Easy interview questions in Backend Dev, page 5
Explain SQLAlchemy ORM vs Pydantic models in FastAPI
This tests separation of database schema from API contracts. A strong answer distinguishes SQLAlchemy table rows from Pydantic validation and OpenAPI generation, and notes that create schemas exclude auto-generated IDs.
Authentication versus authorization in Express
Authentication proves who you are, authorization decides what you may do, authentication happens first.
What is sharding and why shard over vertical scaling?
Sharding splits one dataset across servers by a shard key so each holds a subset; you shard because vertical scaling hits hardware ceilings, gets costly, and remains a single point of failure.
JWT structure and how the signature works
Name header, payload, and signature, note the first two are base64url-encoded not encrypted, explain the signature is computed over header and payload with a secret to detect tampering.
Read a file into a byte slice in Go and Rust
This tests standard-library convenience APIs for slurping files. In Go, use os.ReadFile (1.16+) returning ([]byte, error). In Rust, use std::fs::read returning Result<Vec<u8>>. A red flag is opening a file and looping over reads when a one-liner exists.
How do you protect a FastAPI endpoint using Depends and OAuth2PasswordBearer?
OAuth2PasswordBearer sets the token URL, Depends injects it into the endpoint, and FastAPI validates the Bearer header.
Build a TCP server in Go and Rust using standard libraries
Tests standard-library networking APIs in both languages. Strong answer: Go's net.Listen with Accept loop vs Rust's std::net::TcpListener::bind and incoming iterator. Red flag: reaching for HTTP or async frameworks instead of core TCP primitives.
What are the three components of a JWT?
Tests if you know JWT structure beyond library usage. A strong answer lists header, payload, and signature; notes Base64Url encoding; and gives a registered claim like exp. A red flag is confusing signing with encryption.
Serialize a Go struct to JSON and contrast with Rust
This tests fluency in Go's encoding/json versus Rust's derive macro ecosystem. Go: call json.Marshal on exported fields; Rust: derive Serialize, then serde_json::to_string. Red flag: claiming Rust uses std-only serialization or that Go needs external crates.
Basic presence validation on a POST login route
Ensure the JSON body parser runs, destructure email and password from req.body, return 400 early if either is missing, then proceed.
Full, differential, and incremental backups
Full copies everything; differential copies all changes since the last full; incremental copies changes since the last backup of any type.
How should you store user passwords in a database?
Tests knowledge of slow salted hashing versus encryption. Strong answers pick Argon2id or bcrypt, require unique per-user salts, describe verification via re-hashing with constant-time comparison, and cite bcrypt or argon2-cffi.
Least privilege for database service accounts
Grant each account only the minimum rights its job needs; for an app service account, scope grants to specific tables and verbs, never use the superuser.
Unit, integration, and E2E tests explained
Unit tests isolate one function with dependencies mocked, integration tests exercise several units together (route plus DB), E2E tests drive the whole running system.
Frontend on localhost:3000 gets errors calling FastAPI on localhost:8000. Name and fix?
This tests whether different ports mean different origins, causing CORS errors. A strong answer names CORS, notes ports are distinct origins, and outlines using CORSMiddleware with allow_origins.
How do you write a table-driven test in Go?
Tests idiomatic Go test design. A strong answer: slice/map of structs with inputs/expected outputs, loop with t.Run for named subtests, and cite DRY code, parallelization, and failure isolation. Red flag: separate Test functions per case or omitting t.Run.
Writing a basic Jest unit test
Import the function, group cases with describe, define each case with it or test, assert with expect and a matcher like toBe, covering normal and edge inputs.
Purpose of database drivers (JDBC/ODBC)
A driver translates a standard API into each database's wire protocol, so app code stays portable across vendors.
How do you send an email without blocking a FastAPI request?
Tests knowledge of FastAPI's BackgroundTasks for post-response work. Strong answer: import it, inject into the endpoint, define a task function, and call add_task before returning.
How does Rust differentiate unit and integration tests?
Tests Rust test layout and privacy. Unit tests sit in src/ under #[cfg(test)] and call private functions via super::. Integration tests go in tests/ as external crates. Wrong: claiming it blocks private testing or merging them into src/.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles