Reference material

Interview

The questions that actually get asked, sorted by level and topic. Each one carries what the interviewer is really testing, a short answer you could say out loud, the reasoning underneath, and sources you can check yourself.

101questions

12topics

4levels

12simulations

Reference material, not an answer key. Read it to understand the question, then answer with your own examples.

JavaScript & TypeScript

What's the difference between `var`, `let` and `const`?

Scope, hoisting and reassignment. The part people get wrong: `const` does not mean immutable.

Fresher3 min

Java & JVM

Why must you override `hashCode()` whenever you override `equals()`?

Skipping `hashCode` compiles fine. It just makes objects vanish from the `HashMap` you just put them in.

Fresher4 min

Databases

What's the difference between INNER JOIN, LEFT JOIN and FULL OUTER JOIN?

The classic opener. The points aren't in the definition — they're in how a misplaced WHERE turns a LEFT JOIN back into an INNER JOIN.

Fresher3 min

API & Backend

What's the difference between 401 and 403, and when is 404 the right answer?

401 means "I don't know who you are", 403 means "I know, and no". Sometimes 404 is a security decision.

Fresher4 min

Frontend & React

What does `box-sizing: border-box` change, and why does nearly every project set it?

It decides whether `width: 300px` means 300px, or 300px plus padding plus border.

Fresher3 min

System Design

Explain the CAP theorem. Why is PACELC more useful in practice?

CAP only describes the partitioned case — 0.01% of the time. PACELC also describes the other 99.99%.

Mid7 minInteractive

Concurrency & Distributed

What is a race condition? Give one you've actually hit.

The outcome depends on an ordering you don't control. The real example matters more than the definition.

Junior4 min

Performance

Why is average latency useless, and what does p99 actually mean?

The average hides precisely the users having a bad time. And a page's p99 isn't a request's p99.

Mid6 min

DevOps & Operations

Why does the order of instructions in a Dockerfile affect build time?

Each instruction is a cached layer, and changing one invalidates every layer after it.

Junior4 min

Security

How does SQL injection happen, and what's the only reliable defence?

The cause is mixing data into the statement. The defence is separating them — not escaping cleverly.

Junior5 min

Testing

What does the test pyramid say, and do you agree with it?

Many unit tests, few end-to-end ones. The interesting part is why — and when it's wrong.

Junior5 min

Algorithms & Data Structures

What is Big-O, and is O(1) always faster than O(n)?

It describes growth RATE, not speed. For small n, an O(n) routine regularly beats an O(1) one with a large constant.

Fresher4 min

JavaScript & TypeScript

How do `==` and `===` differ, and what does `NaN === NaN` return?

Coercion, plus the handful of cases where `===` doesn't behave the way you'd expect either.

Fresher3 min

Java & JVM

What does `String` immutability buy you, and how is `StringBuilder` different?

Immutability is a design decision with a security rationale, not a convenience. Concatenating in a loop is the direct consequence.

Fresher4 min

Databases

What does `NULL = NULL` return, and why?

Neither TRUE nor FALSE. Understanding three-valued logic is what explains why NOT IN against a subquery so often returns nothing.

Fresher3 min

API & Backend

A client POSTs to create an order, the network drops before the response arrives, and they retry. How do you avoid two orders?

An idempotency key. This shows up in almost every mid-or-above backend round, because it's the real problem in every payment system.

Mid7 min

Frontend & React

Why does React need `key`, and why is using the index dangerous?

Keys tell React which element is which across renders. An index tells it wrongly the moment the list reorders.

Junior4 min

System Design

Design a URL shortener.

The classic, because it's small enough to finish in 45 minutes while still touching key generation, caching and a lopsided read/write ratio.

Mid8 min

Concurrency & Distributed

A dependency starts failing. How should your client retry?

Retrying wrongly turns a small incident into a total one. Three mandatory ingredients: backoff, jitter, and a budget.

Mid7 minInteractive

Performance

What do the Core Web Vitals measure, and how do you fix a slow LCP?

Three metrics, three thresholds. And INP replaced FID in 2024 — much of the material online hasn't caught up.

Mid7 minInteractive

DevOps & Operations

Rolling, blue-green, canary — which do you choose and why?

Three ways to trade infrastructure cost against rollback speed against how much risk you expose.

Mid6 minInteractive

Security

How do you store user passwords correctly?

A SLOW salted hash, not SHA-256. And the slowness is the feature, not a defect.

Mid6 min

Testing

What do you mock in a test, and what don't you?

The pragmatic rule: mock what you don't own and what's slow. Over-mock and the test only verifies the mock.

Mid5 min

Algorithms & Data Structures

You need fast lookup by key AND ordered iteration. Which structure?

The real question is whether you know what a hash table gave up to reach O(1).

Mid6 min

JavaScript & TypeScript

Given a snippet with `setTimeout(…, 0)` and `Promise.resolve().then(…)`, what order do the logs print in?

The most-asked JavaScript question at every level. The crux: the microtask queue is DRAINED FULLY before the next macrotask runs.

Junior7 minInteractive

Java & JVM

How does `HashMap` work internally, and how are collisions handled?

A bucket array, a rehash, and one thing Java 8 changed: long buckets convert from a list to a red-black tree.

Junior6 min

Databases

The column has an index but the query still does a full scan. Why?

Four causes cover nearly every real case: a function wrapping the column, a leading wildcard, low selectivity, and the wrong column order in a composite index.

Junior6 minInteractive

API & Backend

How do you version an API, and what counts as a breaking change?

Three common approaches with different costs. The harder half is defining what "breaking" actually means.

Mid6 min

Frontend & React

What do you use `useEffect` for, and when should you not?

Effects synchronise with systems OUTSIDE React. Three in four effects I see in review shouldn't be there.

Mid7 min

System Design

When must you shard a database, and how do you choose the shard key?

Sharding is the least reversible decision there is. The wrong key means redoing all of it, and there's no fast way.

Senior7 min

Concurrency & Distributed

At-most-once, at-least-once, exactly-once — which of these is real?

The first two are real. The third exists in marketing, and exists technically only with a long list of conditions.

Senior8 min

Performance

Your manager says "the API is slow, make it faster". What do you do first?

Nothing yet. Ask "slow where, for whom, compared to what" — and that is the answer being scored.

Senior7 min

DevOps & Operations

How do logs, metrics and traces differ, and what do you use each for?

Three data sources answering three different questions. Mix them up and you spend money without learning anything.

Mid6 min

Security

JWT or server-side sessions — which, and how do you revoke a JWT?

The trap is in the second half. A JWT can't be revoked, and every workaround makes it behave like a session again.

Mid7 min

Testing

Your team has flaky tests and everyone just hits retry. How do you deal with it?

The problem isn't technical but one of trust. Once CI isn't believable, it does nothing at all.

Senior6 min

Algorithms & Data Structures

You're given a coding problem you've never seen. What do you do in the first five minutes?

Not write code. The interviewer scores how you narrow the problem, and they're scoring continuously rather than only at the end.

Mid6 min

JavaScript & TypeScript

What is a closure, and what have you actually used one for?

The definition is easy. The second half separates candidates — and closures are also a common memory-leak source.

Junior5 min

Java & JVM

Checked versus unchecked exceptions — which do you use, and when?

An opinionated question, so the interviewer cares more about the reasoning than the conclusion.

Junior5 min

Databases

What is ACID, and which letter is most misunderstood?

Four letters anyone can recite. The C is what separates candidates — it doesn't mean what it means in CAP.

Junior4 min

API & Backend

Which rate-limiting algorithm do you implement, and what's wrong with a fixed window?

A fixed window permits double the limit at the boundary. Token bucket and a sliding log fix it in two different ways.

Mid6 min

Frontend & React

When do `memo`, `useMemo` and `useCallback` actually help?

Less often than you think. Memoisation costs something too, and blanket wrapping usually makes code slightly slower and much harder to read.

Mid6 min

System Design

Design a system that notifies 10 million users within five minutes.

A fan-out problem. The crux isn't sending fast — it's not taking down yourself and your external providers.

Senior8 min

Concurrency & Distributed

You need exactly one instance running a job. Is a Redis distributed lock safe?

It's safe for efficiency, not for correctness. That distinction is the whole answer.

Senior7 min

Performance

Your JavaScript bundle is 2MB. How do you reduce it?

Analyse before cutting. Usually one or two libraries account for half of it, and both are replaceable.

Mid5 min

DevOps & Operations

A pod is in CrashLoopBackOff. In what order do you diagnose it?

One status, five quite different causes. The order you check in saves hours.

Senior7 min

Security

What's OWASP's number-one vulnerability, and where in the architecture do you defend against it?

Broken access control. It tops the list because it isn't one bug but a class that reappears with every new endpoint.

Senior7 min

Testing

You have a function that prices an order. Which tests do you write?

Not "one test for the happy path". The value is at the boundaries and in the combinations the author didn't think of.

Mid5 min

Algorithms & Data Structures

When do you use recursion, and when a loop?

Recursion wins when the problem itself is tree-shaped. Iteration wins when the call stack matters.

Junior4 min

JavaScript & TypeScript

How is `this` determined in JavaScript, and how do arrow functions differ?

Four rules, applied in precedence order. Arrow functions aren't in the list at all — they have no `this` of their own.

Junior5 min

Java & JVM

How is JVM memory laid out, and how does a generational collector work?

Heap, stack, metaspace, native. The generational hypothesis explains the layout — and why PermGen is gone.

Mid8 minInteractive

Databases

What does each of the four isolation levels prevent, and what are the defaults in Postgres and MySQL?

The single most discriminating question in this track. Everyone remembers the four-row table; very few know the two engines default differently.

Mid8 minInteractive

API & Backend

You need to write to the database AND publish a message. How do you keep the two from diverging?

The dual-write problem. You can't make two systems atomic, so the answer is not to try — use an outbox.

Senior8 min

Frontend & React

How do SSR, CSR, SSG and ISR differ, and what is a hydration mismatch?

Four answers to one question: where and when is the HTML built? Hydration is where the two worlds must agree.

Mid6 min

System Design

Microservices or a monolith for a new product?

Almost always the monolith first. Microservices solve an ORGANISATIONAL problem, and an eight-person team doesn't have one yet.

Mid7 min

Concurrency & Distributed

How many threads should a pool have?

It depends on the ratio of WAITING to COMPUTING. The two kinds of work give wildly different numbers.

Mid6 min

Performance

A query takes eight seconds. In what order do you attack it?

There's a clearly effective order, and adding an index isn't the first step.

Senior7 minInteractive

DevOps & Operations

Design a CI/CD pipeline for a team of eight. Which steps are non-negotiable?

A trade-off question between feedback speed and confidence. A 40-minute pipeline is one people find ways around.

Mid6 min

Security

A library you depend on gets a critical CVE at 2am. What's your process?

A question about preparation rather than reaction. If you don't know what you're running, every reaction is slow.

Senior6 min

Testing

What does 90% code coverage tell you?

That 90% of lines were EXECUTED. Not that they were verified — those are different claims.

Mid5 min

Algorithms & Data Structures

Which sort does a standard library use, and why not plain quicksort?

No serious library uses a single algorithm. They hybridise — and the reason for hybridising is the answer.

Mid6 min

JavaScript & TypeScript

`Promise.all`, `allSettled`, `race`, `any` — which for which situation?

Four functions that look alike and handle failure completely differently. Pick wrong and you either lose data or leak requests.

Mid6 min

Java & JVM

How do `volatile` and `synchronized` differ, and when is `volatile` enough?

One guarantees visibility, the other visibility plus atomicity. Confusing them produces races nobody can reproduce.

Mid7 min

Databases

What is an N+1 query, and how do you detect one in a running project?

Everyone can define it. The discriminating half is the second one: how do you catch it when every individual query is fast?

Mid5 minInteractive

API & Backend

After each deploy a handful of requests return 502. Why, and how do you fix it?

The process dies before the load balancer notices. Fixed with the right shutdown order and a delay most people skip.

Senior7 min

Frontend & React

How do you make a custom component usable by keyboard and screen reader?

The first rule of ARIA is don't use ARIA. The right HTML element gives you nearly all of it for free.

Junior5 min

System Design

You're in a 45-minute system design round. Where do you start?

Not with architecture. The first four minutes are for narrowing the problem, and that's the most heavily scored part.

Junior6 min

Concurrency & Distributed

What conditions does a deadlock require, and which one do you break in practice?

Four conditions must hold at once. Breaking one suffices, and in practice you nearly always break the same one.

Mid5 min

Performance

The page is slow because of images. What do you do?

Four things in order of impact, and the first isn't compression — it's sending the right size.

Junior4 min

DevOps & Operations

Where should secrets — API keys, database passwords — live?

Not in git, and not merely in environment variables without thinking further.

Mid5 min

Security

What does HTTPS protect against, and what doesn't it?

Three guarantees on the wire. It says nothing about whether the server is trustworthy or the data is correct.

Junior4 min

Testing

How do you test asynchronous and time-dependent code?

By removing real time from the test entirely. Every `sleep` in a test is a promise to flake later.

Mid5 min

Algorithms & Data Structures

An endpoint accepts arbitrary JSON and puts it in a map. Where's the risk?

The attacker chooses the keys, so they can choose collisions — turning O(1) into O(n), and one request into an incident.

Senior6 min

JavaScript & TypeScript

How do `any` and `unknown` differ, and why should `as` be rationed?

Both accept any value. Only one forces you to check before using it — and that's the entire difference.

Mid6 min

Java & JVM

The Stream API — what does laziness mean, and when does `parallelStream()` backfire?

A stream does nothing until a terminal operation runs. And `parallelStream()` is almost always a trap in a web application.

Mid6 min

Databases

Why is `OFFSET 100000 LIMIT 20` slow, and what do you replace it with?

OFFSET has to walk every row it skips. Keyset pagination stays flat at any depth — and fixes duplicate rows as a bonus.

Mid5 min

API & Backend

REST, gRPC or GraphQL — how do you choose for a new service?

An open question whose good answers start with "who's the client" rather than with feature lists.

Mid6 min

Frontend & React

How do you choose state management for a medium-sized application?

Good answers start by classifying the state, not by naming a library.

Senior6 min

Concurrency & Distributed

An order needs stock, payment and shipping across three services. What if step two fails?

There's no shared transaction, so there's no rollback. You COMPENSATE — and compensating isn't undoing.

Senior7 min

Performance

What `Cache-Control` do you set for HTML, for hashed JS, and for an avatar?

Three quite different answers, and knowing why they differ matters more than remembering the syntax.

Mid5 min

DevOps & Operations

Where does configuration that differs between dev, staging and production live?

In the environment, not in the code. The test: could you open-source the repo right now without leaking anything?

Junior4 min

Security

What's the difference between OAuth 2.0 and OpenID Connect?

One is authorisation, the other authentication. Using OAuth to log people in is the field's most common misunderstanding.

Mid6 min

Testing

You have to change an 800-line function with no tests. Where do you start?

By pinning the CURRENT behaviour first, even where it's wrong. You can't refactor what you can't describe.

Senior6 min

Algorithms & Data Structures

The code is O(n²) but n is always under 50. Do you optimise it?

No. But the good answer doesn't stop at no — it names the condition that would change the answer.

Junior4 min

JavaScript & TypeScript

An SPA's memory grows over a few hours and the tab gets sluggish. How do you find the cause?

Four leak sources cover nearly all real cases, and there's a concrete measurement loop that beats guessing.

Senior7 min

Java & JVM

What did virtual threads change, and what do they not solve?

They make blocking code cheap again. They don't make the CPU faster, and they break a few old assumptions about pools.

Senior8 min

Databases

Optimistic or pessimistic locking — which, and on what basis?

Not a preference question. It turns on the probability of contention and the cost of redoing the work.

Mid6 min

API & Backend

You put Redis in front of the database. How do you invalidate it correctly?

Three strategies, and the real trap is the stampede when a hot key expires.

Senior7 minInteractive

Frontend & React

Does React protect you from XSS automatically?

Mostly yes, thanks to default escaping. But there are four escape hatches React doesn't guard.

Mid6 min

Concurrency & Distributed

Two people edit the same document at once. How do you handle it?

Four approaches, and the right one depends on how bad it is to lose an edit.

Mid6 min

Performance

How do you stop performance degrading one deploy at a time?

Nobody makes a page slow on purpose. It degrades 3% per PR, and without an automated threshold nobody notices.

Senior6 min

DevOps & Operations

Beyond automation, why is Terraform better than clicking in a console?

Because infrastructure becomes REVIEWABLE and REBUILDABLE. The automation is a side effect.

Mid5 min

Security

Do you validate input on the client or the server?

Both, for entirely different reasons. Confusing the reasons is where a class of vulnerability comes from.

Junior4 min

JavaScript & TypeScript

How do ESM and CommonJS differ, and why is mixing them so painful?

The root difference: ESM resolves statically before execution, CJS resolves dynamically at runtime. Every other pain follows from that.

Mid5 min

Java & JVM

A Java service in production suddenly pegs the CPU at 100%. What do you do in the first ten minutes?

An operations question, not a theory question. It measures whether you've actually been there.

Senior8 min

Databases

Rename a column on a live 200-million-row table with no downtime. How?

Not a question about ALTER syntax. It measures whether you know that deploys and migrations are two separate things.

Senior8 min

API & Backend

Design an image upload flow. Does the file go through your server?

Almost always no. A presigned URL lets the client write straight to object storage; the server only authorises and records.

Junior5 min

DevOps & Operations

The incident is over. What goes into your postmortem?

No blame on a person. What you're looking for is which system let an ordinary action have that consequence.

Senior6 min

JavaScript & TypeScript

How does the prototype chain work, and what is a JavaScript `class` really?

`class` is syntax over prototypal inheritance. Understanding the lookup chain explains why adding to `Array.prototype` breaks unrelated libraries.

Mid5 min

Databases

After adding a read replica, users save their profile, reload, and see the old data. What do you do?

Read-your-writes is broken. There are four fixes, and the popular one — "just read the primary" — throws away the reason you added the replica.

Senior7 minInteractive

Databases

The app is throwing "too many connections". Do you raise the pool size or lower it?

Almost always lower. It's a counter-intuitive trap that measures whether you understand queueing or only configuration.

Senior6 min

Databases

When would you choose NoSQL over Postgres?

An open question that reveals whether you pick technology from the problem or from fashion. Good answers start with query shape.

Mid6 min

Loading…

Reference material

Interview

101questions

12topics

4levels

12simulations

Reference material, not an answer key. Read it to understand the question, then answer with your own examples.

JavaScript & TypeScript

What's the difference between `var`, `let` and `const`?

Scope, hoisting and reassignment. The part people get wrong: `const` does not mean immutable.

Fresher3 min

Java & JVM

Why must you override `hashCode()` whenever you override `equals()`?

Skipping `hashCode` compiles fine. It just makes objects vanish from the `HashMap` you just put them in.

Fresher4 min

Databases

What's the difference between INNER JOIN, LEFT JOIN and FULL OUTER JOIN?

The classic opener. The points aren't in the definition — they're in how a misplaced WHERE turns a LEFT JOIN back into an INNER JOIN.

Fresher3 min

API & Backend

What's the difference between 401 and 403, and when is 404 the right answer?

401 means "I don't know who you are", 403 means "I know, and no". Sometimes 404 is a security decision.

Fresher4 min

Frontend & React

What does `box-sizing: border-box` change, and why does nearly every project set it?

It decides whether `width: 300px` means 300px, or 300px plus padding plus border.

Fresher3 min

System Design

Explain the CAP theorem. Why is PACELC more useful in practice?

CAP only describes the partitioned case — 0.01% of the time. PACELC also describes the other 99.99%.

Mid7 minInteractive

Concurrency & Distributed

What is a race condition? Give one you've actually hit.

The outcome depends on an ordering you don't control. The real example matters more than the definition.

Junior4 min

Performance

Why is average latency useless, and what does p99 actually mean?

The average hides precisely the users having a bad time. And a page's p99 isn't a request's p99.

Mid6 min

DevOps & Operations

Why does the order of instructions in a Dockerfile affect build time?

Each instruction is a cached layer, and changing one invalidates every layer after it.

Junior4 min

Security

How does SQL injection happen, and what's the only reliable defence?

The cause is mixing data into the statement. The defence is separating them — not escaping cleverly.

Junior5 min

Testing

What does the test pyramid say, and do you agree with it?

Many unit tests, few end-to-end ones. The interesting part is why — and when it's wrong.

Junior5 min

Algorithms & Data Structures

What is Big-O, and is O(1) always faster than O(n)?

It describes growth RATE, not speed. For small n, an O(n) routine regularly beats an O(1) one with a large constant.

Fresher4 min

JavaScript & TypeScript

How do `==` and `===` differ, and what does `NaN === NaN` return?

Coercion, plus the handful of cases where `===` doesn't behave the way you'd expect either.

Fresher3 min

Java & JVM

What does `String` immutability buy you, and how is `StringBuilder` different?

Immutability is a design decision with a security rationale, not a convenience. Concatenating in a loop is the direct consequence.

Fresher4 min

Databases

What does `NULL = NULL` return, and why?

Neither TRUE nor FALSE. Understanding three-valued logic is what explains why NOT IN against a subquery so often returns nothing.

Fresher3 min

API & Backend

A client POSTs to create an order, the network drops before the response arrives, and they retry. How do you avoid two orders?

An idempotency key. This shows up in almost every mid-or-above backend round, because it's the real problem in every payment system.

Mid7 min

Frontend & React

Why does React need `key`, and why is using the index dangerous?

Keys tell React which element is which across renders. An index tells it wrongly the moment the list reorders.

Junior4 min

System Design

Design a URL shortener.

The classic, because it's small enough to finish in 45 minutes while still touching key generation, caching and a lopsided read/write ratio.

Mid8 min

Concurrency & Distributed

A dependency starts failing. How should your client retry?

Retrying wrongly turns a small incident into a total one. Three mandatory ingredients: backoff, jitter, and a budget.

Mid7 minInteractive

Performance

What do the Core Web Vitals measure, and how do you fix a slow LCP?

Three metrics, three thresholds. And INP replaced FID in 2024 — much of the material online hasn't caught up.

Mid7 minInteractive

DevOps & Operations

Rolling, blue-green, canary — which do you choose and why?

Three ways to trade infrastructure cost against rollback speed against how much risk you expose.

Mid6 minInteractive

Security

How do you store user passwords correctly?

A SLOW salted hash, not SHA-256. And the slowness is the feature, not a defect.

Mid6 min

Testing

What do you mock in a test, and what don't you?

The pragmatic rule: mock what you don't own and what's slow. Over-mock and the test only verifies the mock.

Mid5 min

Algorithms & Data Structures

You need fast lookup by key AND ordered iteration. Which structure?

The real question is whether you know what a hash table gave up to reach O(1).

Mid6 min

JavaScript & TypeScript

Given a snippet with `setTimeout(…, 0)` and `Promise.resolve().then(…)`, what order do the logs print in?

The most-asked JavaScript question at every level. The crux: the microtask queue is DRAINED FULLY before the next macrotask runs.

Junior7 minInteractive

Java & JVM

How does `HashMap` work internally, and how are collisions handled?

A bucket array, a rehash, and one thing Java 8 changed: long buckets convert from a list to a red-black tree.

Junior6 min

Databases

The column has an index but the query still does a full scan. Why?

Four causes cover nearly every real case: a function wrapping the column, a leading wildcard, low selectivity, and the wrong column order in a composite index.

Junior6 minInteractive

API & Backend

How do you version an API, and what counts as a breaking change?

Three common approaches with different costs. The harder half is defining what "breaking" actually means.

Mid6 min

Frontend & React

What do you use `useEffect` for, and when should you not?

Effects synchronise with systems OUTSIDE React. Three in four effects I see in review shouldn't be there.

Mid7 min

System Design

When must you shard a database, and how do you choose the shard key?

Sharding is the least reversible decision there is. The wrong key means redoing all of it, and there's no fast way.

Senior7 min

Concurrency & Distributed

At-most-once, at-least-once, exactly-once — which of these is real?

The first two are real. The third exists in marketing, and exists technically only with a long list of conditions.

Senior8 min

Performance

Your manager says "the API is slow, make it faster". What do you do first?

Nothing yet. Ask "slow where, for whom, compared to what" — and that is the answer being scored.

Senior7 min

DevOps & Operations

How do logs, metrics and traces differ, and what do you use each for?

Three data sources answering three different questions. Mix them up and you spend money without learning anything.

Mid6 min

Security

JWT or server-side sessions — which, and how do you revoke a JWT?

The trap is in the second half. A JWT can't be revoked, and every workaround makes it behave like a session again.

Mid7 min

Testing

Your team has flaky tests and everyone just hits retry. How do you deal with it?

The problem isn't technical but one of trust. Once CI isn't believable, it does nothing at all.

Senior6 min

Algorithms & Data Structures

You're given a coding problem you've never seen. What do you do in the first five minutes?

Not write code. The interviewer scores how you narrow the problem, and they're scoring continuously rather than only at the end.

Mid6 min

JavaScript & TypeScript

What is a closure, and what have you actually used one for?

The definition is easy. The second half separates candidates — and closures are also a common memory-leak source.

Junior5 min

Java & JVM

Checked versus unchecked exceptions — which do you use, and when?

An opinionated question, so the interviewer cares more about the reasoning than the conclusion.

Junior5 min

Databases

What is ACID, and which letter is most misunderstood?

Four letters anyone can recite. The C is what separates candidates — it doesn't mean what it means in CAP.

Junior4 min

API & Backend

Which rate-limiting algorithm do you implement, and what's wrong with a fixed window?

A fixed window permits double the limit at the boundary. Token bucket and a sliding log fix it in two different ways.

Mid6 min

Frontend & React

When do `memo`, `useMemo` and `useCallback` actually help?

Less often than you think. Memoisation costs something too, and blanket wrapping usually makes code slightly slower and much harder to read.

Mid6 min

System Design

Design a system that notifies 10 million users within five minutes.

A fan-out problem. The crux isn't sending fast — it's not taking down yourself and your external providers.

Senior8 min

Concurrency & Distributed

You need exactly one instance running a job. Is a Redis distributed lock safe?

It's safe for efficiency, not for correctness. That distinction is the whole answer.

Senior7 min

Performance

Your JavaScript bundle is 2MB. How do you reduce it?

Analyse before cutting. Usually one or two libraries account for half of it, and both are replaceable.

Mid5 min

DevOps & Operations

A pod is in CrashLoopBackOff. In what order do you diagnose it?

One status, five quite different causes. The order you check in saves hours.

Senior7 min

Security

What's OWASP's number-one vulnerability, and where in the architecture do you defend against it?

Broken access control. It tops the list because it isn't one bug but a class that reappears with every new endpoint.

Senior7 min

Testing

You have a function that prices an order. Which tests do you write?

Not "one test for the happy path". The value is at the boundaries and in the combinations the author didn't think of.

Mid5 min

Algorithms & Data Structures

When do you use recursion, and when a loop?

Recursion wins when the problem itself is tree-shaped. Iteration wins when the call stack matters.

Junior4 min

JavaScript & TypeScript

How is `this` determined in JavaScript, and how do arrow functions differ?

Four rules, applied in precedence order. Arrow functions aren't in the list at all — they have no `this` of their own.

Junior5 min

Java & JVM

How is JVM memory laid out, and how does a generational collector work?

Heap, stack, metaspace, native. The generational hypothesis explains the layout — and why PermGen is gone.

Mid8 minInteractive

Databases

What does each of the four isolation levels prevent, and what are the defaults in Postgres and MySQL?

The single most discriminating question in this track. Everyone remembers the four-row table; very few know the two engines default differently.

Mid8 minInteractive

API & Backend

You need to write to the database AND publish a message. How do you keep the two from diverging?

The dual-write problem. You can't make two systems atomic, so the answer is not to try — use an outbox.

Senior8 min

Frontend & React

How do SSR, CSR, SSG and ISR differ, and what is a hydration mismatch?

Four answers to one question: where and when is the HTML built? Hydration is where the two worlds must agree.

Mid6 min

System Design

Microservices or a monolith for a new product?

Almost always the monolith first. Microservices solve an ORGANISATIONAL problem, and an eight-person team doesn't have one yet.

Mid7 min

Concurrency & Distributed

How many threads should a pool have?

It depends on the ratio of WAITING to COMPUTING. The two kinds of work give wildly different numbers.

Mid6 min

Performance

A query takes eight seconds. In what order do you attack it?

There's a clearly effective order, and adding an index isn't the first step.

Senior7 minInteractive

DevOps & Operations

Design a CI/CD pipeline for a team of eight. Which steps are non-negotiable?

A trade-off question between feedback speed and confidence. A 40-minute pipeline is one people find ways around.

Mid6 min

Security

A library you depend on gets a critical CVE at 2am. What's your process?

A question about preparation rather than reaction. If you don't know what you're running, every reaction is slow.

Senior6 min

Testing

What does 90% code coverage tell you?

That 90% of lines were EXECUTED. Not that they were verified — those are different claims.

Mid5 min

Algorithms & Data Structures

Which sort does a standard library use, and why not plain quicksort?

No serious library uses a single algorithm. They hybridise — and the reason for hybridising is the answer.

Mid6 min

JavaScript & TypeScript

`Promise.all`, `allSettled`, `race`, `any` — which for which situation?

Four functions that look alike and handle failure completely differently. Pick wrong and you either lose data or leak requests.

Mid6 min

Java & JVM

How do `volatile` and `synchronized` differ, and when is `volatile` enough?

One guarantees visibility, the other visibility plus atomicity. Confusing them produces races nobody can reproduce.

Mid7 min

Databases

What is an N+1 query, and how do you detect one in a running project?

Everyone can define it. The discriminating half is the second one: how do you catch it when every individual query is fast?

Mid5 minInteractive

API & Backend

After each deploy a handful of requests return 502. Why, and how do you fix it?

The process dies before the load balancer notices. Fixed with the right shutdown order and a delay most people skip.

Senior7 min

Frontend & React

How do you make a custom component usable by keyboard and screen reader?

The first rule of ARIA is don't use ARIA. The right HTML element gives you nearly all of it for free.

Junior5 min

System Design

You're in a 45-minute system design round. Where do you start?

Not with architecture. The first four minutes are for narrowing the problem, and that's the most heavily scored part.

Junior6 min

Concurrency & Distributed

What conditions does a deadlock require, and which one do you break in practice?

Four conditions must hold at once. Breaking one suffices, and in practice you nearly always break the same one.

Mid5 min

Performance

The page is slow because of images. What do you do?

Four things in order of impact, and the first isn't compression — it's sending the right size.

Junior4 min

DevOps & Operations

Where should secrets — API keys, database passwords — live?

Not in git, and not merely in environment variables without thinking further.

Mid5 min

Security

What does HTTPS protect against, and what doesn't it?

Three guarantees on the wire. It says nothing about whether the server is trustworthy or the data is correct.

Junior4 min

Testing

How do you test asynchronous and time-dependent code?

By removing real time from the test entirely. Every `sleep` in a test is a promise to flake later.

Mid5 min

Algorithms & Data Structures

An endpoint accepts arbitrary JSON and puts it in a map. Where's the risk?

The attacker chooses the keys, so they can choose collisions — turning O(1) into O(n), and one request into an incident.

Senior6 min

JavaScript & TypeScript

How do `any` and `unknown` differ, and why should `as` be rationed?

Both accept any value. Only one forces you to check before using it — and that's the entire difference.

Mid6 min

Java & JVM

The Stream API — what does laziness mean, and when does `parallelStream()` backfire?

A stream does nothing until a terminal operation runs. And `parallelStream()` is almost always a trap in a web application.

Mid6 min

Databases

Why is `OFFSET 100000 LIMIT 20` slow, and what do you replace it with?

OFFSET has to walk every row it skips. Keyset pagination stays flat at any depth — and fixes duplicate rows as a bonus.

Mid5 min

API & Backend

REST, gRPC or GraphQL — how do you choose for a new service?

An open question whose good answers start with "who's the client" rather than with feature lists.

Mid6 min

Frontend & React

How do you choose state management for a medium-sized application?

Good answers start by classifying the state, not by naming a library.

Senior6 min

Concurrency & Distributed

An order needs stock, payment and shipping across three services. What if step two fails?

There's no shared transaction, so there's no rollback. You COMPENSATE — and compensating isn't undoing.

Senior7 min

Performance

What `Cache-Control` do you set for HTML, for hashed JS, and for an avatar?

Three quite different answers, and knowing why they differ matters more than remembering the syntax.

Mid5 min

DevOps & Operations

Where does configuration that differs between dev, staging and production live?

In the environment, not in the code. The test: could you open-source the repo right now without leaking anything?

Junior4 min

Security

What's the difference between OAuth 2.0 and OpenID Connect?

One is authorisation, the other authentication. Using OAuth to log people in is the field's most common misunderstanding.

Mid6 min

Testing

You have to change an 800-line function with no tests. Where do you start?

By pinning the CURRENT behaviour first, even where it's wrong. You can't refactor what you can't describe.

Senior6 min

Algorithms & Data Structures

The code is O(n²) but n is always under 50. Do you optimise it?

No. But the good answer doesn't stop at no — it names the condition that would change the answer.

Junior4 min

JavaScript & TypeScript

An SPA's memory grows over a few hours and the tab gets sluggish. How do you find the cause?

Four leak sources cover nearly all real cases, and there's a concrete measurement loop that beats guessing.

Senior7 min

Java & JVM

What did virtual threads change, and what do they not solve?

They make blocking code cheap again. They don't make the CPU faster, and they break a few old assumptions about pools.

Senior8 min

Databases

Optimistic or pessimistic locking — which, and on what basis?

Not a preference question. It turns on the probability of contention and the cost of redoing the work.

Mid6 min

API & Backend

You put Redis in front of the database. How do you invalidate it correctly?

Three strategies, and the real trap is the stampede when a hot key expires.

Senior7 minInteractive

Frontend & React

Does React protect you from XSS automatically?

Mostly yes, thanks to default escaping. But there are four escape hatches React doesn't guard.

Mid6 min

Concurrency & Distributed

Two people edit the same document at once. How do you handle it?

Four approaches, and the right one depends on how bad it is to lose an edit.

Mid6 min

Performance

How do you stop performance degrading one deploy at a time?

Nobody makes a page slow on purpose. It degrades 3% per PR, and without an automated threshold nobody notices.

Senior6 min

DevOps & Operations

Beyond automation, why is Terraform better than clicking in a console?

Because infrastructure becomes REVIEWABLE and REBUILDABLE. The automation is a side effect.

Mid5 min

Security

Do you validate input on the client or the server?

Both, for entirely different reasons. Confusing the reasons is where a class of vulnerability comes from.

Junior4 min

JavaScript & TypeScript

How do ESM and CommonJS differ, and why is mixing them so painful?

The root difference: ESM resolves statically before execution, CJS resolves dynamically at runtime. Every other pain follows from that.

Mid5 min

Java & JVM

A Java service in production suddenly pegs the CPU at 100%. What do you do in the first ten minutes?

An operations question, not a theory question. It measures whether you've actually been there.

Senior8 min

Databases

Rename a column on a live 200-million-row table with no downtime. How?

Not a question about ALTER syntax. It measures whether you know that deploys and migrations are two separate things.

Senior8 min

API & Backend

Design an image upload flow. Does the file go through your server?

Almost always no. A presigned URL lets the client write straight to object storage; the server only authorises and records.

Junior5 min

DevOps & Operations

The incident is over. What goes into your postmortem?

No blame on a person. What you're looking for is which system let an ordinary action have that consequence.

Senior6 min

JavaScript & TypeScript

How does the prototype chain work, and what is a JavaScript `class` really?

`class` is syntax over prototypal inheritance. Understanding the lookup chain explains why adding to `Array.prototype` breaks unrelated libraries.

Mid5 min

Databases

After adding a read replica, users save their profile, reload, and see the old data. What do you do?

Read-your-writes is broken. There are four fixes, and the popular one — "just read the primary" — throws away the reason you added the replica.

Senior7 minInteractive

Databases

The app is throwing "too many connections". Do you raise the pool size or lower it?

Almost always lower. It's a counter-intuitive trap that measures whether you understand queueing or only configuration.

Senior6 min

Databases

When would you choose NoSQL over Postgres?

An open question that reveals whether you pick technology from the problem or from fashion. Good answers start with query shape.

Mid6 min