104 Backend Essentials interview questions with answers
104 Backend Essentials interview questions with detailed answers, sorted from basic to advanced. Free to practice, with progress saved automatically.
All Backend Essentials interview questions
How do unit, integration, and e2e tests differ, and how should you balance them?
What are test doubles — mock, stub, spy, fake — and how do they differ?
What is Dependency Injection (DI)? What are the types of DI and what frameworks support it?
What is RabbitMQ and why would you use it?
What are the four main exchange types in RabbitMQ?
How do you handle message failures and retries in RabbitMQ?
Merge vs Rebase: when to use which? Explain the golden rule of rebasing.
Merging a feature branch into main, you hit a conflict where both sides refactored the same file. What is the safe resolution process?
Undoing a public commit already merged into main: revert vs reset — when to use which?
What is REST? What principles make an API RESTful?
What is idempotency? Which HTTP methods are idempotent?
What are the HTTP status code classes and what do they mean?
What are the ways to version an API and their trade-offs?
SQL vs NoSQL — what is the difference and when to use each?
How does a database index work and why does it speed up queries?
What is ACID? What are the transaction isolation levels and the anomalies they prevent?
What caching strategies (cache-aside, write-through) exist and how do you invalidate a cache?
What is the CAP theorem?
What is SQL injection and how do you prevent it?
Authentication vs authorization — and how does a server verify a JWT?
Compare REST, GraphQL, and gRPC — when to choose each?
WebSocket vs SSE vs long-polling — how do they differ and when to use each?
What is a webhook and what should you watch for when receiving one?
What are normalization and denormalization, and what is the trade-off?
What is a deadlock, what causes it, and how do you avoid it?
What is an ORM and what are its pros and cons?
What is the difference between a reverse proxy and an API gateway?
What is eventual consistency and how does it trade off against strong consistency?
What do the circuit breaker and retry-with-exponential-backoff patterns solve?
Why should a service be stateless to scale horizontally?
What are health checks and graceful shutdown, and why are they needed?
What is observability, and how do logs, metrics, and traces differ?
How do you store passwords correctly, and how does hashing differ from encryption?
How does HTTPS/TLS work, and what happens in the handshake?
What is CORS and how do you configure it correctly on the server?
What is the OWASP Top 10, and what are some key risks plus secrets management?
What is a database transaction? How do BEGIN/COMMIT/ROLLBACK work?
How do you optimize a slow query? What is EXPLAIN for?
What makes a safe (zero-downtime) database migration strategy?
How do partitions and consumer groups work in Kafka?
What is a dead letter queue (DLQ) and when is it used?
RBAC vs ABAC — what is the difference and when to choose each?
Input validation vs sanitization — what is the difference and why does it matter?
Blue-green vs canary deployment — what is the difference?
What is a race condition in a backend system, and how do you prevent it?
Blocking vs non-blocking I/O — what is the difference, and how does a server handle many concurrent requests?
OAuth2 from the server side: what are the four roles, how do the main grant types differ, and why was the password grant deprecated?
How do you design good API error responses?
What is middleware in a web framework? Why does middleware order matter?
How do containers differ from virtual machines, and what problem does Docker solve?
Primary key vs foreign key — what is the difference, and what is referential integrity?
What is a CDN and why use one?
Session-based vs token-based (JWT) authentication — how do they differ?
What is connection pooling and why does it matter?
How does HTTP caching work? What are Cache-Control, ETag, and 304 for?
What is CSRF and how do you prevent it?
Synchronous vs asynchronous processing — what is the difference and when should you go async?
Message queue (point-to-point) vs pub/sub — what is the difference?
How do HTTP/1.1, HTTP/2, and HTTP/3 differ?
Vertical vs horizontal scaling — what is the difference and the trade-offs?
What is CI/CD? How do continuous integration, delivery, and deployment differ?
What is database replication? Sync vs async replication, and what is replication lag?
What is database sharding? How does it differ from replication and partitioning, and what are the challenges?
What is consistent hashing and what problem does it solve?
What is a Bloom filter and what is it used for in backend systems?
What is two-phase commit (2PC), and why is it often avoided at scale?
What is a distributed lock? Why is an in-process mutex not enough, and how does Redis do it?
How would you design a refresh token flow? Where do you store tokens safely?
How would you design end-to-end Google (OAuth2) login from start to finish?
How would you design a secure password reset flow?
Session or JWT? Which would you choose for a specific app and why?
How would you protect the login page against brute-force / credential guessing?
With stateless JWT, how do you log out / revoke a token before it expires?
Where do you store a token on the client: httpOnly cookie, localStorage, or in-memory?
How would you design an upload flow for large files (hundreds of MB)?
How would you design an image upload flow with resize/optimization served over a CDN?
How would you defend against malicious file uploads?
How would you design a resumable/chunked upload with a progress bar?
Where do you store files: object storage, in the DB, or on the filesystem? How do you choose?
How would you design a payment flow through an external gateway (Stripe/SePay) and handle webhooks so you neither lose money nor credit an order twice?
After a user signs up you need to send a welcome email — how do you handle sending email/notifications: inline in the request or through a queue?
How would you build realtime notifications (red dot, new message) with WebSocket, and how do you scale it across multiple server instances?
Design a list API with filter + sort + pagination over a table with millions of rows — do you use offset or cursor? What pitfalls do you avoid?
A user double-clicks "Place order", or the client retries on timeout — how do you ensure exactly one order is created?
A read-heavy endpoint (e.g. a product page) is slow — how do you add cache-aside with Redis, and handle invalidation and cache stampede?
A user clicks "Export CSV" but the data is hundreds of thousands of rows and the request times out. How do you redesign the export flow?
A public API is being hammered — how do you add rate limiting: which algorithm, keyed by what, what response, and where do you place it?
Design a flash sale flow: 100 units but 10,000 users hit Buy at once — how do you prevent overselling?
Explain the SQL JOIN types, and write a query using GROUP BY and HAVING — how does HAVING differ from WHERE?
What is the difference between PUT and PATCH, and how idempotent is each?
Soft delete vs hard delete — what is the difference, which do you pick, and how do you implement it?
How would you design the database schema for a ticket booking / order feature?
What is the N+1 query problem and how do you fix it?
What is Redis? What data types does it have and what is it used for?
How do TCP and UDP differ, and when do you use each?
What is DNS and how does name resolution work?
How do L4 and L7 load balancers differ, and what balancing algorithms exist?
Monolith vs microservices — what are the trade-offs and when to pick each?
How does the saga pattern handle distributed transactions across services?
When should microservices communicate synchronously (REST/gRPC) vs asynchronously (messaging)?
What are design patterns and what are the GoF categories?
What is the Singleton pattern and what are its drawbacks?
What problem do Factory Method (and Abstract Factory) solve?
What are the SOLID principles?
