast but test your assumptions, in-memory databases quietly diverge from the real engine, and Testcontainers gives you the real thing, hermetically, in CI.
View question - Advanced
What does 'testing in production' actually mean — canary analysis, feature flags, and shadow traffic?
It isn't skipping tests — it's mirroring real requests to a new version, comparing golden signals statistically, and controlling exposure with an instant kill switch.
View question - Intermediate
You've got a flaky test — walk through your actual triage process to find and fix the root cause
Flaky tests are bug reports in disguise — real triage isolates order, parallelism, and timing until the shared state or race condition behind it is exposed.
View question - Advanced
You're starting a brand-new microservice — design its testing strategy from scratch
The flagship, closing question of this course: unit, contract, integration, end-to-end, load, and testing-in-production, tied together into one pipeline from first commit to production.
View question