Full-stack engineer role-specific interview questions

As asked

Walk me through how you would set up a CI/CD pipeline for a monorepo with a Next.js frontend and a Node.js API service. What does each stage do, how do you handle environment secrets, and how do you do zero-downtime deployments?

Sample answer outline

A typical pipeline: lint/type-check, unit tests, integration tests against a test database, Docker build and push to a registry, then deploy. Secrets management means storing them in GitHub Actions secrets or Vault and injecting them as environment variables at build and deploy time, never in the image layer. Zero-downtime deployment uses blue-green or rolling updates: spin up the new container, run health checks, then shift traffic. On Kubernetes this is a rolling update by default. On single-server setups you can use Docker Compose with a reverse proxy health check.

Expect these follow-ups

• How do you handle database migrations in a zero-downtime deployment where the old and new code must both work against the same schema during the transition?

As asked

A Postgres query that has been running fine for months starts timing out in production. No code was deployed in the last week. What is your investigation process?

Sample answer outline

Check for data volume changes: has the table grown past a threshold where the query planner now prefers a sequential scan over an index scan? Run EXPLAIN ANALYZE on a replica. Check for bloat: high table bloat due to dead tuples degrades performance (run VACUUM ANALYZE). Check for lock contention: long-running transactions or lock waits (pg_stat_activity, pg_locks). Check for missing statistics (last ANALYZE run). Other causes: a new index was removed, autovacuum was disabled, or a correlated column value changed in a way that breaks the planner's estimate. Short-term fix: add a query timeout and return a graceful error. Long-term: ANALYZE, add or rebuild indexes, reduce bloat.

Expect these follow-ups

• How do you prevent this from happening silently in the future?

As asked

Your team has significant technical debt that is slowing down feature development, but the product roadmap is fully loaded with new features for the next quarter. How do you approach this situation?

Sample answer outline

Quantify the cost: how many hours per sprint does the debt cost the team? Tie it to business outcomes (feature cycle time, bug rate, on-call incidents). Propose a structured allocation (e.g., 20% of sprint capacity for tech debt), not a big-bang refactor quarter. Identify which pieces of debt block the highest-value features and propose doing those first. Frame it as an investment in velocity rather than a cost. The candidate should show that they can speak the language of business impact rather than just technical purity.

Expect these follow-ups

• How do you decide which technical debt to tackle first when everything feels urgent?

As asked

Cloudflare Workers run at the edge using the V8 isolate model rather than containers or Lambda-style sandboxes. Walk me through what that means in practice: cold starts, memory isolation, CPU time limits, and what constraints a developer has to design around that they would not hit in AWS Lambda.

Sample answer outline

A strong answer explains that isolates share a single V8 heap partition per PoP but are isolated from each other without OS process overhead, giving near-zero cold starts (sub-millisecond vs hundreds of ms in Lambda). CPU time is capped (10ms on free, 30s on paid with Unbound), wall-clock time is different from CPU time. No filesystem access, no native modules, limited Node.js compatibility (Workers runtime is not Node.js). Memory per isolate is capped at 128MB. Strong candidates mention Durable Objects for stateful coordination and how KV is eventually consistent while Durable Objects give strong consistency.

Expect these follow-ups

• What happens to in-flight requests when Cloudflare deploys a new version of your Worker?
• How would you handle a task that takes longer than the CPU time limit?

As asked

You are starting a new TypeScript full-stack app. Walk me through how you would choose between tRPC, REST, and GraphQL.

Sample answer outline

tRPC: best when client and server are both TypeScript in the same repo. End-to-end types for free, no codegen, fastest to ship. Falls down if you have non-TS clients (mobile, public API) or want a stable wire contract. REST: stable, well-understood, easy to cache at the CDN, good for public APIs. Verbose for complex resource graphs. GraphQL: best when many clients consume different shapes of the same data graph, or when product teams need to evolve the API without coordinating. Heavier infra (resolvers, dataloaders, persisted queries) and learning curve. Pick by team shape and client diversity, not by which is fashionable.

Expect these follow-ups

• When would you mix tRPC for internal routes and REST for external?
• What is the migration path from REST to GraphQL if you outgrow REST?
• How does Server Actions in Next.js change this calculus?

As asked

Your Node.js Docker builds take 8 minutes because npm install runs on every code change. Walk me through how you would restructure the Dockerfile to fix this, and what other optimizations you would make for a production image.

Sample answer outline

The fix is to copy package.json and package-lock.json before copying the rest of the source, so npm install is only re-run when dependencies change. For production: use a multi-stage build (builder stage runs npm install and builds, final stage uses a slim node:alpine image and copies only node_modules and the compiled output). This reduces the image from gigabytes to under 200 MB. Additional optimizations: use npm ci instead of npm install, set NODE_ENV=production to skip devDependencies, and use .dockerignore to exclude node_modules and .git.

Expect these follow-ups

• What is the difference between COPY and ADD in a Dockerfile, and when would you use ADD?

As asked

Your app depends on a payment provider API. At 10am, the provider's status page shows a major outage with no ETA. Orders cannot be placed. What decisions do you make and what do you communicate?

Sample answer outline

Immediate: confirm the outage is external (not your own integration issue), communicate internally, update the user-facing status page, disable the checkout flow gracefully with a clear message rather than showing cryptic errors. Assess if queuing orders locally is feasible and safe. Check if the payment provider has a fallback or test mode. Communicate estimated impact to the business. After recovery: implement a circuit breaker pattern so future outages degrade gracefully without cascading, add the provider status API to your monitoring, and consider a secondary payment provider for failover.

Expect these follow-ups

• How would you implement a circuit breaker in Node.js to wrap this third-party API call?

As asked

You are reviewing a PR from a colleague that adds an API endpoint GET /api/orders/{orderId}. The handler fetches the order by ID from the database and returns it, but does not check if the requesting user owns that order. What do you do?

Sample answer outline

This is an Insecure Direct Object Reference (IDOR). First, add a clear blocking review comment explaining the vulnerability and its severity. The fix is to add a WHERE user_id = current_user_id check to the database query. Check if similar patterns exist in other endpoints and open follow-up issues. If the PR is already merged and the endpoint is in production, treat it as a security incident: assess exposure (are order IDs sequential or UUIDs?), deploy a fix immediately, check access logs for evidence of exploitation, and notify the security team. The candidate should distinguish between blocking in review vs escalating if it is already live.

Expect these follow-ups

• How would you use UUIDs vs sequential IDs to reduce but not eliminate IDOR risk?

As asked

Product tells you that a new campaign will bring 10x the current traffic in two weeks. Your current Node.js and Postgres stack handles 1K req/s. What do you investigate first, and what changes can you realistically make in two weeks?

Sample answer outline

Identify the actual bottleneck first with load testing rather than guessing. At 10x traffic, likely bottlenecks are: database connection pool exhaustion, no read replica for read-heavy queries, API endpoints missing caching, static assets served from Node rather than a CDN. Two-week realistic wins: add a Postgres read replica and route reads there, add Redis caching on hot endpoints, enable CDN for static assets, set up horizontal scaling for the Node.js tier, tune connection pool sizes. Longer-term: database indexing audit, query optimization. The candidate should push back on the premise: has the product manager confirmed it is actually 10x and that it is sustained, not a one-hour spike?

Expect these follow-ups

• How would you load test your stack before the launch to find the breaking point?

As asked

Cloudflare KV is eventually consistent. Durable Objects provide strong consistency. Describe the design of Durable Objects: how they achieve serialized execution, how they handle migration between PoPs, and when you would pick Durable Objects over KV for a real application.

Sample answer outline

A strong answer explains that each Durable Object is a single-threaded actor with a unique ID, always running in exactly one PoP at a time. All requests to that object are serialized by the runtime, so there are no concurrent writes. The Durable Object storage API is asynchronous (returns Promises) but requests are processed one at a time, so callers never observe interleaved state. Migration happens when the runtime decides to move an object to a different PoP; in-flight requests are drained first. Use DOs over KV when you need transactions, counters, WebSocket connection state, or any write-read consistency guarantee. KV is fine for read-heavy globally replicated config.

Expect these follow-ups

• How would you implement a rate limiter using Durable Objects?
• What is the latency trade-off when a client in Tokyo hits a Durable Object pinned to a US PoP?

As asked

A customer reports that their Cloudflare cache hit ratio dropped from 85% to 30% overnight with no configuration changes on their end. Walk me through how you would diagnose this step by step.

Sample answer outline

A methodical answer checks Cache-Control and Vary headers in the origin response first, since a new Vary: Cookie or no-store directive would bypass the cache. Then check if query string parameters changed (new tracking params creating cache key fragmentation). Look at whether the origin started returning Set-Cookie on cached responses (which Cloudflare treats as a bypass signal). Check if the customer deployed a new Cache Rule or Page Rule that altered caching behavior. Strong candidates mention using Cloudflare Cache Analytics and the CF-Cache-Status response header (HIT, MISS, EXPIRED, BYPASS, DYNAMIC) to narrow down which status is spiking.

Expect these follow-ups

• How would you use a Cache Rule to cache responses that include Set-Cookie?
• What is edge cache TTL vs browser cache TTL, and which one does Cloudflare control?

As asked

You are building a multi-tenant SaaS on Cloudflare Workers. Each tenant has a configuration object that changes rarely and is read on every request. Some tenants also need transactional writes across multiple records. Walk me through how you would pick between KV, D1, and Durable Objects for each use case.

Sample answer outline

KV is ideal for the configuration read: globally replicated, eventually consistent, very low read latency, handles high read fanout. D1 (SQLite at the edge) is good for structured relational data with SQL queries and ACID transactions within a database, but it has regional consistency and is not globally replicated the way KV is. Durable Objects suit the transactional use case when you need cross-record consistency with strong ordering. A strong answer draws the distinction clearly: KV for hot reads, D1 for structured SQL with ACID within a region, DOs for actor-model coordination or cross-record transactions with global ordering.

Expect these follow-ups

• What happens to a D1 database query latency for a user in Sydney if the database is hosted in North America?
• How would you replicate a D1 database closer to users in multiple regions?

As asked

You are setting up a CI/CD pipeline for a critical Cloudflare Worker that handles payment redirects. Walk me through how you would structure environments (dev, staging, prod), manage secrets, handle rollbacks, and use Wrangler's features to minimize deployment risk.

Sample answer outline

A strong answer uses Wrangler environments in wrangler.toml to separate dev/staging/prod with different KV namespaces, route patterns, and Worker names. Secrets are stored in Cloudflare's encrypted secret store via `wrangler secret put` rather than in source code. Deployments use `wrangler deploy` gated by CI tests. Rollback uses `wrangler rollback` to revert to the last version, or candidates mention Gradual Deployments (percentage-based traffic splitting between old and new Worker versions). Monitoring uses Cloudflare Workers analytics and logpush to detect errors post-deploy.

Expect these follow-ups

• How does Cloudflare's version control for Workers differ from a typical containerized deployment?
• What is a Workers Placement Hint and when would you use it?

As asked

A user in Singapore is reporting a time-to-first-byte of 800ms on a Cloudflare-proxied site. The origin is in Frankfurt. Walk me through how you would identify where the latency is coming from, using Cloudflare's tools and standard network diagnostics.

Sample answer outline

A strong answer starts with checking CF-Cache-Status to confirm the response is a cache MISS, then looks at the CF-RAY header to identify which PoP handled the request. With a cache miss, TTFB = edge-to-origin RTT + origin processing + network. Singapore to Frankfurt is roughly 160-180ms RTT bare minimum, so 800ms suggests origin processing or a TCP handshake to origin adding overhead. Next steps: check if Argo Smart Routing is enabled (uses Cloudflare's private backbone), look at origin response time in Cloudflare Analytics, and use the Observatory tool. If origin has keep-alive misconfigured, new TCP handshakes on each request add hundreds of ms.

Expect these follow-ups

• What is Argo Smart Routing and under what conditions does it most improve latency?
• How would enabling Cloudflare's Tiered Cache change the origin hit rate for this scenario?

As asked

When would you use Cloudflare Pages over Workers Sites for deploying a web application, and what are the differences in the build pipeline, deployment model, and support for server-side rendering?

Sample answer outline

Cloudflare Pages is the first-class JAMstack deployment platform with built-in CI from GitHub/GitLab, automatic preview deployments per branch, and Pages Functions (backed by Workers) for server-side logic. Workers Sites was the older pattern of manually binding static assets to a Worker. Pages is the right choice for new projects because of the developer experience: automatic builds, preview URLs, rollbacks via the dashboard. Workers Sites is only relevant for legacy setups or when you need very fine control over asset serving logic. For SSR, Pages Functions enable full server-side rendering frameworks like Next.js via the adapter pattern.

Expect these follow-ups

• How do Pages Functions differ from a standalone Worker in terms of request routing?
• What is an _routes.json file in Cloudflare Pages and when would you need one?

As asked

It is 2pm on a Tuesday. A colleague runs a migration that accidentally drops a production Postgres table containing order data for the last 6 months. The table does not exist in any backup from the last 4 hours. What do you do, step by step?

Sample answer outline

Immediate steps: stop writes to the affected area to prevent overwriting WAL segments, escalate to the on-call lead and engineering manager, check if WAL archiving or Point-in-Time Recovery is enabled (pg_waldump or a cloud PITR like RDS PITR). If PITR is available, spin up a restored instance at T-10 minutes and extract the table. Check read replicas: if replication has not caught up, the replica may still have the data. Notify affected teams. After recovery, implement safeguards: require two-factor confirmation for DROP TABLE in migrations, enforce migration review by a second engineer, and test PITR regularly. The candidate should stay calm and prioritize data recovery over blame.

Expect these follow-ups

• What backup and recovery strategy would you put in place after this incident to reduce the recovery time objective in future?

As asked

You wake up to alerts showing your Node.js API is getting 50x normal traffic from a pattern that looks like a DDoS attack. The origin IPs are spread across thousands of addresses. What steps do you take in the first 30 minutes?

Sample answer outline

First: assess impact (is the site down, is it degraded, which endpoints are affected). Enable rate limiting immediately at the CDN/WAF layer (Cloudflare rate limit rules, AWS WAF) before touching application code. Look for attack patterns: is it targeting one endpoint (e.g., /api/auth/login), a specific payload size, or a User-Agent? Block patterns at the CDN. Scale horizontally if the traffic is just large volume. Communicate to stakeholders. After the immediate threat is contained, analyze logs, add alerts for similar patterns, and review whether application-level rate limiting would have caught this sooner.

Expect these follow-ups

• How do you distinguish a DDoS from a legitimate traffic spike, such as from a viral social media post?

As asked

During a log review you notice that your Node.js API has been logging the full request body, including passwords submitted to the /auth/login endpoint. The logs are stored in a cloud logging service and retained for 90 days. What do you do?

Sample answer outline

Treat this as a security incident immediately. Steps: stop further logging of sensitive fields (deploy a fix with a request body sanitizer), notify the security team and follow the incident response process. Assess exposure: who has access to the logging service? Are the passwords hashed in the database (making the leak less severe)? Coordinate with security to purge or restrict access to the affected log streams. Assess if any accounts may have been compromised and whether users need to be notified. After the fix: add a pre-logging sanitizer for all sensitive fields (password, token, credit card, SSN), add a test that asserts no sensitive fields appear in request logs.

Expect these follow-ups

• How do you write a test that asserts your logger never outputs certain fields?