Intermediate interview questions in Backend Dev, page 8
BackgroundTasks dependency vs response.background
The injected BackgroundTasks parameter lets endpoints and dependencies stack tasks and is the common path; response.background attaches a single Starlette task when you return a Response object…
Explaining and preventing CSRF in Express
CSRF abuses a victim's ambient cookies to forge state-changing requests; the server issues an unpredictable token tied to the session, embeds it in forms, and validates it…
Preventing SQL injection with parameterized queries
The flaw is SQL injection; prevent it with parameterized queries/prepared statements (pg $1, mysql2 ?), never string concatenation, so input is data not code.
Aurora Serverless v2 for spiky traffic
Serverless v2 autoscales capacity in fine-grained ACU steps near-instantly, you pay per-ACU-second, and provisioned is fixed cost regardless of load.
Explain FastAPI dependency overrides with an in-memory SQLite test example
This tests FastAPI's hook for swapping dependencies cleanly in tests. A strong answer names app.dependency_overrides, defines a test-only in-memory SQLite session, and handles teardown. A red flag is patching globals or mocking ORM instead of dependency.
Input validation versus output encoding
Validation checks input fits expected rules on entry; encoding makes data safe for a specific output context on exit. You need both; encoding is the real anti-XSS control.
Near-zero-downtime database migration to cloud
Assess and provision, do a full load then continuous CDC replication with a tool like DMS, validate, then cut over with a rollback plan.
How do you test a FastAPI endpoint without real tokens?
Tests whether you know FastAPI's dependency override mechanism to isolate business logic from auth. A great answer describes using app.dependency_overrides to swap the auth Depends for a mock returning a fake user, then cleaning up after the test.
Using reflect, iterate a pointer-to-struct's fields
Tests fluency with Go reflection for indirection and field traversal. Outline: ValueOf/TypeOf, guard IsValid, check Kind==Ptr, Elem to struct, loop NumField with Type for names and Value for values. Red flag: Field() on the pointer before Elem panics.
Auditing and fixing vulnerable npm dependencies
Run npm audit (or yarn audit) to list advisories, npm audit fix to patch within semver, bump majors deliberately, and lock versions; wire audits into CI.
Cache-aside pattern with Redis and RDS
App checks cache, on miss reads DB and populates, writes invalidate the key, and consistency is eventual.
Rust references vs raw pointers
References are borrow-checked, always valid, aliasing-controlled, non-null; raw pointers carry no guarantees, can be null, dangling, or aliased, and dereferencing needs unsafe.
How would you use pytest fixtures to manage TestClient and mock dependencies?
Tests FastAPI test isolation and dependency overrides. Strong answer: function-scoped fixture yielding TestClient, mock injection via app.dependency_overrides, and teardown cleanup to prevent state leaks.
How Spanner achieves global external consistency
TrueTime gives bounded-uncertainty clocks via GPS and atomic sources, Spanner commit-waits out that uncertainty, and Paxos replicates each shard.
In Go's reflect package, what is settability and how is it obtained?
This tests whether you know reflection mutates only addressable storage. Settability means a Value points to actual memory; obtain it by calling reflect.ValueOf on a pointer then Elem, or on slice elements. Set panics when the Value is a copy, not an address.
What are Rust's three procedural macros and derive's advantage over macro_rules?
Tests Rust macros and AST generation vs text macros. Lists derive, attribute-like, and function-like macros, then explains derive needs AST introspection for per-field impl unreachable with macro_rules. Red flag: that macro_rules can iterate struct fields.
Clickstream architecture for real-time and batch
Ingest events into a log like Kafka, fan out to a real-time path for dashboards and a batch path to a lake for ad-hoc analysis.
Offloading CPU work with worker_threads
Heavy sync work blocks the single event loop and stalls all requests; move it to a Worker, message the input, await the result asynchronously, and ideally pool workers.
Exactly-once semantics in stream processing
Exactly-once means each event affects state once despite retries, it is hard because of failures between processing and committing, and you achieve it via idempotency or atomic…
How do you document multiple response schemas in OpenAPI?
This tests FastAPI OpenAPI schema generation for error responses. A strong answer covers the decorator responses dict mapping status codes to Pydantic models and descriptions, plus manually returning JSONResponse with that code.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles