Advanced interview questions in Backend Dev, page 6
Deploying a strict CSP for an Express SPA
Define directives, start in Report-Only to gather violations, then enforce; allow inline code via per-request nonces or hashes plus strict-dynamic instead of unsafe-inline.
How do you test FastAPI background tasks are enqueued correctly?
This tests mocking framework hooks without firing side effects. A great answer: mock BackgroundTasks or override its dependency, assert add_task got the right function and payload, and test the sender separately.
Prototype pollution: how it works and prevention
Attacker writes to Object.prototype via __proto__ keys in merge/parse code, poisoning all objects; prevent by guarding keys, null-prototype objects, Object.freeze, Map, and patched deps.
Aurora vs Spanner architecture contrast
Aurora is single-writer with a shared distributed log-based storage and quorum, scaling reads; Spanner shards data with Paxos and TrueTime for global writes.
How do you test a FastAPI WebSocket endpoint and lifecycle with pytest?
Tests knowledge of FastAPI TestClient usage for async WebSocket lifecycles. Use a with statement for websocket_connect; assert send, receive_json, and close; tests use standard def because TestClient handles the async app.
JWT storage: localStorage versus HttpOnly cookie
LocalStorage is JS-readable so XSS steals the token; HttpOnly cookies resist XSS theft but reintroduce CSRF, mitigated by SameSite plus CSRF tokens.
Multi-region active-passive DR with Aurora
Async global replication to a passive region, promote and repoint traffic on failover, and fence the old primary to prevent split-brain.
How do router-level and app-level dependencies affect dependency override testing?
This tests FastAPI dependency hierarchy and test isolation. A strong answer states overrides are global to the app, so router-specific deps need scoped fixtures to prevent cross-test leaks. A red flag is claiming APIRouter has its own override registry.
Implement a custom derive macro for a Builder pattern
Tests proc-macro AST transformation. A strong answer lists: parse TokenStream with syn into DeriveInput, inspect fields, then quote builder code as TokenStream, noting the separate proc-macro crate. Red flag: treating tokens as strings instead of AST nodes.
Zero-copy string to []byte conversion via unsafe in Go
Use unsafe.StringData/Slice (or reflect headers) to alias the string's bytes without copying; assumes shared backing array; risk is mutating an immutable string.
Design a safe Rust wrapper taking &[i32] and returning Vec<i32>
Tests Rust FFI buffer-output encapsulation. A strong answer declares an unsafe extern C block, allocates a Vec with capacity, passes as_mut_ptr and a local size_t, validates returned length, then calls set_len.
The small files problem in data lakes
Many tiny files create per-file overhead and metadata pressure, hurting scans; fix via compaction, batching writes, and tuning partitioning.
Iceberg vs Delta Lake metadata and ACID
Iceberg uses a tree of metadata and manifest files with atomic pointer swaps and optimistic concurrency; Delta uses an ordered transaction log of JSON commits with optimistic concurrency.
How does Node.js cluster module enable zero-downtime restarts?
Master-worker architecture, graceful shutdown of old workers, routing new requests to new workers.
postMessage vs SharedArrayBuffer in worker_threads tradeoffs?
Structured cloning copies data, SharedArrayBuffer shares memory.
Add a custom x- field to a FastAPI path operation schema
Tests knowledge of FastAPI's built-in OpenAPI extension hook. Answer: cite the path operation decorator's extra-schema dict (OpenAPI Extra) to merge x-internal-id directly. Red flag: proposing manual JSON editing or schema post-processing.
How do you handle errors across piped streams safely?
Pipe connects streams but errors don't auto-propagate, must listen on each stream. Use pipeline() helper for auto-cleanup.
Building a safe Rust wrapper over an unsafe C API
Hide extern calls behind a safe module, own the resource in a struct with Drop calling the C free, return Result mapping C error codes, use NewType/NonNull and PhantomData.
How do you disable FastAPI docs but keep the OpenAPI schema?
Tests FastAPI constructor routing: docs_url, redoc_url, and openapi_url. Answer: pass docs_url=None and redoc_url=None while keeping openapi_url="/openapi.json", gated by env var. Red flag: middleware or manual route deletion instead of native configuration.
cgo directives: CFLAGS, LDFLAGS, and pkg-config
#cgo CFLAGS feeds the C compiler include paths/defines, LDFLAGS feeds the linker libraries/paths, pkg-config auto-discovers both; needed to compile against a system C library.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles