Interview questions in Backend Dev, page 18
Profiling a Rust hot loop with perf
Build with debuginfo, perf record cycles or cache-misses, perf report then perf annotate to map counters to source/asm; flamegraph for hotspots.
Why is FastAPI BackgroundTasks poor for multi-minute PDF generation?
Tests whether you know BackgroundTasks is same-process and for seconds, not minutes. Answer: propose a task queue with broker, workers, and result backend; return HTTP 202 with a job ID. Red flag: suggesting FastAPI workers instead of persistence and retries.
Purpose of Helmet middleware in Express
Helmet sets safe response headers like X-Content-Type-Options, HSTS, and CSP, mitigating MIME-sniffing, clickjacking, and protocol downgrade.
Managed RDS vs self-managed DB on EC2
Managed RDS offloads patching, backups, failover, and replication, freeing the team to build product; self-managed EC2 means you own all that toil.
Design DB transaction middleware and identify the background-task pitfall
Tests request-scoped DB lifecycle awareness. Strong answer: middleware closes the session on response, yet BackgroundTasks run afterward, so sharing that session causes crashes or leaks. Red flag: saying background tasks can reuse the request transaction.
Compare Go and Rust approaches to exposing profiling data
Contrast Go's pprof import with Rust crates or profilers, noting runtime versus OS-level sampling.
Preventing XSS when rendering user content in templates
The risk is XSS; default to escaped interpolation (EJS <%= %>, Pug #{}) so HTML is encoded, and avoid raw output (<%- %>) for untrusted data.
Read replica vs Multi-AZ in RDS
Multi-AZ is synchronous standby for failover, read replicas are async copies for read throughput, and the two solve different problems.
How do you test a FastAPI GET endpoint with pytest and TestClient?
Import TestClient and app, write a test_ function, call client.get("/items/1"), assert status_code == 200 and json() matches expected data.
What is go generate and how does it differ from make?
This tests whether go generate is a pre-build code generator, not a build system. Strong answers cover //go:generate directives, no dependency analysis, and committing generated files. A red flag is calling it a make replacement or an automatic build step.
Explaining and preventing CSRF in Express
CSRF abuses a victim's ambient cookies to forge state-changing requests; the server issues an unpredictable token tied to the session, embeds it in forms, and validates it…
Replica lag and read-your-writes consistency
Stale reads come from async replica lag, the guarantee a user expects is read-your-writes, and you route that user's reads to the primary after a write.
What is FastAPI's TestClient and how does it differ from requests?
Tests if you know TestClient runs pytest against the app directly without a live server. Good answers note its HTTPX-based Requests-like API, passing the FastAPI app into the client, and simple asserts. Red flag: saying you need a running server and real URLs.
What are Rust's two macro categories and use cases?
Name macro_rules! for syntax like vec!, and procedural macros for custom derive on structs.
Preventing SQL injection with parameterized queries
The flaw is SQL injection; prevent it with parameterized queries/prepared statements (pg $1, mysql2 ?), never string concatenation, so input is data not code.
Aurora Serverless v2 for spiky traffic
Serverless v2 autoscales capacity in fine-grained ACU steps near-instantly, you pay per-ACU-second, and provisioned is fixed cost regardless of load.
Explain FastAPI dependency overrides with an in-memory SQLite test example
This tests FastAPI's hook for swapping dependencies cleanly in tests. A strong answer names app.dependency_overrides, defines a test-only in-memory SQLite session, and handles teardown. A red flag is patching globals or mocking ORM instead of dependency.
What does unsafe enable in Go and Rust? List two operations.
Go unsafe enables pointer arithmetic and type punning; Rust unsafe permits raw pointer dereferencing and FFI.
Input validation versus output encoding
Validation checks input fits expected rules on entry; encoding makes data safe for a specific output context on exit. You need both; encoding is the real anti-XSS control.
Near-zero-downtime database migration to cloud
Assess and provision, do a full load then continuous CDC replication with a tool like DMS, validate, then cut over with a rollback plan.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles