Backend Core quiz — 38 questions with answers and explanations

Answer: A

GET, PUT and DELETE are idempotent: repeating the call leaves the same final state as calling it once. POST is not — each call creates a new record. PATCH depends on payload: setting status = "paid" is idempotent, while add 10 to balance is not. This property determines whether a client can safely retry on network failure.

Answer: D

201 Created, with a Location header pointing to the new resource and usually a body containing the created record. 200 is for reads or updates that return content, 204 for success with no body, and 202 only for requests that have been accepted but not yet processed.

Answer: B

SHA-256 is designed to be fast, so a GPU can try billions of combinations per second. bcrypt and Argon2 have tunable cost parameters and auto-generate a unique salt per record, making brute-force expensive and defeating rainbow tables. Argon2 is also memory-hard, which GPUs cannot cheaply parallelize.

Answer: C

Atomicity means a transaction is treated as an indivisible unit: either all statements take effect, or none do. This ensures a money transfer never stops in a state where the source account is debited but the destination is not credited, even if the application crashes midway.

Answer: D

An index is a separate sorted structure that lets the database find rows without scanning the whole table. In exchange, every insert, update or delete has to update that structure too, and it takes up space. So only index columns that actually appear in filter conditions, joins or sorts.

Answer: B

A queue decouples accepting work from doing work. The request returns immediately after enqueuing the job, so latency no longer depends on the email provider. If the provider fails, the worker retries on a schedule instead of failing the user's signup.

Answer: B

Structured logging turns each line into data with clearly defined fields, so collection, filtering, and aggregation happen immediately: count errors by endpoint, trace every line of a single request, and alert when latency crosses a threshold. String-concatenated logs force regex parsing, and every wording change breaks something.

Answer: A

The UI is only one of many ways to call the API: anyone can send requests directly with a command-line tool. Client-side validation is for fast user feedback, but server-side validation is the real constraint that protects the data. Without that second layer, every business rule can be bypassed.

Answer: C

PUT means full replacement: the body is the complete state the resource should have after the call, so omitted fields become empty. PATCH describes only the changes and leaves the rest untouched. A common bug is using PUT with a form that has only a few fields and accidentally wiping fields not shown.

Answer: D

401 means identity is not established: missing token, invalid signature, or expired — client should refresh or log in again. 403 means identity is known but the account is not allowed to do that — logging in again won't help. Returning the wrong code traps users in a login loop.

Answer: B

Client generates an Idempotency-Key per payment intent and sends it on every retry. Server stores the key with the result in a table with a unique constraint: new keys are processed normally, existing keys return the original response. This ensures one button click maps to exactly one transaction no matter how many network failures occur.

Answer: D

OFFSET 100000 forces the database to read and discard 100,000 rows, so deeper pages get slower. It also causes drift: a new record inserted at the top pushes the last item of page 1 onto page 2, causing duplicates or missing records. Cursor pagination anchors to the last row's value, avoiding both problems.

Answer: B

Breaking changes should be done via expand-then-contract: add the new field alongside the old one, write both, let clients migrate gradually, then remove the old field once metrics show no one uses it. Bumping the entire API version is only worth it when many things change at once.

Answer: C

Self-contained JWTs let every service verify the signature without querying a store, but the trade-off is no revocation: locking an account at 10:00 doesn't stop a token issued at 9:55 from working until it expires. Server-side sessions are the opposite — deleting one row revokes access immediately, but every request must read the store.

Answer: C

Access tokens appear in every call, passing through logs, proxies, and client-side code, so the chance of exposure is high — a short lifetime limits the damage. Refresh tokens are sent only to a single endpoint and can be stored in an HttpOnly cookie with a narrow path, so they can live long while remaining controllable and revocable at any time.

Answer: B

A token in localStorage can be read by any script on the page, so a single XSS flaw means losing the token. An HttpOnly cookie is unreachable from JavaScript, but the browser sends it automatically with every request, so CSRF must be mitigated with SameSite and an anti-forgery token. In practice, an HttpOnly cookie with Secure and SameSite is the better default choice.

Answer: D

This is an object-level authorization flaw: the system authenticates the caller and stops there, never checking whether the order belongs to them. The fix is to include the ownership condition directly in the query, e.g. where id = ? and user_id = ?, rather than filtering after fetching the data.

Answer: D

Fixed-minute counting has a boundary gap: 100 requests in the last second of one minute plus 100 in the first second of the next is 200 requests in two seconds yet still valid. A token bucket refills tokens steadily over time and allows spending a reserve, so it tolerates reasonable bursts while maintaining the correct average rate.

Answer: C

You fetch 50 posts with one query, then loop and issue one more query for each post's author: 51 database round trips in total. The fix is to collect the ids and fetch all authors in a single query using in, or use a join. With GraphQL, batch them with DataLoader within the same request.

Answer: A

A composite index is like a phone book sorted by last name then first name: looking up by last name, or by last name plus first name, is fast, but finding everyone with first name "An" without knowing the last name means flipping through the whole book. A query can only use the index if it covers columns from the first one onward, known as the leftmost prefix rule.

Answer: C

Each connection consumes memory and a processing slot on the database side, so exceeding what the machine can handle makes every query slower rather than just some of them waiting. The pool limits how many queries run in parallel and queues the rest — a controlled queue is always better than making the database contend for resources.

Answer: D

This is a read-then-write race condition. The cheapest and safest approach is not to bring the value back to the application to compute: write update accounts set balance = balance - 30 where id = ? and balance >= 30, then check the number of affected rows to know whether the balance was sufficient. The database locks the row during the update, so the two statements naturally serialize.

Answer: A

A transaction holds locks until commit, so a slow network call turns into long-held locks, a connection in the pool is occupied, and deadlocks become more likely. Also, a rollback cannot take back what has already been sent: the email is gone, the money is already deducted at the payment gateway, while the database data reverts to its previous state.

Answer: A

Cache-aside: the application checks the cache first, returning immediately on a hit; on a miss it reads the database, writes the result to the cache with a TTL, and returns it. On the write path it updates the database and deletes the related key, so the next read reloads it. The advantage is that only data someone actually reads takes up space in the cache.

Answer: A

Delete the relevant keys right in the write path, and keep a moderate TTL as a safety net for write paths that were missed or changes coming from outside. Read-heavy, write-rare is the ideal case: the delete cost is negligible, while the hit rate stays high most of the time.

Answer: A

The key is missing the tenant identifier, so the whole system shares one slot: if tenant A populates it first, tenant B gets A's data on a hit. This is a data leak, not just a display bug. The key must contain every factor that makes the result differ — tenant, user, language, filter parameters and schema version.

Answer: B

Services usually fail due to overload, so thousands of clients retrying immediately will keep it down. Backoff gradually increases the wait interval to give it room to recover, while jitter desynchronizes clients so they don't all come back at once and create a second wave.

Answer: D

A non-responsive service without a timeout will hold the caller's connections and resources indefinitely. Within minutes the pool is exhausted, queues fill up, and a failure in a downstream service cascades into a system-wide outage. A timeout turns "hang forever" into an explicit error to handle.

Answer: D

At-least-once means a message is guaranteed to arrive but may arrive multiple times: if a worker crashes after processing but before acking, the broker redelivers. The consumer must be idempotent — typically by storing processed message ids with a unique constraint, or by making operations set state instead of incrementing.

Answer: C

A message that can never be processed — malformed, referencing a deleted record — will fail and requeue forever and block messages behind it. After a few attempts, the broker moves it to a dead letter queue so the main flow can continue and humans have a place to inspect it.

Answer: B

Queue is a work-sharing model: multiple workers pull from it, each job goes to only one worker, so adding workers increases throughput. Pub/sub is a broadcast model: each subscriber gets a copy, so an "order created" event can simultaneously trigger sending email, updating inventory, and recording metrics without the publisher knowing who is listening.

Answer: A

A user action crosses many services and produces logs in many places. A correlation id is generated at the gateway, passed down in headers with every call, and written to every log line, so one filter rebuilds the entire path instead of guessing by timestamps.

Answer: D

Logs are read by many people, synced to third-party monitoring services, and retained for months. Logging the raw body means passwords, tokens, and card numbers land wherever access control is not equally strict. Filter against an allow-list of fields and mask the rest at the logging layer.

Answer: D

Liveness answers "can this process still be saved" — if broken, the platform restarts it. Readiness answers "should requests go here right now" — if broken, it is only pulled out of the load-balancer list and returns when healthy. Mixing the two up makes a temporary database issue restart the whole service.

Answer: A

The backend only issues a signed URL with a short expiry, and the data flows straight from the browser to object storage. The application server never receives 500 MB, never holds a connection open for minutes, and needs no temporary disk. Once the upload finishes, the client reports back so the backend can record it and start processing.

Answer: C

Recompute the HMAC signature over the exact raw body and compare with a constant-time function; check the timestamp header to block replays; and store processed event ids so a redelivery does not credit money twice. A webhook endpoint is a public door — everything entering must be treated as untrusted.

Answer: C

Accept the request, create a job record, push it to a queue, and return 202 with the id and a status-check path. The client polls or gets notified when it is done, then downloads the result from a separate URL. Holding a three-minute connection bets on the proxy, browser, and user network all surviving.

Answer: C

Secrets are injected at runtime from environment variables or a secret manager, while the repository only holds a template file listing variable names. Each environment then gets its own values, key rotation needs no code redeploy, and commit history never stores real values.