Backend engineer technical fundamentals interview questions

As asked

Explain the CAP theorem. Give me a concrete example of a system that prioritizes CP and one that prioritizes AP, and tell me how each behaves during a network partition.

Sample answer outline

CAP states that a distributed system can provide at most two of: Consistency (every read returns the latest write), Availability (every request gets a response), and Partition Tolerance (the system continues operating during network splits). During a partition, a CP system (Zookeeper, HBase) rejects requests on the minority partition to preserve consistency. An AP system (Cassandra, DynamoDB) continues serving requests but may return stale data. A strong answer notes that partition tolerance is non-negotiable in real networks, so the real choice is between consistency and availability under partition, and mentions PACELC as a more nuanced model.

Expect these follow-ups

• How does eventual consistency differ from strong consistency in terms of developer guarantees?
• Where does Postgres sit in the CAP model and does that change in a read-replica setup?

As asked

Compare synchronous and asynchronous communication between microservices. For each, tell me the failure modes and what coupling guarantees or problems each introduces.

Sample answer outline

Synchronous (HTTP/gRPC): the caller blocks waiting for a response. If the callee is down, the caller fails immediately. This creates temporal coupling: both services must be available at the same time. It is simpler to reason about because you know the result before continuing. Asynchronous (message queue): the caller sends a message and continues. The callee can be down and processes the message when it recovers. This decouples availability but introduces eventual consistency and makes error propagation harder. A strong answer gives examples of when each is appropriate and mentions the dual-write problem with async communication.

Expect these follow-ups

• How does a saga pattern use asynchronous messaging to coordinate distributed transactions?
• What is choreography versus orchestration in microservices communication?

As asked

Walk me through how you would store passwords in your Postgres user table. What algorithm do you use, what parameters matter, and what is wrong with using SHA-256 or bcrypt with a low cost factor?

Sample answer outline

Use bcrypt, scrypt, or Argon2id. Never store plaintext or use fast hashes like MD5 or SHA-256 for passwords because they are trivially brute-forced with GPU hardware. Bcrypt's cost factor should be tuned so hashing takes 100 to 300ms on your hardware, making offline dictionary attacks expensive. Argon2id is the current recommendation (winner of the Password Hashing Competition) because it is also memory-hard, resisting ASIC attacks. Always include a per-user salt (bcrypt includes one automatically). A strong answer mentions that a low cost factor is effectively insecure because attackers can try billions of hashes per second offline after a database breach.

Expect these follow-ups

• How would you upgrade your existing bcrypt hashes to Argon2id without forcing all users to reset their passwords?
• What is pepper and when would you add it on top of bcrypt?

As asked

Name the correct HTTP status code for each of these: a resource not found, an authenticated user accessing a resource they do not have permission for, a request that would create a duplicate resource, a long-running job accepted for async processing, and a validation error in the request body. Explain why each is correct.

Sample answer outline

404 for not found. 403 Forbidden for authenticated but unauthorized (401 is for unauthenticated). 409 Conflict for duplicates. 202 Accepted for async jobs where the result is not yet available. 422 Unprocessable Entity (or 400 Bad Request with a body explaining validation errors) for validation failures. A strong answer distinguishes 401 from 403 correctly (common mistake) and notes that 400 is appropriate for syntactically malformed requests whereas 422 is better for semantically invalid but well-formed requests.

Expect these follow-ups

• When would you use 503 versus 429 for rate limiting?
• What is the difference between 301 and 302 in the context of API versioning or redirects?

As asked

Explain cache coherence. What problem does it solve, what is the MESI protocol, and what happens at the hardware level when two cores on an AMD Ryzen processor write to the same cache line?

Sample answer outline

Cache coherence ensures that all cores see a consistent view of memory. MESI defines four states per cache line: Modified (dirty, owned), Exclusive (clean, owned), Shared (clean, multiple owners), Invalid. When core A holds a line in Modified and core B requests it, a snoop is issued over the CCX interconnect, core A writes back to L3 or main memory, and core B fetches the updated value. On AMD Ryzen, the CCX interconnect uses the Infinity Fabric to communicate between CCXs, so cross-CCX snoops have higher latency than same-CCX snoops.

Expect these follow-ups

• What is false sharing, and how would you detect and fix it in a C++ program?
• How does the AMD Infinity Fabric affect the coherence latency compared to Intel's ring bus?

As asked

A Coinbase transaction fee is 1.49% of the trade amount. A user buys 0.00312 BTC at $42,385.50 per BTC. Your backend calculates the fee in JavaScript using floating-point arithmetic. What can go wrong and how do you fix it?

Sample answer outline

The candidate should explain that IEEE 754 floating-point representation cannot exactly represent many decimals (0.1 + 0.2 !== 0.3 in JS), which means fee calculations can be off by fractional cents at scale. The fix is to use integer arithmetic in the smallest unit (satoshis for BTC, cents for USD) or a big-decimal library like Decimal.js or bignumber.js. They should also mention how the fee should be rounded (floor, ceil, or banker's rounding) and that the rounding rule should be consistent with regulatory requirements.

Expect these follow-ups

• If a user makes 10,000 trades per day, what is the worst-case cumulative error from naive float arithmetic?
• How do you test your fee calculation code to catch rounding bugs before production?

As asked

A junior engineer wrote this Node.js query to fetch a user's trade history: `db.query('SELECT * FROM trades WHERE user_id = ' + req.params.userId + ' AND asset = \'' + req.query.asset + '\'')` What is wrong with this code, what is the worst-case exploit, and how do you fix it?

Sample answer outline

The candidate should identify string concatenation as the vulnerability, demonstrate a payload like `' OR '1'='1` that returns all trades or `'; DROP TABLE trades;--` as a destructive example, and fix it with parameterized queries or a prepared statement. They should also mention that in a financial context a compromised trades table could expose all user transaction history and PII. A bonus point for mentioning ORMs as a layer of protection and the importance of a security code review gate for database queries.

Expect these follow-ups

• How would you detect if this vulnerability had already been exploited in production?
• What other injection vectors would you check in this same codebase?

As asked

Figma's engineering team receives reports that about 100 users are experiencing a crash when opening a specific file type, but your local reproduction attempts have all failed. The crash shows up only in production. How do you investigate, and what instrumentation or tools do you use?

Sample answer outline

A strong answer covers structured investigation: gather signal from error reporting (Sentry or Datadog) to find the common stack trace, correlate with attributes like browser version, OS, file size, and network conditions to find what the 100 affected users have in common. If a specific file is implicated, request a copy (with user consent) and test with that. Add targeted logging around the suspected code path and deploy behind a feature flag to the affected cohort. A great answer discusses how to safely add canary instrumentation to production without adding latency to the hot path, and how to communicate status to affected users during the investigation.

Expect these follow-ups

• What if the crash is non-deterministic and only occurs 1 in 1000 times, making even targeted reproduction difficult?
• How do you decide when to declare the issue resolved and remove the extra instrumentation?

As asked

IBM client engagements frequently hand off software to the client's own team, so the quality and maintainability of your test suite reflects directly on IBM's reputation. You are building a new Java microservice from scratch that other teams will depend on. Walk me through the full testing strategy you would put in place, from unit tests to production monitoring, including what you test at each layer and how you decide how much coverage is enough.

Sample answer outline

A strong answer covers unit tests for business logic in isolation using mocks (JUnit and Mockito), integration tests for database and external service interactions using a test container or embedded DB, contract tests (Pact or Spring Cloud Contract) since other teams will consume the API, end-to-end smoke tests for the critical paths after deployment, and production observability with structured logging, metrics, and health checks. Coverage targets should be principled (high for core logic, lower for glue code) rather than an arbitrary 80% number.

Expect these follow-ups

• How do you test a method that calls a third-party API with unpredictable response times?
• What is your approach when a bug slips past all your tests into production?

As asked

Microsoft asks this frequently in their OOP/LLD round. Design an elevator control system for a building with N floors and M elevators. Define your classes, their responsibilities, and the core scheduling algorithm. How do you decide which elevator responds to a floor request?

Sample answer outline

Key classes include Elevator (current floor, direction, state, queue of requests), ElevatorController or Dispatcher (receives external requests and assigns them), Floor (with up/down call buttons), and Request. The scheduling algorithm options range from simple FCFS to the SCAN (elevator) algorithm where the elevator sweeps in one direction serving all requests along the way before reversing. Strong candidates explain why SCAN reduces average wait time compared to FCFS and how they handle edge cases like an elevator at capacity or out of service.

Expect these follow-ups

• How would your design change if you needed to support VIP floors that always get priority?
• How would you add an emergency mode that sends all elevators to the ground floor?

As asked

Another classic Microsoft LLD question: design a parking lot system that supports multiple levels, different vehicle sizes (motorcycle, car, truck), automated ticket issuance on entry, and fee calculation on exit based on time parked. Walk me through classes, relationships, and state management.

Sample answer outline

Core classes: ParkingLot (has levels, entry/exit gates), ParkingLevel (has spots), ParkingSpot (type: small/medium/large, occupied/available), Vehicle (type, license plate), Ticket (entry time, spot reference), and FeeCalculator (implements pricing strategy). The spot-finding algorithm traverses levels top-down or with a heap indexed by available spots per level. The candidate should show they know to use an interface or strategy pattern for fee calculation so different pricing models can be swapped. Microsoft tests both class modeling and thinking about concurrency when two cars race to the same spot.

Expect these follow-ups

• How do you handle two cars simultaneously trying to take the last spot on a level?
• How would you extend this to support monthly pass holders who have reserved spots?

As asked

Walk me through how global memory coalescing works in CUDA. If a kernel is reading a 2D matrix column-by-column, what happens at the hardware level and how would you fix it?

Sample answer outline

A strong answer explains that CUDA groups 32 threads into a warp and that the GPU serves a single 128-byte cache line per memory transaction per warp. Reading column-by-column means each thread in the warp accesses a non-contiguous address, causing 32 separate transactions instead of one and wasting bandwidth by a factor of up to 32x. The fix is typically to transpose the access pattern, store the matrix in column-major order, or use shared memory as a staging buffer to re-order the reads. The candidate should mention that modern Ampere and Hopper GPUs have better L2 caches but coalescing still matters at scale.

Reference implementation (cuda)

__global__ void colReadKernel(float* mat, float* out, int rows, int cols) {
  int tid = blockIdx.x * blockDim.x + threadIdx.x;
  // Bad: threads in a warp read from different rows (stride = cols)
  if (tid < cols)
    out[tid] = mat[tid]; // warp reads mat[0], mat[cols], mat[2*cols]...
}
// Fix: transpose first or use shared memory tiling

Expect these follow-ups

• How does shared memory help here and what is its latency relative to global memory?
• How would you profile this bottleneck using Nsight Compute?

As asked

Explain the CUDA thread hierarchy from grid down to warp. Given a 1D array of 1 million floats you want to process in parallel, how would you choose block size and grid size, and why does block size matter for occupancy?

Sample answer outline

A strong answer describes grids as collections of blocks, blocks as groups of up to 1024 threads that share shared memory and can synchronize, and warps as the scheduler's unit of 32 threads that execute in lockstep on SIMT hardware. For 1M elements, a common choice is 256 threads per block giving ceil(1e6/256) = 3907 blocks. Occupancy depends on shared memory used per block and register count per thread, because the SM has fixed pools of both. Larger blocks amortize per-block overhead but burn more registers and shared memory, limiting how many blocks can reside concurrently. The candidate should mention the Occupancy Calculator or Nsight as a tool to tune this.

Expect these follow-ups

• What happens when threads in a warp diverge on an if-else branch?
• How does the Hopper SM's warp scheduler differ from Volta's in handling dependent instructions?

As asked

A business analyst wants to automate a process where creating a high-value Opportunity automatically creates a follow-up Task and sends a Slack message. They are asking you whether to use Salesforce Flow or Apex. How do you decide?

Sample answer outline

Strong answers show the candidate knows the 'automate with clicks first, code second' principle Salesforce promotes. Flow handles this scenario well: record-triggered flows can create child records and call HTTP callouts (or named credentials) for Slack. Apex is justified when logic is complex, requires bulkification beyond what Flow supports, or performance is critical. The candidate should also mention that mixing flows and Apex on the same object can cause ordering and recursion issues that need careful management.

Expect these follow-ups

• What are the performance risks of deeply nested flows on high-volume objects?
• How would you test a Flow in a sandbox?

As asked

Explain CAP. Then tell me what CAP does and does not tell you when you are choosing a database in 2026.

Sample answer outline

CAP says: under a network partition, a distributed system must choose between consistency (every read sees the latest write) and availability (every request gets a response). It does NOT say you pick two out of three in normal operation. The more useful framing is PACELC: in a partition, choose A or C; else, choose latency or consistency. Real systems are not binary either. DynamoDB offers per-request consistency levels. Spanner uses synchronised clocks to give strong consistency at higher latency. The interview answer that matters: which of consistency or availability does your specific application require, with reasons.

Expect these follow-ups

• What does PACELC add over CAP?
• How does Spanner's TrueTime change the CAP discussion?
• Give an example where eventual consistency is the right call.

As asked

Explain the TCP three-way handshake and describe how it contributes to API latency. What techniques does a backend server use to minimize its impact?

Sample answer outline

The three-way handshake (SYN, SYN-ACK, ACK) adds one round-trip before any data is sent. For a client and server 50ms apart, this adds 50ms before the first HTTP byte. Mitigation techniques: keep-alive connections reuse existing TCP connections for multiple requests; connection pooling at the client and server level; TCP Fast Open (TFO) allows data in the initial SYN packet; HTTP/2 multiplexes many requests over one connection. A strong answer also touches on the TLS handshake layered on top of TCP for HTTPS, adding another round-trip.

Expect these follow-ups

• How does HTTP persistent connection (keep-alive) work and when does the server close the connection?
• What is TLS session resumption and how does it reduce latency?

As asked

Explain consistent hashing. Why is it better than simple modulo hashing for distributing data across a cache cluster, and what happens when a node is added or removed?

Sample answer outline

In modulo hashing (key % n), adding or removing a node requires remapping nearly all keys. Consistent hashing places both nodes and keys on a ring of hash values. Each key is served by the nearest node clockwise. When a node is added or removed, only the keys on the arc between that node and its predecessor need remapping, on average 1/n of total keys. Virtual nodes (multiple hash positions per server) distribute load more evenly. A strong answer gives a concrete example of how Redis cluster or Cassandra uses this technique.

Expect these follow-ups

• How do virtual nodes address the hotspot problem in consistent hashing?
• What is the difference between consistent hashing and rendezvous hashing?

As asked

Explain how a B-tree index is structured and why it supports equality, range, and ORDER BY queries efficiently. What is the cost of maintaining a B-tree index on a write-heavy table?

Sample answer outline

A B-tree is a balanced tree where leaf nodes hold the indexed values and pointers to heap pages. Internal nodes hold separator keys for routing. Equality lookups traverse O(log n) levels. Range queries find the starting leaf and scan forward. ORDER BY queries can use the index to avoid a sort if the index covers the ORDER BY columns in the same direction. Write cost: every INSERT, UPDATE, or DELETE that changes the indexed column requires updating the B-tree, adding write amplification and WAL volume. Frequent writes can cause page fragmentation, mitigated by FILLFACTOR settings.

Expect these follow-ups

• What is index bloat and how do you detect and fix it in Postgres?
• How does a covering index eliminate heap fetches?

As asked

What is eventual consistency, and what specific challenges does it create for a developer writing application code? Give me two concrete examples of bugs that arise when code assumes strong consistency but the system provides eventual consistency.

Sample answer outline

Eventual consistency means replicas converge to the same value if no new updates arrive, but reads may return stale data in the meantime. Bug example 1: a user updates their email and immediately reads it back from a replica that has not yet replicated the write; the app shows the old email. Bug example 2: two processes read a stock quantity, both see 1 unit available, both decrement, and the stock goes negative. Fixes: read-your-writes consistency by always reading from the primary for a time window after writes; optimistic or pessimistic locking for inventory; monotonic read consistency. A strong answer names these anomalies precisely.

Expect these follow-ups

• How does DynamoDB's strongly consistent read option work and what does it cost?
• What is the difference between read-your-writes consistency and monotonic reads?

As asked

Compare publish-subscribe and point-to-point messaging. When would you use each, and what are the trade-offs in terms of coupling, fan-out, and message ordering?

Sample answer outline

Point-to-point (queues): one producer, one consumer, message is consumed once. Good for task distribution where exactly one worker should process each job. Pub-sub (topics): one producer, many consumer groups each get a copy. Good for events that multiple systems need to react to (order placed triggers billing, inventory, and notification services). In Kafka, consumer groups implement point-to-point within the group and pub-sub across groups. Ordering is preserved per partition in Kafka; global ordering requires a single partition which limits parallelism.

Expect these follow-ups

• How does Kafka use consumer groups to implement both patterns simultaneously?
• What is the fan-out exchange pattern in RabbitMQ and how does it compare to Kafka topics?

As asked

Explain third normal form. Give me a concrete scenario where you would deliberately violate it and explain the trade-off you are accepting.

Sample answer outline

3NF requires that every non-key attribute depends only on the primary key and not on other non-key attributes (no transitive dependencies). Example violation to accept: storing a denormalized user name on an orders table so that order history queries do not require a JOIN to the users table. The trade-off is update anomalies: if the user changes their name, historical orders still show the old name (which may be desirable for an order receipt). A strong answer distinguishes between denormalization for read performance versus preserving historical state, and mentions materialized views as an alternative that keeps the normalized source of truth.

Expect these follow-ups

• What is a materialized view and how does it differ from a regular view in Postgres?
• When is denormalization preferable to an index for read performance?

As asked

Design the classes and interfaces for a font management library similar to Adobe Fonts. It should support browsing fonts by family and weight, activating a font for use in an application, and tracking which fonts a user has recently used. Walk me through your class hierarchy and the responsibilities of each class.

Sample answer outline

A strong answer separates Font (a specific weight/style), FontFamily (groups fonts), FontLibrary (the collection and search interface), FontActivation (the act of making a font available), and RecentFontsTracker (a bounded history with LRU semantics). The candidate should discuss the open/closed principle when adding new activation sources (local vs cloud), and how to make FontLibrary searchable by multiple criteria without a combinatorial explosion of subclasses. They should mention the observer pattern to notify applications when fonts activate.

Expect these follow-ups

• How do you handle a font that exists both locally and in the cloud and they are different versions?
• How would you serialize a user's font activation state so it persists across restarts?

As asked

Adobe Creative Cloud apps like Photoshop ship on Windows and macOS. Walk me through how you would design a CI/CD pipeline that runs tests, enforces code quality, builds native installers for both platforms, signs them for distribution, and rolls out to users incrementally with the ability to halt a bad release.

Sample answer outline

The pipeline has distinct stages: build (cross-compiled in cloud or on platform-specific agents), unit and integration test (fastest first to fail fast), code signing (separate secure environment with HSM-stored keys), artifact storage (versioned, immutable), and staged rollout (1% of Creative Cloud users via feature flags, automated smoke tests, then progressive percentage increases). Halt mechanism: a global kill switch in the Creative Cloud desktop app that checks a remote config and blocks the update from applying. A strong answer mentions delta updates (only ship changed files, not the full 2 GB installer every time) and the app store constraints on macOS notarization.

Expect these follow-ups

• A security vulnerability is found in the code-signing key. What is your immediate response and how do you re-sign already-shipped artifacts?
• How do you ensure deterministic builds so that two build agents on the same source commit produce byte-identical installers?

As asked

Walk me through what happens from the moment a program dereferences a pointer to when it gets data back from DRAM. Cover the TLB, page table walk, and where AMD's hardware page walker fits in.

Sample answer outline

A strong answer covers: virtual address lookup in the TLB (L1 iTLB/dTLB, L2 TLB); on TLB miss the hardware page table walker traverses the four-level page table (PML4, PDPT, PD, PT) on AMD64; if the page is not present a page fault is raised and the OS handles it (demand paging, COW, swap); once the physical address is found, the cache hierarchy (L1, L2, L3) is checked before DRAM. The candidate should mention the CR3 register holding the PML4 base and that AMD supports 5-level paging on Zen 4 for larger address spaces.

Expect these follow-ups

• What is the cost of a TLB shootdown in a multi-core system and when does it happen?
• How do huge pages (2 MB or 1 GB) reduce TLB pressure and what is the trade-off for using them?

As asked

Explain the difference between a store-load reordering issue and a data race. Write a minimal example in C where two threads produce an unexpected result due to memory reordering, and explain what fence or atomic instruction fixes it.

Sample answer outline

A strong answer distinguishes a data race (concurrent unsynchronized access where at least one is a write, undefined behavior in C++) from memory ordering (a legal but reordered sequence of operations visible to other cores). A classic example is Dekker's mutual exclusion where two flags are set and then read, but stores are not immediately visible to the other core without a fence. The fix is std::atomic with seq_cst or an explicit SFENCE/LFENCE. On AMD x86-64, store-load reordering is the main model violation; most other orderings are respected by the hardware.

Expect these follow-ups

• Why does AMD x86-64 have a stronger memory model than ARM, and how does that affect cross-platform lock-free code?
• What is the cost of a full memory fence on a Zen 4 core compared to a relaxed atomic load?