Founding engineer technical fundamentals interview questions

As asked

A customer reports that your just-launched API feels slow. You suspect the problem is not in your own code. Trace the full lifecycle of an HTTP POST request from the browser through DNS, TCP, TLS, your Node.js process, the database, and back, naming every point where latency can be introduced so you know where to look first.

Sample answer outline

DNS lookup (cacheable, TTL matters), TCP handshake (three-way), TLS handshake (1.3 reduces RTTs), HTTP request arrives at Node.js event loop, middleware chain (auth, parsing), database query (connection pool checkout, query execution, network to DB), response construction, and client-side rendering. Latency points: DNS TTL expiry, TLS negotiation on first connection, DB connection pool exhaustion, slow query, large response payload.

Expect these follow-ups

• What does Keep-Alive do and when would you disable it?
• Where does the overhead of a connection pool fit into this lifecycle and how do you measure it?

As asked

You are the only engineer designing the API that both the web frontend and the React Native mobile app will consume, and you will also be the person maintaining it for the next two years. Make the case for REST, then make the case for GraphQL, then tell me which one you would actually pick and why, given that you have no dedicated API team and must keep the surface area small.

Sample answer outline

REST case: simpler caching with HTTP semantics, easier for third-party integrators, no N+1 on the client if you design endpoints well, and no schema maintenance overhead. GraphQL case: mobile apps often need fewer fields than a REST endpoint returns (bandwidth), a single schema replaces API docs, and the type system catches mismatches. Pick: REST with a few specialized endpoints for the mobile app is the right founding-engineer answer, GraphQL at this stage adds schema maintenance burden without enough mobile complexity to justify it.

Expect these follow-ups

• A mobile client says loading the home screen requires seven separate REST calls. Does that change your answer?
• How do you handle field-level authorization in GraphQL without leaking data to unauthorized users?

As asked

A junior engineer you just hired is confused about why their async Node.js code sometimes executes in an unexpected order, mixing setTimeout, Promise.then, and queueMicrotask. Explain the JavaScript event loop and microtask queue clearly enough that they can reason about execution order themselves. What is the difference between the macrotask queue and the microtask queue, and what practical problem does this cause in a real API server?

Sample answer outline

Synchronous code runs first. After the call stack empties, the microtask queue is drained completely (Promise callbacks, queueMicrotask, MutationObserver). Only then does the event loop pick one macrotask from the macrotask queue (setTimeout, setInterval, I/O callbacks). After each macrotask, microtasks are drained again. Practical implication: a long chain of resolved Promises can starve setTimeout callbacks.

Expect these follow-ups

• If you resolve a thousand promises synchronously in a loop, what happens to the event loop?
• How does async/await map to the Promise microtask queue under the hood?

As asked

You are the only engineer setting up a new TypeScript codebase from scratch and no one will review your tsconfig. Should you enable strict mode on day one? Walk me through exactly which strict flags matter most, what errors they catch, and what the cost is when every sprint is adding new features and you are the person unblocking everyone else.

Sample answer outline

Strong answer covers noImplicitAny, strictNullChecks, and strictFunctionTypes as the highest-value flags, explains that enabling them after the fact is exponentially harder than starting with them, and acknowledges the up-front cost of writing more precise types. Candidate should mention ts-ignore as a valid short-term escape hatch with a rule to audit it quarterly.

Expect these follow-ups

• How do you handle a third-party package that ships poor TypeScript types or no types at all?
• You are refactoring a JavaScript codebase to TypeScript. What is the order in which you add types?

As asked

Explain CAP theorem in plain language and tell me what it means in practice when you are choosing between a single-region Postgres cluster, a multi-region Postgres setup, and DynamoDB for a startup's primary data store.

Sample answer outline

CAP: in the presence of a network partition, a distributed system must sacrifice either consistency or availability. Single-region Postgres is CA for most purposes because partitions within a data center are rare. Multi-region Postgres (with synchronous replication) sacrifices availability for consistency under cross-region partition. DynamoDB is AP by default. The practical point: for most startups, CAP is theoretical because single-region deployment means partitions are not the real risk.

Expect these follow-ups

• What is the PACELC model and how does it improve on CAP for practical database selection?
• A customer requires their data to be in two regions simultaneously with no data loss. What does that cost you in terms of write latency?

As asked

Your production site goes down because a TLS certificate expired and no one noticed. Walk me through what a TLS certificate is, why browsers rejected it, how Let's Encrypt works, and how you set up certificate renewal automation so this never happens again, all as the only person responsible for the server.

Sample answer outline

A TLS cert is a signed document proving a domain is controlled by the private key holder, signed by a trusted CA in the browser's root store. Self-signed certs have no chain of trust. Let's Encrypt uses the ACME protocol: the client proves domain control by placing a challenge file at a well-known URL or a DNS TXT record. Renewal automation: certbot or Caddy handles this automatically; the operational risk is when a cert is behind a load balancer that is not configured to auto-renew.

Expect these follow-ups

• Your cert renews automatically but the load balancer does not pick up the new cert. How do you detect and fix that?
• What is HSTS and why can enabling it with a short max-age be dangerous?

As asked

Walk me through the OAuth 2.0 authorization code flow as if you are implementing 'Login with Google' in a Next.js app. Name every redirect, every token, and explain the purpose of the state parameter.

Sample answer outline

User clicks login, your app redirects to Google with client_id, scope, redirect_uri, and a random state value stored in session. Google authenticates and redirects back with an authorization code and the state. Your server validates the state (CSRF protection), exchanges the code for access and refresh tokens via a back-channel POST to Google's token endpoint using the client secret. Access token is used to call Google APIs; refresh token is stored and used to get new access tokens when they expire.

Expect these follow-ups

• Why does the authorization code flow use a back-channel token exchange instead of returning the token in the redirect?
• What is PKCE and when do you need it?

As asked

You are designing a payment endpoint and a webhook delivery system for your product. Explain idempotency in the context of HTTP APIs, which HTTP methods are idempotent by definition and which are not, and give a concrete example of a customer being charged twice because a non-idempotent endpoint was called twice due to a network retry. How do you prevent it?

Sample answer outline

GET, PUT, DELETE, and HEAD are idempotent by definition. POST is not. Concrete bug: a payment POST endpoint is called, the network times out, the client retries, and the user is charged twice. Fix: client sends an idempotency key (UUID) with the request; the server stores the key and result on first call and returns the stored result on duplicate calls within a time window.

Expect these follow-ups

• How do you implement idempotency keys in Postgres without a race condition?
• DELETE is idempotent but your API returns 404 on the second call. Is that acceptable?

As asked

You are migrating your product from one hosting provider to another over a weekend with no downtime window and you are the only engineer online. Explain how DNS propagation works, why lowering the TTL matters, and describe the exact sequence of steps you take to minimize downtime. What is the worst mistake you can make and how do you avoid it?

Sample answer outline

DNS records are cached by resolvers up to their TTL. Lower the TTL to 60 seconds at least 48 hours before the migration (to flush existing cached records with the old long TTL). During the migration window, bring the new server up, verify it works, then update the DNS A record. Old TTL records expire within 60 seconds. Verify with dig +short from multiple regions before declaring success.

Expect these follow-ups

• Your DNS TTL was 86400 seconds and you forgot to lower it. You have already updated the A record. What do you do?
• How does a CDN's Anycast routing interact with standard DNS propagation?