Interview questions in Backend Dev, page 15
Split-brain, consensus, and quorum
Split-brain is two nodes both believing they are leader during a partition; Raft/Paxos require a majority quorum to elect a leader and commit, so the minority side cannot make progress.
How do you protect a FastAPI endpoint using Depends and OAuth2PasswordBearer?
OAuth2PasswordBearer sets the token URL, Depends injects it into the endpoint, and FastAPI validates the Bearer header.
Build a TCP server in Go and Rust using standard libraries
Tests standard-library networking APIs in both languages. Strong answer: Go's net.Listen with Accept loop vs Rust's std::net::TcpListener::bind and incoming iterator. Red flag: reaching for HTTP or async frameworks instead of core TCP primitives.
Mitigating a database shard hot spot
Short-term, add read replicas or cache the hot keys; long-term, fix the partition key with hashing, salting, or finer-grained splitting.
What are the three components of a JWT?
Tests if you know JWT structure beyond library usage. A strong answer lists header, payload, and signature; notes Base64Url encoding; and gives a registered claim like exp. A red flag is confusing signing with encryption.
Serialize a Go struct to JSON and contrast with Rust
This tests fluency in Go's encoding/json versus Rust's derive macro ecosystem. Go: call json.Marshal on exported fields; Rust: derive Serialize, then serde_json::to_string. Red flag: claiming Rust uses std-only serialization or that Go needs external crates.
Basic presence validation on a POST login route
Ensure the JSON body parser runs, destructure email and password from req.body, return 400 early if either is missing, then proceed.
Full, differential, and incremental backups
Full copies everything; differential copies all changes since the last full; incremental copies changes since the last backup of any type.
How should you store user passwords in a database?
Tests knowledge of slow salted hashing versus encryption. Strong answers pick Argon2id or bcrypt, require unique per-user salts, describe verification via re-hashing with constant-time comparison, and cite bcrypt or argon2-cffi.
Compare efficient line-by-line file reading in Go and Rust
Go uses bufio.Scanner with ScanLines/Scan(); Rust uses BufReader with lines() or read_line().
Propagating async errors to Express error handlers
Express does not auto-catch rejected promises, so catch and call next(err), or wrap handlers in an asyncHandler that forwards rejections; Express 5 awaits handlers automatically.
Least privilege for database service accounts
Grant each account only the minimum rights its job needs; for an app service account, scope grants to specific tables and verbs, never use the superuser.
Implement OAuth2 Password Flow in FastAPI
Tests FastAPI security integration and stateless auth patterns. A strong answer covers the POST /token endpoint returning a JWT, the OAuth2PasswordBearer dependency, and get_current_user decoding the JWT sub.
Compare Go's error tuples to Rust's Result for I/O
Tests trade-offs between Go's explicit error returns and Rust's Result type. Contrast Go's inline err checks with Rust's ? operator, noting verbosity versus compile-time exhaustiveness. Never call Result an exception or claim Go ignores errors.
Reusable schema validation middleware with Zod or Joi
Define a schema (email, password min 8, optional firstName), write a factory middleware that validates req.body, returns 400 with messages on failure, and assigns the parsed value on success.
Connection pooling and its key parameters
Reuse open connections to skip costly handshakes; tune max pool size and connection timeout.
Concurrent TCP server: Go goroutines vs Rust std::thread
Both accept in a loop; Go spawns a goroutine per connection (go handle(conn)); Rust spawns an OS thread (thread::spawn moving the stream).
Implement RBAC in FastAPI with a JWT role dependency
Build a dependency that decodes the JWT, checks the role, raises 403 if not admin, and inject via Depends.
Custom Error classes and centralized handling
Custom Error subclasses carry a statusCode and flag, the central handler inspects instanceof or statusCode to set the HTTP code and JSON shape, defaulting unknown errors to 500.
Point-in-Time Recovery (PITR)
Restore a base backup then replay archived write-ahead logs up to a chosen moment, enabling recovery to just before an error.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles