Top 30 Backend Interview Questions and Answers

30 questions. Pick an answer, or open “Show the answer” to read it.

Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.

1. Question 1 of 30

   What is the primary characteristic that distinguishes the Service Layer from the Web Layer?

   • aIt handles all direct database interactions and data persistence.
   • bIt defines application routes and manages the request/response cycle.
   • cIt is responsible for validating incoming user input and sanitizing data.
   • dIt contains the core business logic, independent of HTTP specifics.
   Show the answer

   Answer: d · It contains the core business logic, independent of HTTP specifics.

   The card explicitly states the Service Layer "contains the core business logic, orchestrating tasks without knowing about HTTP," highlighting its independence from the web protocol. Option B describes the primary function of the Web Layer, which is concerned with HTTP requests and responses.

   Read the full bite: Structuring Express Apps with Layered Architecture

2. Question 2 of 30

   What is the most reliable method for confirming an email address is both deliverable and actually controlled by a user?

   • aImplementing strict real-time validation checks exclusively on the frontend.
   • bPerforming a synchronous DNS lookup to check for the domain's MX records.
   • cValidating the format using a comprehensive, RFC 5322-compliant regular expression.
   • dSending a verification email with a unique link for the user to click.
   Show the answer

   Answer: d · Sending a verification email with a unique link for the user to click.

   Sending a verification email is the only method that confirms both deliverability and user control. A complex regex is a common but flawed approach, as it can reject valid emails and cannot prove ownership.

   Read the full bite: What validation checks would you implement for an email field?

3. Question 3 of 30

   Which scenario best illustrates the appropriate use case for OAuth 2.0 authentication compared to a simple API key?

   • aA mobile application requesting access to a user's social media profile on a third-party platform.
   • bAn API requiring a static secret string to be sent with every request for basic access control.
   • cA backend service communicating with another trusted internal microservice.
   • dAn API providing public, read-only weather data without user-specific information.
   Show the answer

   Answer: a · A mobile application requesting access to a user's social media profile on a third-party platform.

   OAuth 2.0 is designed for delegated authorization, allowing third-party applications to access a user's resources with their consent, without sharing the user's credentials. Simple API keys are better suited for trusted server-to-server communication or basic access control where user consent and granular permissions are not required.

   Read the full bite: API Authentication: Who Goes There?

4. Question 4 of 30

   Which action is crucial for a Node.js HTTP server to signal that a response has been fully sent to the client?

   • aCalling server.listen() to activate the server on a port.
   • bSetting the response.statusCode to a success code like 200.
   • cInvoking response.end() on the response object.
   • dUsing response.write() to send all data chunks to the client.
   Show the answer

   Answer: c · Invoking response.end() on the response object.

   The card explicitly states that `response.end()` is critical to signal that the response is complete, otherwise the client will hang indefinitely. While `response.write()` sends data, it does not close the connection or mark the response as finished.

   Read the full bite: Creating a Basic HTTP Server in Node.js

5. Question 5 of 30

   To display millions of time-series points, which strategy best balances performance with preserving important visual features like peaks and valleys?

   • aSend a subset of the data by selecting every Nth point on the backend.
   • bUse a high-performance WebGL charting library to render all the raw points on the client.
   • cDownsample data on the backend using an algorithm like LTTB, and fetch higher resolutions on zoom.
   • dGroup data into time buckets on the backend and send the average value for each bucket.
   Show the answer

   Answer: c · Downsample data on the backend using an algorithm like LTTB, and fetch higher resolutions on zoom.

   LTTB preserves visually important peaks and valleys, unlike averaging which smooths them out or naive sampling (every Nth point) which can miss them entirely. Fetching higher resolutions on zoom maintains detail interactively.

   Read the full bite: Strategy for Visualizing Millions of Time-Series Points

6. Question 6 of 30

   Which scenario best describes the appropriate use case for path.join()?

   • aWhen you need to obtain a guaranteed absolute path to a resource, independent of the current working directory.
   • bWhen the goal is to simplify a complex path string by removing all '..' and '.' segments, resulting in the shortest possible absolute path.
   • cWhen you need to process a series of path segments, where an absolute segment should override all preceding segments.
   • dWhen you are combining path segments to build a path relative to a known base directory, such as a module's location.
   Show the answer

   Answer: d · When you are combining path segments to build a path relative to a known base directory, such as a module's location.

   path.join() is designed for constructing paths relative to a base directory you control, by concatenating segments and handling normalization. Option A and C describe the primary use cases and processing behavior of path.resolve().

   Read the full bite: path.join() vs. path.resolve(): Concatenation vs. Calculation

7. Question 7 of 30

   Which approach effectively visualizes millions of time-series data points in a web application while preserving visual fidelity?

   • aImplement a backend service using LTTB for dynamic downsampling based on requested resolution and time range, with a frontend fetching higher-resolution data on zoom and rendering with a canvas library.
   • bPre-compute and store multiple fixed-resolution aggregations of the data in the database, allowing the frontend to fetch the most suitable pre-aggregated view for the current zoom level.
   • cUtilize a high-performance frontend charting library with WebGL to render all raw data points directly in the browser, leveraging GPU acceleration for speed.
   • dDownsample data on the backend by selecting every Nth point, then send this reduced dataset to the frontend for rendering using an SVG-based library.
   Show the answer

   Answer: a · Implement a backend service using LTTB for dynamic downsampling based on requested resolution and time range, with a frontend fetching higher-resolution data on zoom and rendering with a canvas library.

   Option A correctly outlines a multi-layered strategy involving backend LTTB downsampling for visual fidelity, a multi-resolution API for efficient data transfer, and canvas rendering for frontend performance. Option C is incorrect because rendering millions of raw data points in the browser, even with WebGL, typically exceeds memory and rendering capabilities, and doesn't address the network bottleneck.

   Read the full bite: Visualize Millions of Time-Series Data Points

8. Question 8 of 30

   As a user zooms from a ten-year overview into a single week within a multi-million-point series, what is the most important change in the data pipeline?

   • aThe backend should serve a higher-resolution tier for that specific week rather than reusing the decade-wide downsample.
   • bThe frontend should offload parsing to a Web Worker and continue using the decade-wide downsample at higher zoom.
   • cThe backend should run LTTB across the entire ten-year dataset at the finest granularity to preserve all peaks.
   • dThe frontend should switch from Canvas to SVG to improve interactivity for the denser week view.
   Show the answer

   Answer: a · The backend should serve a higher-resolution tier for that specific week rather than reusing the decade-wide downsample.

   Zooming into a narrow range requires viewport-aware fetching of a higher-resolution tier for just that visible window, not reusing the coarse overview downsample. Option C is tempting because preserving peaks sounds desirable, but running LTTB over the entire raw dataset to serve a single week ignores tiered aggregation and wastes compute.

   Read the full bite: How do you build a performant visualization for millions of time-series points?

9. Question 9 of 30

   You need a FastAPI dependency that combines a path parameter and a request header. What is the correct implementation pattern?

   • aUse a special @composite_dependency decorator on the function to tell FastAPI to resolve parameters from multiple request locations.
   • bInject the raw Request object into the dependency and manually read the path parameter and header from its scope and headers dictionary.
   • cExtract both values in the path operation endpoint and pass them into a plain helper function called directly from the endpoint.
   • dAnnotate each parameter in the dependency function with its source (e.g., Path, Header) and declare the function as a dependency with Depends().
   Show the answer

   Answer: d · Annotate each parameter in the dependency function with its source (e.g., Path, Header) and declare the function as a dependency with Depends().

   FastAPI inspects dependency signatures using the same resolution engine as endpoints, so annotating parameters with Path, Header, or similar and using Depends() lets the framework inject them automatically. Option B is tempting for developers familiar with lower-level frameworks, but manually parsing Request bypasses validation and defeats the purpose of FastAPI's dependency injection system.

   Read the full bite: How would you implement a dependency requiring multi-source parameters?

10. Question 10 of 30

    You have defined routes using APIRouter in a separate file. What is the correct final step in main.py to make those routes available?

    • aImport the router object and call app.include_router(router)
    • bCopy the route functions into main.py and register them directly with @app.get
    • cCall router.include_router(app) after creating the FastAPI instance
    • dImport the router file and rely on FastAPI to auto-register the routes
    Show the answer

    Answer: a · Import the router object and call app.include_router(router)

    Calling app.include_router(router) is the required step to mount the imported router on the FastAPI instance. Simply importing the module is not enough, as FastAPI does not auto-register routes from imported files.

    Read the full bite: How do you include a router in your main FastAPI app?

11. Question 11 of 30

    You need to enforce authentication on every /users endpoint while leaving /items public. What is the most maintainable FastAPI approach?

    • aAdd Depends(get_current_user) to every path operation in the users router and leave items routes bare.
    • bRegister a middleware that checks authentication before every request and bypasses /items by path.
    • cPass dependencies=[Depends(get_current_user)] to the users APIRouter and omit it from the items router, then include both in the app.
    • dApply the dependency at the app level and add conditional logic inside get_current_user to skip /items paths.
    Show the answer

    Answer: c · Pass dependencies=[Depends(get_current_user)] to the users APIRouter and omit it from the items router, then include both in the app.

    Passing dependencies to APIRouter scopes authentication to that router only while keeping other routers unaffected and preserving OpenAPI docs. Adding Depends to every route manually violates DRY and makes refactoring painful, even though it produces the same runtime behavior.

    Read the full bite: How to apply a dependency to only one FastAPI router?

12. Question 12 of 30

    What is the main advantage of using Express.js compared to Node.js's native HTTP module for building web servers?

    • aIt provides a complete solution for database integration and ORM.
    • bIt offers built-in support for real-time communication using WebSockets.
    • cIt automatically generates a structured project directory with separate files.
    • dIt simplifies the process of defining routes, applying middleware, and handling responses.
    Show the answer

    Answer: d · It simplifies the process of defining routes, applying middleware, and handling responses.

    The card states Express was created to simplify routing, middleware, and response handling, which are verbose with Node's native HTTP modules. Express itself is unopinionated about databases or project structure, and WebSocket support is not its primary advantage over native HTTP.

    Read the full bite: Creating Your First Express Server

13. Question 13 of 30

    Which design best supports a valid headline A/B test on a single article URL with reliable CTR measurement?

    • aCreate a separate article row for each headline variant and assign users via server-side randomization on every request
    • bUse client-side randomization that re-rolls on every page load, keep the article table unchanged, and emit impression and click events from the browser
    • cStore the variant headline directly on the article record and update real-time click and impression counters in place
    • dHash the user ID with the experiment key for deterministic bucketing, maintain separate experiment and variant tables, and emit structured impression and click events
    Show the answer

    Answer: d · Hash the user ID with the experiment key for deterministic bucketing, maintain separate experiment and variant tables, and emit structured impression and click events

    Deterministic hashing ensures the same user always sees the same headline across sessions without per-user assignment rows, separate tables preserve the single URL requirement, and discrete events enable accurate CTR and statistical testing. Option B is tempting because it tracks events and avoids schema changes, but re-rolling client-side splits users across variants and corrupts the experiment data.

    Read the full bite: Design a system to A/B test headlines for a single article URL

14. Question 14 of 30

    Which approach best keeps FastAPI router modules decoupled and reusable when applying a shared path prefix like /api/v1?

    • aUse relative paths in the router and apply the shared prefix via app.include_router when mounting
    • bPass the prefix argument directly to the APIRouter constructor instead of to include_router
    • cCreate custom middleware that rewrites incoming URLs to prepend the shared prefix before routing
    • dHardcode the full absolute path in every APIRouter decorator and mount the router without any prefix
    Show the answer

    Answer: a · Use relative paths in the router and apply the shared prefix via app.include_router when mounting

    Defining relative paths in APIRouter and setting the prefix in include_router keeps route definitions separate from URL composition, enabling reuse. Hardcoding full paths scatters configuration, while middleware and router-level prefix arguments add unnecessary complexity.

    Read the full bite: How do you apply a common path prefix across FastAPI routers?

15. Question 15 of 30

    How does Express.js determine which specific handler function to execute for an incoming web request?

    • aBy executing the first handler function defined in the application, regardless of method or path.
    • bBy matching only the HTTP method of the request to a defined route.
    • cBy matching only the URL path of the request to a defined route.
    • dBy matching both the HTTP method and the URL path of the request.
    Show the answer

    Answer: d · By matching both the HTTP method and the URL path of the request.

    Express routing connects a request's path and HTTP method to a specific handler function. It requires both components to uniquely identify and execute the correct handler, as stated in the card: 'Each route matches a unique combination of an HTTP method and a URL path.' Options A and C are incomplete, as they only consider one part of the matching criteria. Option A describes a general execution order, not the specific matching logic for a route.

    Read the full bite: Express.js: Basic Request Routing

16. Question 16 of 30

    What is a critical pitfall to avoid when using the `res` object in an Express route handler?

    • aTrying to access client-sent data using `res.body` instead of `req.body`.
    • bSending multiple HTTP responses for a single client request.
    • cUsing `res.send()` to return a JavaScript object directly without stringifying it.
    • dForgetting to include `req` as the first parameter in the handler function.
    Show the answer

    Answer: b · Sending multiple HTTP responses for a single client request.

    The card explicitly warns against sending more than one response per request, as it closes the connection and leads to errors. While other options describe common mistakes, they are either syntax issues, misunderstandings of object roles, or not critical errors in the same way.

    Read the full bite: Express Request and Response Objects (req, res)

17. Question 17 of 30

    Which approach correctly models the backend logic for a daily login streak while avoiding common timezone and idempotency bugs?

    • aStore last_login_utc, current_streak, and user_timezone; use calendar-day buckets aligned to the user's local midnight
    • bStore last_login_utc and current_streak, then derive the user's timezone from their device clock on each request
    • cStore only the last login timestamp in local time and increment the streak whenever 24 hours have elapsed
    • dStore a daily_login boolean and reset all streaks at a single global midnight UTC
    Show the answer

    Answer: a · Store last_login_utc, current_streak, and user_timezone; use calendar-day buckets aligned to the user's local midnight

    Option A is correct because the card specifies storing UTC timestamps and a user_timezone, then evaluating logins against calendar-day boundaries set to the user's local midnight to handle DST and idempotency. Option C is tempting but wrong because local timestamps and 24-hour rolling windows break during daylight saving transitions and can double-count retries.

    Read the full bite: Describe the data model and backend logic for a daily login bonus.

18. Question 18 of 30

    What is the consequence if an Express middleware function neither calls next() nor sends a response?

    • aThe client's request will hang indefinitely, awaiting a response.
    • bThe server terminates the connection with an internal server error.
    • cThe application automatically proceeds to the next middleware in the sequence.
    • dThe request is silently discarded, and the client receives no feedback.
    Show the answer

    Answer: a · The client's request will hang indefinitely, awaiting a response.

    The card states, "If a middleware does neither, the request hangs." This means the client will wait indefinitely for a response. Calling next() is explicitly required for the request to proceed to the next function in the chain, making option C incorrect.

    Read the full bite: Express Middleware: The Chain of Command for Requests

19. Question 19 of 30

    What is the primary outcome if an Express middleware function completes its execution without calling next() or sending a response?

    • aThe client's request will remain open, eventually timing out without a response.
    • bThe middleware will automatically retry its execution until a valid response is generated.
    • cThe server will log an error and terminate the request gracefully.
    • dThe request will be automatically redirected to the application's default error handler.
    Show the answer

    Answer: a · The client's request will remain open, eventually timing out without a response.

    The card states that if next() is not called and no response is sent, 'the request will hang and eventually time out,' meaning the client waits indefinitely. The server does not automatically terminate or redirect the request; it simply waits for the middleware to complete its cycle.

    Read the full bite: Express Middleware: Intercepting Requests Before Your Route Handler

20. Question 20 of 30

    What prevents users who never saw the CTA variant from polluting your conversion rate denominator?

    • aAppending experiment metadata to the page URL for all visitors
    • bAn exposure event fired when the variant is actually shown to the user
    • cSynchronous server-side rendering of the variant before the DOM paint
    • dDeterministic user bucketing with a hashed stable identifier
    Show the answer

    Answer: b · An exposure event fired when the variant is actually shown to the user

    An exposure event explicitly logs when a user is shown the variant, creating an accurate denominator; deterministic bucketing keeps users in consistent groups but does not by itself record who actually viewed the CTA.

    Read the full bite: How do you implement a CTA A/B test and attribute conversions?

21. Question 21 of 30

    Why does a browser block a frontend on localhost:3000 from calling a FastAPI backend on localhost:8000, and what is the proper fix?

    • aThey are the same origin because both use localhost; the error means the API endpoint requires authentication headers.
    • bThe browser considers them different origins because the ports differ; add CORSMiddleware to FastAPI with the frontend origin in allow_origins.
    • cYou should set allow_origins to ["*"] in FastAPI so any origin can access the backend without restrictions.
    • dThe proper fix is to install a browser extension that disables CORS for local development, avoiding server changes.
    Show the answer

    Answer: b · The browser considers them different origins because the ports differ; add CORSMiddleware to FastAPI with the frontend origin in allow_origins.

    The browser treats protocol, host, and port as an origin tuple, so localhost:3000 and localhost:8000 are cross-origin and CORSMiddleware must explicitly allow the frontend. The distractor that claims they are the same origin because they share localhost reflects a fundamental misunderstanding of the same-origin policy.

    Read the full bite: Frontend on localhost:3000 gets errors calling FastAPI on localhost:8000. Name and fix?

22. Question 22 of 30

    Which change to an API would most likely necessitate creating a new version?

    • aOptimizing the database query for an existing endpoint to improve speed.
    • bAdding a new, optional field to an existing response payload.
    • cIntroducing a completely new endpoint to handle a new business process.
    • dSplitting a single 'address' field into 'street', 'city', and 'zipCode' fields.
    Show the answer

    Answer: d · Splitting a single 'address' field into 'street', 'city', and 'zipCode' fields.

    The card states that 'breaking changes' alter data structures or endpoint behavior, citing splitting a 'fullName' field as an example. Splitting an 'address' field is analogous, requiring clients to adapt to new fields. Adding optional fields or new endpoints are non-breaking changes, and performance optimizations do not alter the API contract.

    Read the full bite: API Versioning: Managing Change Without Breaking Clients

23. Question 23 of 30

    What is required to ensure a click can be causally linked to the headline variant a user actually saw?

    • aEach variant must be served from a unique URL so analytics can separate traffic naturally
    • bThe user must be deterministically assigned to a variant and the variant ID must travel with the click event
    • cThe browser must randomly assign a variant on each page load to keep the sample unbiased
    • dThe page must hide all content until a client-side script finishes swapping the headline
    Show the answer

    Answer: b · The user must be deterministically assigned to a variant and the variant ID must travel with the click event

    Deterministic bucketing ensures the same user always sees the same variant, preventing cross-contamination, and the variant ID must be included in the click event metadata to preserve causation from impression to click. Option C is wrong because random assignment per request destroys session consistency and can expose a user to both variants.

    Read the full bite: How would you track which headline wins in an A/B test?

24. Question 24 of 30

    When is a workflow engine most appropriately used in a software system?

    • aTo replace a database transaction for ensuring atomicity in a single-service operation.
    • bTo coordinate a complex, long-running business process involving multiple distributed steps.
    • cTo manage low-latency, synchronous request-response interactions between two services.
    • dTo execute a simple, stateless function within a single application component.
    Show the answer

    Answer: b · To coordinate a complex, long-running business process involving multiple distributed steps.

    Workflow engines are designed for 'stateful, multi-step processes that need to be reliable,' especially 'long-running' ones involving 'distributed, asynchronous work.' They are explicitly not for low-latency RPC or simple, stateless tasks.

    Read the full bite: Workflow Engine: The Conductor for Your Business Logic

25. Question 25 of 30

    When is server-side experimentation the most appropriate choice for an A/B test?

    • aTo segment users based on their browser's local storage data.
    • bTo test the effectiveness of a new product recommendation algorithm.
    • cTo compare two different button colors on a landing page.
    • dTo quickly change a website's headline for a marketing campaign.
    Show the answer

    Answer: b · To test the effectiveness of a new product recommendation algorithm.

    Server-side experimentation is designed for testing deep backend logic, such as algorithms, where the variation is applied before the page is rendered. Simple UI changes like headlines or button colors, or segmentation based on client-side data, are typically better suited for client-side testing tools.

    Read the full bite: Server-Side Experimentation: Testing Your Backend Logic

26. Question 26 of 30

    Which scenario best describes the primary use case for a Next.js Route Handler?

    • aCreating API endpoints to handle data operations or integrate with third-party services.
    • bDefining client-side functions that respond to user interactions in the browser.
    • cPre-rendering static content at build time for improved performance.
    • dGenerating and serving HTML pages with dynamic content to users.
    Show the answer

    Answer: a · Creating API endpoints to handle data operations or integrate with third-party services.

    Route Handlers are designed to create API endpoints for data fetching, mutations, and integrations, acting as a backend for your Next.js app. Option D describes the function of Server Components or page.js files, which render UI, not data, and is a common misconception.

    Read the full bite: Route Handlers: Your Next.js App's API Endpoints

27. Question 27 of 30

    Which principle best describes the recommended approach for robust input validation?

    • aIdentifying and removing all known malicious patterns from input.
    • bDefining and accepting only strictly formatted, known-good data.
    • cAllowing all input initially, then filtering out common errors later.
    • dTrusting internal system data and only validating external user input.
    Show the answer

    Answer: b · Defining and accepting only strictly formatted, known-good data.

    The card emphasizes 'allowlisting,' which means defining a strict, narrow definition of what is 'good' and rejecting everything else. This contrasts with 'denylisting' (Option A), which attempts to identify and block all 'bad' inputs, a strategy the card explicitly advises against.

    Read the full bite: Never Trust User Input: The Validation Mindset

28. Question 28 of 30

    Which combination correctly wires a FastAPI WebSocket endpoint so it can receive text from a client?

    • aUse @app.get("/ws"), declare websocket: WebSocket, and call await websocket.receive_text()
    • bUse @app.websocket("/ws"), declare websocket: WebSocket, and call await websocket.accept() then await websocket.receive_text()
    • cUse @app.websocket("/ws"), declare websocket: WebSocket, and call await websocket.receive_text() then await websocket.accept()
    • dUse @app.websocket("/ws"), declare websocket: WebSocket, and call await websocket.accept() then websocket.receive_text()
    Show the answer

    Answer: b · Use @app.websocket("/ws"), declare websocket: WebSocket, and call await websocket.accept() then await websocket.receive_text()

    The correct pattern requires the @app.websocket decorator, a WebSocket parameter, and an explicit await websocket.accept() before any await websocket.receive_text(). Option C is tempting because it uses the right decorator and types, but reversing accept and receive causes the client to hang since the handshake never completes.

    Read the full bite: How do you define a WebSocket endpoint in FastAPI?

29. Question 29 of 30

    Where should you place code to initialize a database pool once at app startup and close it at shutdown?

    • aIn a route dependency with yield so it runs around every request
    • bAt the top level of the module so it executes once on import
    • cIn a lifespan context manager or startup/shutdown event handlers
    • dIn an async middleware function that runs before each request
    Show the answer

    Answer: c · In a lifespan context manager or startup/shutdown event handlers

    Lifespan and startup/shutdown hooks execute exactly once per application lifecycle, making them the right place for expensive shared resources. Middleware and route dependencies run per request, which would wastefully recreate the pool on every call.

    Read the full bite: What are startup and shutdown events in FastAPI?

30. Question 30 of 30

    Which task is NOT a suitable use case for a Next.js Route Handler?

    • aCreating a webhook to receive updates from third-party services.
    • bProcessing data submitted through a client-side form.
    • cGenerating and serving a full HTML page to the browser.
    • dProviding an API endpoint for client components to fetch data.
    Show the answer

    Answer: c · Generating and serving a full HTML page to the browser.

    Route Handlers are designed to return data, typically JSON, and are explicitly stated as not suitable for rendering HTML pages. That functionality is handled by Page Components. The other options are all valid uses for Route Handlers.

    Read the full bite: Next.js Route Handlers: One File, Multiple Methods