Interview questions in Backend Dev, page 16
How do OAuth2 scopes enable granular permissions in FastAPI versus role-based checks?
Tests OAuth2 scope granularity vs RBAC and FastAPI SecurityScopes. Strong answers mention JWT claim strings, SecurityScopes per endpoint, and that RBAC is coarse while scopes are fine-grained. Red flag: treating scopes as roles or skipping claim checks.
Compare Go's []byte and Rust's &[u8]
Tests memory-model depth: Go slices are GC-managed headers (ptr, len, cap) permitting shared mutation, while Rust &[u8] is a borrow-checked fat pointer (ptr, len) enforcing aliasing-XOR-mutation.
Revoking stateless JWTs on logout
A server-side denylist of revoked token IDs checked per request, or short-lived access tokens paired with revocable refresh tokens.
Operational versus programmer errors in Node.js
Operational errors are expected runtime conditions you handle and respond to; programmer errors are bugs that may corrupt state, so you log and gracefully restart.
RBAC vs direct user grants
Direct grants tie rights to individuals; RBAC groups rights into roles users inherit, so changes happen once per role.
Network read/write timeouts in Go vs Rust stdlib
Go uses SetReadDeadline/SetWriteDeadline as absolute times; Rust uses set_read_timeout/set_write_timeout as durations on TcpStream.
Handling uncaughtException and unhandledRejection
Listen on process for uncaughtException and unhandledRejection, log the error, stop accepting new work, drain in-flight requests, then exit non-zero for a supervisor to restart.
Diagnosing degradation with normal CPU and memory
When CPU and memory look fine, sessions are waiting, not computing; examine wait statistics, lock and latch contention, I/O waits, and buffer pool hit ratio.
Cancellation: Go context vs Rust sync stdlib
Go's context.Context threads a Done channel and deadline through call chains; Rust std has no built-in cancellation, so you wire an AtomicBool or channel and check it.
What JWT claims must you validate beyond the signature?
This tests whether you understand token misuse beyond crypto: time validity, audience and issuer binding, algorithm whitelisting, and required claims enforcement. Red flag: only checking signature and ignoring exp or aud.
Unit, integration, and E2E tests explained
Unit tests isolate one function with dependencies mocked, integration tests exercise several units together (route plus DB), E2E tests drive the whole running system.
Defense-in-depth against SQL injection
Beyond parameterization, apply least-privilege accounts, stored procedures, input allowlisting, and monitoring to shrink blast radius.
Frontend on localhost:3000 gets errors calling FastAPI on localhost:8000. Name and fix?
This tests whether different ports mean different origins, causing CORS errors. A strong answer names CORS, notes ports are distinct origins, and outlines using CORSMiddleware with allow_origins.
How do you write a table-driven test in Go?
Tests idiomatic Go test design. A strong answer: slice/map of structs with inputs/expected outputs, loop with t.Run for named subtests, and cite DRY code, parallelization, and failure isolation. Red flag: separate Test functions per case or omitting t.Run.
Writing a basic Jest unit test
Import the function, group cases with describe, define each case with it or test, assert with expect and a matcher like toBe, covering normal and edge inputs.
Purpose of database drivers (JDBC/ODBC)
A driver translates a standard API into each database's wire protocol, so app code stays portable across vendors.
How do you send an email without blocking a FastAPI request?
Tests knowledge of FastAPI's BackgroundTasks for post-response work. Strong answer: import it, inject into the endpoint, define a task function, and call add_task before returning.
How does Rust differentiate unit and integration tests?
Tests Rust test layout and privacy. Unit tests sit in src/ under #[cfg(test)] and call private functions via super::. Integration tests go in tests/ as external crates. Wrong: claiming it blocks private testing or merging them into src/.
Integration testing a POST endpoint with Supertest
Pass the Express app to supertest, send a POST with a body, then assert status 201, the response shape, and the persisted side effect; also test validation failures.
Connection pools and the problem they solve
A pool reuses pre-opened connections so requests skip the expensive connect handshake; without one, every request pays setup latency and may overwhelm the database.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles