Full-stack engineer domain knowledge interview questions

As asked

Claude's behavior is shaped by three parties: Anthropic, operators who access the API to build products, and end users. Explain how Claude is supposed to handle conflicts between instructions from each of these parties, and give a concrete example of a conflict and the expected resolution.

Sample answer outline

Anthropic's values and guidelines take highest precedence and are baked into the model via training. Operators can customize behavior within Anthropic's policies via the system prompt, such as restricting topics or enabling adult content on appropriate platforms. Users can adjust within what the operator permits. A conflict example: an operator says 'never discuss competitor products' but a user asks about them. Claude should follow the operator restriction since it is a plausible business reason, not an attempt to harm the user. Claude should not follow operator instructions that actively harm users or deceive them in damaging ways.

Expect these follow-ups

• What should Claude do if an operator instructs it to lie to users about being an AI?
• How does this hierarchy change in the API when there is no system prompt at all?

As asked

You are onboarding a backend engineer who has never used Datadog before. Explain the difference between metrics, distributed traces, and logs, and give a concrete example of when you would reach for each one to debug a latency problem in a microservices API.

Sample answer outline

A strong answer explains that metrics are numeric aggregations good for alerting on trends, traces capture the causal chain across service boundaries to find which hop is slow, and logs carry the raw event detail for understanding why a specific request failed. The debugging example should show the three being used in sequence: alert from a p99 latency metric, trace to find the slow downstream call, log on that service to read the specific error.

Expect these follow-ups

• How does Datadog's APM connect traces to the underlying infrastructure metrics?
• What is cardinality and why does it matter when choosing what to put in a metric tag?

As asked

Imagine you are onboarding a new backend engineer to the Jira Software codebase. Walk me through the core data model: what are the primary entities, how do issues, projects, workflows, and boards relate, and where are the key constraints that affect query performance at Atlassian's scale?

Sample answer outline

A strong answer covers: Projects contain Issues; Issues have Types, Statuses, and Priorities; Workflows define valid transitions between Statuses; Boards are views on Issues filtered by JQL. At scale, the candidate should mention that Issues is the highest-cardinality table, that index design on project/status/assignee is critical, and that JQL translates to SQL with multi-tenant isolation per project.

Expect these follow-ups

• How would you shard this data model if a single tenant had 50 million issues?
• Where would you put a caching layer and what would you cache?

As asked

When a user visits a Cloudflare-proxied site, TLS terminates at the Cloudflare edge, not at the origin server. What are the security and privacy implications of this for the website owner and for the end user, and how does Cloudflare address those concerns architecturally?

Sample answer outline

The candidate should acknowledge that Cloudflare can see plaintext traffic between the edge and the browser, which requires a trust relationship. For the origin, the connection from Cloudflare to origin can use origin certificates or full strict TLS. Privacy-sensitive answers mention Cloudflare's Keyless SSL (private key stays on origin) and Geo Key Manager (keys stored only in specific jurisdictions). Strong candidates also mention that this model is what enables Cloudflare to inspect, cache, and transform traffic, which is the source of the product's value.

Expect these follow-ups

• What is Keyless SSL and what problem does it solve for highly regulated customers?
• How does TLS 1.3 change the handshake latency story at the edge?

As asked

Cloudflare R2 is object storage compatible with the S3 API but charges zero egress fees. Explain how Cloudflare makes R2 financially viable at zero egress, what the architectural implications are for how data is served, and what the trade-offs are compared to S3.

Sample answer outline

R2 is financially viable because data served from R2 exits through Cloudflare's network, which Cloudflare owns and pays for at peering costs much lower than AWS's rack-rate egress fees. Cloudflare can afford to not charge egress because it drives lock-in and broader platform adoption. Architecturally, R2 serves objects from the same network as Workers, so internal data access has low latency. Trade-offs include smaller ecosystem maturity vs S3, no transfer acceleration, fewer storage classes, and limited region controls (data jurisdiction is a newer feature). S3 wins on global feature set and third-party integrations.

Expect these follow-ups

• How would you use R2 with Workers to serve a media-heavy application efficiently?
• What consistency model does R2 provide for concurrent writes to the same key?

As asked

A customer says their Datadog Agent is using 800MB of RAM on a host that also runs a memory-constrained application. Walk me through how the Agent is structured internally, what the likely causes of high memory usage are, and what you would recommend the customer investigate first.

Sample answer outline

A strong answer shows familiarity with the Agent's multi-process architecture: the core agent, trace agent, process agent, and logs agent run as separate processes and can be enabled or disabled independently. Memory can spike from high-cardinality DogStatsD traffic, large log buffers, too many enabled checks, or process and container metadata collection. The candidate should recommend checking which agent components are running, reviewing check load with 'datadog-agent check', and tuning log buffer sizes or disabling unused integrations.

Expect these follow-ups

• How would you reduce the Agent's footprint on a memory-constrained host without disabling key integrations?
• What is the DogStatsD protocol and what happens when DogStatsD buffers fill up?

As asked

A customer reports that their Datadog bill doubled overnight and their custom metrics count jumped from 500,000 to 10 million. They have not deployed any new services. Walk me through how you would diagnose the root cause, what Datadog tools you would use, and what the most likely causes are.

Sample answer outline

A strong answer starts with the Metrics Summary page or the Metrics Without Limits audit to identify which metric names grew, then uses tag value distributions to find a tag that suddenly has many new unique values (a user ID, request ID, or pod name added by mistake). Common root causes: a deploy added a high-cardinality tag, a container orchestrator started using pod instance IDs as tag values, or a developer used an HTTP path with IDs as a metric tag. Resolution is to either drop the tag with tag filtering in the Agent or use Metrics Without Limits to index only the needed dimensions.

Expect these follow-ups

• What is Metrics Without Limits and how does it differ from dropping a tag at the Agent level?
• How would you prevent this kind of cardinality explosion from happening again?

As asked

A customer wants to use OpenTelemetry SDKs for instrumentation but send data to Datadog's backend. What are the different ways they can do this, what are the tradeoffs between them, and what Datadog-specific features do they lose or keep in each approach?

Sample answer outline

A strong answer covers three paths: using the OTLP ingest directly to Datadog (simplest, keeps all telemetry, loses some Datadog-specific tags and service map features), using the Datadog Agent as an OTLP gateway (adds Datadog host metadata, infrastructure correlation), and using the OTel Collector with the Datadog exporter (most flexible, good for multi-backend routing). The candidate should know that Datadog's APM features like code hotspots and runtime metrics require the Datadog SDK and are not available via OTel.

Expect these follow-ups

• What is the difference between OTLP/gRPC and OTLP/HTTP and when would you choose each?
• How does the semantic convention mapping between OTel and Datadog affect span names and service names?

As asked

Your team's CI pipelines are getting slower and flakier. Walk me through how you would set up Datadog CI Visibility with GitHub Actions, what the key metrics you would track are, and how you would use the data to prioritize which flaky tests to fix first.

Sample answer outline

A strong answer describes adding the datadog-ci upload command or the Datadog GitHub Actions step to the pipeline, setting DD_API_KEY and pipeline tags, and enabling test visibility with the relevant language tracer. Key metrics: flakiness rate per test, mean duration per test, p95 stage duration per pipeline. To prioritize fixes: sort by flaky rate times blocking impact (does this test block deploys?), then fix the highest-impact flaky tests first, and use the flaky test management dashboard to track improvement.

Expect these follow-ups

• How does Datadog detect a test as flaky rather than genuinely failing?
• How would you use CI Visibility data to set a flakiness budget for your team?

As asked

A Kubernetes pod running a Datadog-instrumented service is stuck in Pending state. You have access to Datadog's Kubernetes Explorer and infrastructure metrics. Walk me through your diagnostic process from first seeing the Pending status to identifying the root cause.

Sample answer outline

A strong answer starts with kubectl describe pod to read the Events section for the scheduler message (resource insufficient, no nodes match affinity, PVC not bound), then checks the Datadog Kubernetes Explorer for node capacity (CPU/memory requests vs limits across the cluster), checks node conditions in the host map for NotReady nodes, and if it is a resource issue, looks at which namespace or team is consuming most of the reserved resources. The candidate should distinguish between pending because of scheduling (no nodes) versus pending because of initialization (init container failing).

Expect these follow-ups

• How would you use Datadog to monitor for pods stuck in Pending state automatically?
• What is the difference between a resource request and a resource limit in Kubernetes scheduling?

As asked

GitLab has native Kubernetes integration and many teams deploy via CI pipelines to k8s clusters. Walk me through what happens if a deployment job applies a new manifest, the pods start crashing, and the rollout needs to be rolled back. What should the pipeline job do and how do you prevent bad deployments from reaching 100% of pods?

Sample answer outline

Strong answers describe: rolling update strategy with maxUnavailable and maxSurge, using kubectl rollout status to poll until ready or timeout, detecting crash loop via exit code or failed rollout check, triggering kubectl rollout undo on failure, and prevention strategies like canary deployments or using GitLab's Auto DevOps progressive delivery with Flagger. They should mention liveness vs. readiness probes as the detection mechanism.

Expect these follow-ups

• How would you set up a canary deployment for a stateful service?
• What's the risk of relying solely on kubectl rollout undo for safety?

As asked

It is 2am. You are on call and you get a page: Notion page loads are failing for 30% of users, error rate is climbing, and your Slack is lighting up. Walk me through exactly what you do in the first 30 minutes.

Sample answer outline

A strong answer follows a clear incident response playbook: (1) acknowledge the alert and open an incident channel, (2) assess impact with dashboards (error rate, affected regions, error type distribution), (3) check recent deploys and roll back the most recent one if there is a strong correlation, (4) mitigate before fully diagnosing (if possible, route traffic around the failing component), (5) communicate status to users and stakeholders every 15 minutes. The candidate should discuss how to triage between a Postgres outage, a bad deploy, a network issue, and a third-party provider failure using the right signals (DB connection pool metrics, APM traces, Cloudflare status). A great answer also covers post-incident: a blameless postmortem within 48 hours and tracking action items to completion.

Expect these follow-ups

• How do you decide whether to roll back or push a hotfix?
• The on-call rotation is burning people out. What systemic changes would you propose to fix the underlying reliability issues?

As asked

Explain what 3D Secure 2 is, why Stripe surfaces it in the PaymentIntent flow, and what happens technically when a payment requires additional authentication. What is the difference between a frictionless flow and a challenge flow, and how does Stripe's SDK help merchants handle both?

Sample answer outline

A strong answer explains that 3DS2 is a protocol allowing the card network to authenticate the cardholder before authorization, shifting fraud liability to the issuer if authentication passes. The frictionless flow uses device data and risk signals to authenticate silently; the challenge flow prompts the user for a biometric or OTP. In Stripe's flow, the PaymentIntent enters requires_action when 3DS is needed, Stripe.js handles the redirect or SDK pop-up, and the intent returns to succeeded or requires_payment_method depending on outcome. Strong Customer Authentication (SCA) under PSD2 for European payments is a plus.

Expect these follow-ups

• Can a merchant choose to skip 3DS for low-risk charges? What are the implications?
• How does SCA under PSD2 in Europe change when and why 3DS is required?

As asked

Adobe tools work extensively with color profiles: sRGB, Adobe RGB, CMYK, and others. Explain what a color profile is, why converting between them can cause visible color shifts, and how you would implement a lossless round-trip conversion pipeline in a backend image processing service.

Sample answer outline

A color profile maps device-specific color values to a device-independent color space (usually CIE XYZ or Lab). Converting sRGB to CMYK involves gamut mapping because CMYK has a smaller gamut; colors outside that gamut must be tone-mapped using a rendering intent (perceptual, relative colorimetric, etc.). A lossless round-trip is only possible within the same gamut. A strong answer mentions ICC profiles, the importance of preserving the embedded profile in the output file, and how to use libraries like Little CMS (lcms2) in a backend service for this conversion rather than implementing the math from scratch.

Expect these follow-ups

• A customer uploads an image with no embedded color profile. What do you assume and why?
• How do you test that your color conversion is numerically accurate without visual inspection?

As asked

Atlassian's Forge platform runs third-party app code inside Atlassian's cloud. From a platform engineering perspective, how does Forge isolate tenant app code, what execution environment does it use, and what constraints does that impose on third-party developers?

Sample answer outline

Forge uses a FaaS model where app functions run in isolated sandboxed environments (V8 isolates or similar). Each invocation is stateless and short-lived. The platform limits outbound network calls to an allowlist, restricts filesystem access, and enforces execution time limits. Developers must use Forge's storage APIs instead of external databases. The candidate should mention the tradeoff: strong security and managed infrastructure versus limited customization compared to Connect apps.

Expect these follow-ups

• How would you handle a Forge app that needs to maintain state across invocations?
• What are the cold-start implications of the FaaS model for Forge apps?

As asked

Coinbase launched Base, an Ethereum L2 built on the OP Stack. A developer asks you whether they should deploy their DeFi protocol on Base or Ethereum mainnet. What tradeoffs do you walk them through?

Sample answer outline

A strong answer covers: Base's significantly lower gas fees and faster finality versus mainnet's deeper liquidity and longer security track record; the trust assumptions of an optimistic rollup (7-day fraud proof window for withdrawals to L1); EVM equivalence on Base meaning most Ethereum tooling and Solidity code works without changes; the sequencer centralization risk on Base today versus Ethereum's more decentralized validator set; and liquidity bootstrapping challenges for a new protocol on a newer chain.

Expect these follow-ups

• What changes in your analysis if the protocol needs trustless cross-chain asset bridging?
• How would you explain the fraud proof window to a user who expects instant finality?

As asked

Traditional vector tools like Illustrator model paths as closed or open Bezier curves where each point connects to exactly two neighbors. Figma introduced vector networks where a point can connect to any number of other points in any direction. As an engineer, what data structure would you use to represent a vector network and what algorithms does this complicate compared to a simple path?

Sample answer outline

A strong answer models the vector network as a directed or undirected graph where vertices are anchor points with Bezier handles and edges are cubic Bezier curves. This immediately complicates fill computation: deciding which regions are 'inside' requires a planar graph algorithm, and hit testing for fill regions requires computing faces of the planar subdivision rather than a simple winding number check. The candidate should mention that self-intersecting edges make fill computation more complex than with simple paths, and that the stroke rendering must handle junctions where more than two edges meet at a vertex. A great answer references computational geometry concepts like the DCEL (doubly connected edge list) for planar subdivisions.

Expect these follow-ups

• How would you compute which closed regions in a vector network should receive a fill color?
• How would you implement boolean operations (union, intersect, subtract) on vector networks?

As asked

GitHub Copilot has a limited context window. When completing code in a large repository, it cannot send all open files to the model. Walk me through how you would design the context selection strategy: what signals you use to rank candidate context, how you fill the prompt budget, and how you'd evaluate whether your selection is actually helping the model.

Sample answer outline

Signals: cursor distance (nearby code is most relevant), import graph (files the current file imports are likely relevant), recently edited files, language-server-derived symbol references, and BM25 or embedding similarity to the prefix. Fill the prompt window greedily by relevance score. Evaluation: held-out completion benchmarks where you ablate each context type and measure exact-match or edit similarity. Discuss latency: retrieval must complete in <50ms to not block the user.

Expect these follow-ups

• How would you handle a monorepo with 10,000 files where the import graph alone spans thousands of transitive dependencies?
• A user is editing a SQL migration file. What context would be uniquely relevant that wouldn't appear in a typical code completion scenario?

As asked

You get placed on an IBM client engagement that involves modernizing a 40-year-old COBOL batch processing system running on z/OS. You have never worked with COBOL or mainframes before. How do you get yourself productive enough to contribute meaningfully within the first month?

Sample answer outline

A strong answer is honest about the learning curve and shows a structured approach: using IBM's own COBOL learning resources, pairing with a team member who knows z/OS, reading the existing JCL and COBOL source to understand data division structure and batch flow before writing anything, and focusing first on reading/testing rather than modifying production code. Bonus for mentioning IBM's open-source COBOL tools and how modern IDEs can help.

Expect these follow-ups

• How would you decide which parts of the system to modernize versus leave on the mainframe?
• What risks would you flag to the client before any code changes on a production mainframe?

As asked

Salesforce has over 40 certifications available through Trailhead. If you were hiring a Salesforce developer, how much weight would you give their certifications versus hands-on experience? What certifications would you expect a senior developer to hold?

Sample answer outline

Strong answers are balanced: certifications show baseline knowledge of the platform and are useful signals especially for candidates without much prior Salesforce work history, but hands-on experience building real solutions matters more. A senior Salesforce developer should minimally hold Platform Developer I (PDI), and ideally Platform Developer II (PDII), which requires a practical coding exam. Application Architect and System Architect are meaningful for senior roles. The candidate should also mention that Trailhead badges supplement but do not replace real project experience.

Expect these follow-ups

• What would you look for in a code review from a certified but inexperienced Salesforce developer?
• How would you get someone up to speed on the Salesforce platform who comes from a strong Java background?

As asked

Salesforce publishes real-time system status at trust.salesforce.com. As a Salesforce engineer, how does the existence of this public trust site affect how you think about your work, particularly around incident response and feature rollouts?

Sample answer outline

Strong answers connect the public trust site to Salesforce's core value of trust and show the candidate understands the stakes. Customer-facing incidents immediately appear on trust.salesforce.com, which means internal engineering standards around availability, change management, and incident response have direct external accountability. The candidate should mention: canary releases to catch regressions before full rollout, strict change advisory board processes, health checks and synthetic monitors that feed the trust page, and the expectation that engineers are on-call with clear runbooks.

Expect these follow-ups

• What does a responsible rollback strategy look like for a platform serving 150,000 customers?
• How would you design a feature flag system to control rollout to a subset of Salesforce orgs?

As asked

Starlink operates thousands of satellites with dynamic orbital positions and millions of ground terminals. What are the most interesting software engineering challenges that scale creates for the ground network management software?

Sample answer outline

A strong answer identifies: fleet management at scale with individual satellite commanding and telemetry, the scheduling problem of routing traffic through a dynamic mesh where satellite-to-satellite and ground links change as orbits evolve, firmware update logistics across a heterogeneous fleet, anomaly detection at a rate where human review per satellite is impossible, and latency management for the user experience. Candidates who have thought about constellation scheduling or inter-satellite link topology stand out.

Expect these follow-ups

• How would you design a safe firmware rollout strategy for 5,000 satellites?
• How do you detect that a satellite is degrading before it becomes a dead piece of debris?

As asked

A merchant's security team asks why using Stripe's hosted fields and tokens means they only need SAQ A instead of SAQ D for PCI compliance. Explain what PCI DSS scope means, how card data flows with and without Stripe.js, and what residual obligations the merchant still has even with Stripe handling tokenization.

Sample answer outline

A strong answer explains that PCI DSS scope covers any system that stores, processes, or transmits cardholder data. Without Stripe.js the merchant's servers are in scope because raw PANs pass through them. With Stripe.js and hosted fields the raw PAN never reaches the merchant's infrastructure so scope reduces to SAQ A. Residual obligations include securing the Stripe API key, ensuring TLS is active, and maintaining a merchant agreement with Stripe. The candidate should note that server-side tokenization using Stripe's API instead of Stripe.js still puts the server in scope for transmission.

Expect these follow-ups

• What happens to PCI scope if the merchant decides to store the last four digits and card brand themselves?
• How does Stripe's radar and authentication product affect the merchant's fraud liability?