Intermediate interview questions in Backend Dev, page 7
Concurrent TCP server: Go goroutines vs Rust std::thread
Both accept in a loop; Go spawns a goroutine per connection (go handle(conn)); Rust spawns an OS thread (thread::spawn moving the stream).
Implement RBAC in FastAPI with a JWT role dependency
Build a dependency that decodes the JWT, checks the role, raises 403 if not admin, and inject via Depends.
Custom Error classes and centralized handling
Custom Error subclasses carry a statusCode and flag, the central handler inspects instanceof or statusCode to set the HTTP code and JSON shape, defaulting unknown errors to 500.
Point-in-Time Recovery (PITR)
Restore a base backup then replay archived write-ahead logs up to a chosen moment, enabling recovery to just before an error.
How do OAuth2 scopes enable granular permissions in FastAPI versus role-based checks?
Tests OAuth2 scope granularity vs RBAC and FastAPI SecurityScopes. Strong answers mention JWT claim strings, SecurityScopes per endpoint, and that RBAC is coarse while scopes are fine-grained. Red flag: treating scopes as roles or skipping claim checks.
Compare Go's []byte and Rust's &[u8]
Tests memory-model depth: Go slices are GC-managed headers (ptr, len, cap) permitting shared mutation, while Rust &[u8] is a borrow-checked fat pointer (ptr, len) enforcing aliasing-XOR-mutation.
Operational versus programmer errors in Node.js
Operational errors are expected runtime conditions you handle and respond to; programmer errors are bugs that may corrupt state, so you log and gracefully restart.
RBAC vs direct user grants
Direct grants tie rights to individuals; RBAC groups rights into roles users inherit, so changes happen once per role.
Integration testing a POST endpoint with Supertest
Pass the Express app to supertest, send a POST with a body, then assert status 201, the response shape, and the persisted side effect; also test validation failures.
Mocking the database layer in Jest unit tests
A live DB makes tests slow, flaky, and order-dependent; use jest.mock on the model so methods return controlled fakes.
Pooled connection lifecycle and close() semantics
Borrow from pool, use, then close() returns it to the pool rather than tearing down the socket.
Write a FastAPI middleware that adds X-Process-Time header
Tests FastAPI lifecycle and header mutation. Strong answers use the http middleware decorator, await call_next, compute elapsed time, and inject X-Process-Time before returning. Red flag: forgetting to await call_next or mutating headers after the return.
How do you use ResetTimer, StopTimer, and RunParallel in Go benchmarks?
Tests Go benchmark timer hygiene and parallel execution. A strong answer covers b.StopTimer before setup, b.ResetTimer before the loop, and b.RunParallel for CPU-bound scaling. A red flag is resetting without stopping or using parallel benchmarks for I/O.
Testing async Promise-returning code in Jest
Return or await the promise; use await expect(...).resolves/rejects, or await the value directly.
Eager vs lazy loading in an ORM
Eager fetches related data up front (joins/extra query); lazy defers until accessed. Lazy in a loop causes the N+1 query problem.
Which FastAPI CORSMiddleware parameters beyond allow_origins fix a PUT preflight?
Configure allow_methods for PUT and allow_headers for Authorization so the browser approves the cross-origin call.
Generate a Go CPU profile and visualize it as a flame graph
This tests Go profiling workflow and flame graph literacy. A good answer covers net/http/pprof setup, go tool pprof collection, flame graph generation, and reading width as cumulative CPU time and height as call depth. Red flag: width means call count.
Propagating a correlation ID without parameter passing
Middleware reads or generates the header, stores it in a contextvars.ContextVar, service code reads it anywhere, and logging filters inject it.
Transaction isolation levels and their tradeoffs
Isolation levels control which concurrency anomalies (dirty/non-repeatable reads, phantoms) are allowed; higher levels mean stronger consistency but more blocking and less concurrency.
Explain fuzz testing and set up a basic fuzz test
This tests coverage-guided fuzzing and toolchain wiring. Strong answer: defines fuzzing as automated input mutation driven by code coverage, contrasts it with hand-written examples, and sketches Go's FuzzXxx or Rust's cargo-fuzz setup.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles