Full-stack engineer technical fundamentals interview questions

As asked

What is CORS and why does the browser enforce it? Walk me through how a preflight request works, and what Access-Control headers you need to set on an Express API so that a React app on a different origin can make authenticated POST requests.

Sample answer outline

CORS is enforced by the browser to prevent a malicious website from making authenticated requests to a different origin using the user's credentials. For cross-origin POST with credentials, the browser first sends an OPTIONS preflight request. The server must respond with Access-Control-Allow-Origin (the specific origin, not * when credentials are involved), Access-Control-Allow-Methods, Access-Control-Allow-Headers, and Access-Control-Allow-Credentials: true. The candidate should know that * is not allowed when credentials are used, that the cors npm package configures this, and that CORS is a browser policy (server-to-server calls are not affected).

Expect these follow-ups

• Why does setting Access-Control-Allow-Origin: * not work with credentials, and what do you do instead for multiple allowed origins?

As asked

Walk me through the decision process you use to choose between Postgres and a document database like MongoDB for a new project. What data characteristics and access patterns push you toward each?

Sample answer outline

Postgres shines when: data has complex relationships (foreign keys, joins), you need ACID transactions across multiple entities, the schema is relatively stable, or you need strong consistency. MongoDB/document DBs suit: document-oriented data with highly variable shapes, high-volume write workloads that benefit from horizontal sharding, or when schema flexibility during rapid development is more important than relational integrity. The candidate should note that Postgres's JSONB column bridges the gap for semi-structured data. They should avoid the common mistake of treating 'NoSQL = scale' as a binary rule.

Expect these follow-ups

• In what scenario would you use both Postgres and MongoDB in the same application?

As asked

A Coinbase transaction fee is 1.49% of the trade amount. A user buys 0.00312 BTC at $42,385.50 per BTC. Your backend calculates the fee in JavaScript using floating-point arithmetic. What can go wrong and how do you fix it?

Sample answer outline

The candidate should explain that IEEE 754 floating-point representation cannot exactly represent many decimals (0.1 + 0.2 !== 0.3 in JS), which means fee calculations can be off by fractional cents at scale. The fix is to use integer arithmetic in the smallest unit (satoshis for BTC, cents for USD) or a big-decimal library like Decimal.js or bignumber.js. They should also mention how the fee should be rounded (floor, ceil, or banker's rounding) and that the rounding rule should be consistent with regulatory requirements.

Expect these follow-ups

• If a user makes 10,000 trades per day, what is the worst-case cumulative error from naive float arithmetic?
• How do you test your fee calculation code to catch rounding bugs before production?

As asked

A junior engineer wrote this Node.js query to fetch a user's trade history: `db.query('SELECT * FROM trades WHERE user_id = ' + req.params.userId + ' AND asset = \'' + req.query.asset + '\'')` What is wrong with this code, what is the worst-case exploit, and how do you fix it?

Sample answer outline

The candidate should identify string concatenation as the vulnerability, demonstrate a payload like `' OR '1'='1` that returns all trades or `'; DROP TABLE trades;--` as a destructive example, and fix it with parameterized queries or a prepared statement. They should also mention that in a financial context a compromised trades table could expose all user transaction history and PII. A bonus point for mentioning ORMs as a layer of protection and the importance of a security code review gate for database queries.

Expect these follow-ups

• How would you detect if this vulnerability had already been exploited in production?
• What other injection vectors would you check in this same codebase?

As asked

Figma's engineering team receives reports that about 100 users are experiencing a crash when opening a specific file type, but your local reproduction attempts have all failed. The crash shows up only in production. How do you investigate, and what instrumentation or tools do you use?

Sample answer outline

A strong answer covers structured investigation: gather signal from error reporting (Sentry or Datadog) to find the common stack trace, correlate with attributes like browser version, OS, file size, and network conditions to find what the 100 affected users have in common. If a specific file is implicated, request a copy (with user consent) and test with that. Add targeted logging around the suspected code path and deploy behind a feature flag to the affected cohort. A great answer discusses how to safely add canary instrumentation to production without adding latency to the hot path, and how to communicate status to affected users during the investigation.

Expect these follow-ups

• What if the crash is non-deterministic and only occurs 1 in 1000 times, making even targeted reproduction difficult?
• How do you decide when to declare the issue resolved and remove the extra instrumentation?

As asked

IBM client engagements frequently hand off software to the client's own team, so the quality and maintainability of your test suite reflects directly on IBM's reputation. You are building a new Java microservice from scratch that other teams will depend on. Walk me through the full testing strategy you would put in place, from unit tests to production monitoring, including what you test at each layer and how you decide how much coverage is enough.

Sample answer outline

A strong answer covers unit tests for business logic in isolation using mocks (JUnit and Mockito), integration tests for database and external service interactions using a test container or embedded DB, contract tests (Pact or Spring Cloud Contract) since other teams will consume the API, end-to-end smoke tests for the critical paths after deployment, and production observability with structured logging, metrics, and health checks. Coverage targets should be principled (high for core logic, lower for glue code) rather than an arbitrary 80% number.

Expect these follow-ups

• How do you test a method that calls a third-party API with unpredictable response times?
• What is your approach when a bug slips past all your tests into production?

As asked

Microsoft asks this frequently in their OOP/LLD round. Design an elevator control system for a building with N floors and M elevators. Define your classes, their responsibilities, and the core scheduling algorithm. How do you decide which elevator responds to a floor request?

Sample answer outline

Key classes include Elevator (current floor, direction, state, queue of requests), ElevatorController or Dispatcher (receives external requests and assigns them), Floor (with up/down call buttons), and Request. The scheduling algorithm options range from simple FCFS to the SCAN (elevator) algorithm where the elevator sweeps in one direction serving all requests along the way before reversing. Strong candidates explain why SCAN reduces average wait time compared to FCFS and how they handle edge cases like an elevator at capacity or out of service.

Expect these follow-ups

• How would your design change if you needed to support VIP floors that always get priority?
• How would you add an emergency mode that sends all elevators to the ground floor?

As asked

Another classic Microsoft LLD question: design a parking lot system that supports multiple levels, different vehicle sizes (motorcycle, car, truck), automated ticket issuance on entry, and fee calculation on exit based on time parked. Walk me through classes, relationships, and state management.

Sample answer outline

Core classes: ParkingLot (has levels, entry/exit gates), ParkingLevel (has spots), ParkingSpot (type: small/medium/large, occupied/available), Vehicle (type, license plate), Ticket (entry time, spot reference), and FeeCalculator (implements pricing strategy). The spot-finding algorithm traverses levels top-down or with a heap indexed by available spots per level. The candidate should show they know to use an interface or strategy pattern for fee calculation so different pricing models can be swapped. Microsoft tests both class modeling and thinking about concurrency when two cars race to the same spot.

Expect these follow-ups

• How do you handle two cars simultaneously trying to take the last spot on a level?
• How would you extend this to support monthly pass holders who have reserved spots?

As asked

A business analyst wants to automate a process where creating a high-value Opportunity automatically creates a follow-up Task and sends a Slack message. They are asking you whether to use Salesforce Flow or Apex. How do you decide?

Sample answer outline

Strong answers show the candidate knows the 'automate with clicks first, code second' principle Salesforce promotes. Flow handles this scenario well: record-triggered flows can create child records and call HTTP callouts (or named credentials) for Slack. Apex is justified when logic is complex, requires bulkification beyond what Flow supports, or performance is critical. The candidate should also mention that mixing flows and Apex on the same object can cause ordering and recursion issues that need careful management.

Expect these follow-ups

• What are the performance risks of deeply nested flows on high-volume objects?
• How would you test a Flow in a sandbox?

As asked

Design the classes and interfaces for a font management library similar to Adobe Fonts. It should support browsing fonts by family and weight, activating a font for use in an application, and tracking which fonts a user has recently used. Walk me through your class hierarchy and the responsibilities of each class.

Sample answer outline

A strong answer separates Font (a specific weight/style), FontFamily (groups fonts), FontLibrary (the collection and search interface), FontActivation (the act of making a font available), and RecentFontsTracker (a bounded history with LRU semantics). The candidate should discuss the open/closed principle when adding new activation sources (local vs cloud), and how to make FontLibrary searchable by multiple criteria without a combinatorial explosion of subclasses. They should mention the observer pattern to notify applications when fonts activate.

Expect these follow-ups

• How do you handle a font that exists both locally and in the cloud and they are different versions?
• How would you serialize a user's font activation state so it persists across restarts?

As asked

Adobe Creative Cloud apps like Photoshop ship on Windows and macOS. Walk me through how you would design a CI/CD pipeline that runs tests, enforces code quality, builds native installers for both platforms, signs them for distribution, and rolls out to users incrementally with the ability to halt a bad release.

Sample answer outline

The pipeline has distinct stages: build (cross-compiled in cloud or on platform-specific agents), unit and integration test (fastest first to fail fast), code signing (separate secure environment with HSM-stored keys), artifact storage (versioned, immutable), and staged rollout (1% of Creative Cloud users via feature flags, automated smoke tests, then progressive percentage increases). Halt mechanism: a global kill switch in the Creative Cloud desktop app that checks a remote config and blocks the update from applying. A strong answer mentions delta updates (only ship changed files, not the full 2 GB installer every time) and the app store constraints on macOS notarization.

Expect these follow-ups

• A security vulnerability is found in the code-signing key. What is your immediate response and how do you re-sign already-shipped artifacts?
• How do you ensure deterministic builds so that two build agents on the same source commit produce byte-identical installers?

As asked

The Figma Plugin API exposes complex node types with dozens of optional and required properties. Write a TypeScript generic utility type DeepPartial<T> that makes every property at every level of nesting optional. Then write a function that deep-merges two partial nodes, with the second argument taking priority on conflicts.

Sample answer outline

A strong answer correctly defines DeepPartial<T> using a mapped type that conditionally recurses into object types while leaving primitives, arrays, and function types alone. The deep merge function should use recursion, handle null vs undefined correctly, and not mutate either input. A great candidate discusses edge cases: merging arrays (overwrite vs concatenate), merging class instances (prototype chain), and the behavior when one side has a key with value undefined vs the key being absent.

Reference implementation (typescript)

type DeepPartial<T> = {
  // your implementation
};

function deepMerge<T extends object>(
  base: DeepPartial<T>,
  override: DeepPartial<T>
): DeepPartial<T> {
  // your implementation
}

Expect these follow-ups

• How does your DeepPartial handle an array property like children?: FigmaNode[], should it become (Partial<FigmaNode>)[] or just FigmaNode[]?
• What happens if you pass a deeply nested class instance instead of a plain object to your merge function?

As asked

Google uses Protocol Buffers as the standard serialization format for most internal service communication. What are the concrete technical reasons for this choice over JSON, and in what situations would you still prefer JSON?

Sample answer outline

Protobuf is smaller (binary encoding with field numbers instead of string keys), faster to serialize and deserialize, and enforces a schema with typed fields and backward-compatible evolution rules. JSON is human-readable, easier to debug without tooling, and the natural choice for external-facing APIs or browser clients. A strong candidate mentions field number evolution (adding optional fields is backward-compatible), the generated code across languages, and the fact that schema enforcement catches type errors at build time rather than runtime.

Expect these follow-ups

• How does Protobuf handle schema evolution when you remove a field that old clients still send?
• When would you choose MessagePack over Protobuf?

As asked

Explain consistent hashing. Why is it better than simple modulo hashing for distributing keys across a cluster of servers? Describe a concrete scenario inside a large distributed system, like a cache or a distributed storage layer, where consistent hashing solves a real problem.

Sample answer outline

A strong answer explains that with modulo hashing, adding or removing one server remaps nearly all keys. Consistent hashing maps both servers and keys onto a ring, so adding a server only remaps the keys between its position and its predecessor. The candidate should mention virtual nodes (each physical server occupies multiple ring positions) to handle uneven load distribution, and ground it in a concrete example like Memcached or a distributed file system metadata layer.

Expect these follow-ups

• How do virtual nodes help with hotspots?
• What happens during a server failure in consistent hashing, and how is data recovered?

As asked

IBM clients in regulated industries (banking, healthcare, government) hold IBM engineers to a high security bar. Walk me through a specific security vulnerability you found in your own code or a teammate's code, ideally from the OWASP Top 10. What was the vulnerability, how did you find it, what was the potential impact, and what exactly did you change to fix it?

Sample answer outline

Strong answers are concrete: they name the specific vulnerability class (SQL injection, broken access control, insecure deserialization, etc.), describe how it was discovered (code review, SAST tool, penetration test), explain what an attacker could have done with it, and walk through the fix with enough detail to show real understanding. Vague answers about 'sanitizing inputs' without explaining where or how score poorly.

Expect these follow-ups

• What static analysis tools have you used to catch security issues before code review?
• How do you prioritize fixing security findings when you have a long backlog of feature work?

As asked

Your team's CI pipeline has a 25 percent flaky-test rate, meaning 1 in 4 builds fails due to test non-determinism rather than real bugs. Engineers are re-running builds as a habit and starting to ignore red builds. How do you diagnose and fix this?

Sample answer outline

Strong answers start with classification (identify which tests are flaky, categorize causes: timing dependencies, shared state, external service calls, random data), apply targeted fixes (deterministic seeding, mocking external calls, test isolation, retry-with-detection rather than blind retry), and track flakiness rate as a metric on a dashboard. They also describe the cultural fix: quarantine chronically flaky tests rather than let them erode trust in the suite.

Expect these follow-ups

• How do you get engineers to actually fix flaky tests rather than just quarantine them forever?
• What would you instrument to catch a new flaky test within 24 hours of it being introduced?

As asked

A colleague's .NET API endpoint works fine in integration tests but hangs indefinitely in production. After reviewing the code you find they are calling .Result on an async Task inside a classic ASP.NET application that uses a SynchronizationContext. Explain what causes the deadlock and how you would fix it. What is the situation in ASP.NET Core, and why does the same pattern behave differently there?

Sample answer outline

The deadlock occurs in classic ASP.NET because the AspNetSynchronizationContext serializes continuations onto the same thread that is blocked by .Result, creating a circular wait. ASP.NET Core does not install a SynchronizationContext, so calling .Result there does not produce this specific deadlock, which is why the classic pattern can silently go unnoticed when teams migrate. The correct fix everywhere is to await all the way up the call stack and never call .Result or .Wait on Tasks in any context that might have a SynchronizationContext. ConfigureAwait(false) breaks the deadlock in classic ASP.NET by allowing the continuation to run on a thread pool thread, but it is not a substitute for proper async all the way up and should not be used as a default.

Expect these follow-ups

• When is ConfigureAwait(false) the right answer and when is it not?
• How would you find all places in a large codebase where this pattern is being used?

As asked

You are reviewing a TypeScript codebase and see generics used without constraints, causing type errors that only appear at runtime. Explain what generic constraints are, give a concrete example of a bug they prevent, and show how you would fix the offending code.

Sample answer outline

A strong answer explains that constraints with 'extends' restrict the type parameter to a subset of types, letting the compiler verify property accesses at compile time rather than at runtime. A concrete bug: a generic function accessing .length on T without constraining T to { length: number } compiles but throws at runtime for number inputs. The fix adds the constraint. The candidate should also contrast constraints with conditional types and mapped types for bonus depth.

Expect these follow-ups

• What is the difference between T extends object and T extends Record<string, unknown>?
• When would you use a conditional type instead of a constraint?

As asked

You are reviewing a new service that uses OAuth 2.0 Authorization Code flow integrated with Azure Active Directory. The developer stores the access token in localStorage, does not validate the state parameter, and forwards the token to a third-party analytics service. Identify every security issue you see and explain how to fix each one.

Sample answer outline

Three issues: localStorage is vulnerable to XSS attacks because any injected script can read it, the fix is to use httpOnly cookies or in-memory storage. Not validating the state parameter opens the app to CSRF attacks on the authorization endpoint, the fix is to generate a cryptographically random state, store it in session, and verify it on redirect. Forwarding the access token to a third-party service exposes it to a potentially untrusted party that could impersonate the user, the fix is to never share access tokens and to use scoped tokens with minimum permissions.

Expect these follow-ups

• How do you securely handle token refresh in a single-page application?
• What is PKCE and when is it required vs. recommended in the auth code flow?

As asked

Netflix's Android app uses Kotlin coroutines extensively. Explain what structured concurrency means in the coroutines model, how it differs from unstructured concurrency with raw threads, and describe a bug you have seen or could imagine where improper coroutine scope usage causes a resource or memory leak.

Sample answer outline

Structured concurrency means that coroutines are always scoped to a parent and the parent cannot complete until all its children complete or are cancelled. The bug the interviewer is probing for is the classic GlobalScope.launch pattern: a coroutine launched in GlobalScope outlives its parent Activity or ViewModel, holds a reference to a destroyed View, and causes a memory leak or a crash when it tries to update UI that no longer exists. The fix is to use viewModelScope or lifecycleScope so the coroutine is automatically cancelled when the owner is destroyed.

Expect these follow-ups

• How does coroutine cancellation propagate, and what do you need to do in a coroutine that does CPU-bound work to make it cancellation-cooperative?
• What is the difference between coroutineScope and supervisorScope, and when would you choose one over the other?

As asked

A customer reports that their sales reps can see records they should not be able to access. Walk me through how Salesforce's data sharing model works, what layers are involved, and how you would troubleshoot which layer is granting the unintended access.

Sample answer outline

A strong answer walks through the layers in order: Object-Level Security (profiles/permission sets restrict which objects a user can see at all), Field-Level Security (restricts individual fields), Org-Wide Defaults (the baseline sharing for all records of an object), Role Hierarchy (allows upward visibility), Sharing Rules (expand OWD based on criteria or ownership), and Manual Sharing (record-by-record grants). The candidate should describe using the 'Access' button on a record and the sharing debugger tool to identify which rule is granting access. Profile-based access is additive, not restrictive above OWD.

Expect these follow-ups

• What is the difference between a profile and a permission set?
• How would you give a single user access to one specific record without changing their profile?

As asked

Your team is deploying Apex, LWC, and Flow metadata to a Salesforce org using manual change sets today. Walk me through how you would design a modern CI/CD pipeline for this, including how you handle environment management, testing requirements, and rollback.

Sample answer outline

Strong answers mention Salesforce DX (SFDX) source format, a Git-based branching model using scratch orgs for isolated feature development, and CI tools such as GitHub Actions, GitLab CI, or Copado. The pipeline should: on PR open, validate metadata against a CI scratch org or sandbox and run all Apex tests; enforce 75% code coverage as a hard gate for production deployments; use the Salesforce CLI (sf project deploy) rather than legacy change sets; and store environment-specific config in Named Credentials and Custom Metadata rather than hardcoded values. Rollback is handled by keeping a known-good metadata snapshot and using destructiveChanges.xml for removals, since Salesforce has no native deployment rollback command. Bonus for mentioning delta deployments using tools like sgd (Salesforce Git Delta) to deploy only what changed.

Expect these follow-ups

• How do you manage environment-specific configuration between sandbox and production?
• What do you do if an Apex test fails in CI but passes in the developer's sandbox?

As asked

A merchant asks why they need to use Stripe.js and Stripe Elements instead of building their own card input form and sending raw card numbers to Stripe's API. Explain technically how Stripe.js works under the hood and what security properties it provides.

Sample answer outline

A strong answer explains that Stripe.js renders the card fields inside a cross-origin iframe hosted on stripe.com, so the merchant's JavaScript context never has access to the raw PAN. Stripe.js tokenizes the card number client-side and returns only a token to the merchant's origin. This removes the merchant from PCI DSS scope for card data storage and transmission. The candidate should mention the Content Security Policy considerations and how Stripe.js signals readiness and errors back to the parent page without exposing card data.

Expect these follow-ups

• How does Stripe.js pass the card token back to the parent page from inside its iframe securely?
• What is the difference between a card token, a PaymentMethod, and a PaymentIntent?

As asked

You need to represent and compute a total invoice amount that combines line items in USD and EUR, applying a conversion rate that has six decimal places. What data type do you use for each amount, why is floating-point arithmetic dangerous here, and how do you round correctly for a final display amount?

Sample answer outline

A strong answer stores all amounts as integers in the smallest currency unit (cents for USD, euro cents for EUR), never uses IEEE 754 floats for money, and applies the exchange rate using integer or fixed-point arithmetic, documenting the rounding rule (HALF_UP for consumer-facing totals). Stripe's own API uses integer amounts in the minor unit. The candidate should give a concrete example of float arithmetic error and show the correct integer path. Mentioning Decimal types in languages that support them is good.

Expect these follow-ups

• How do you handle a currency like the Kuwaiti dinar that has three decimal places?
• If you are storing amounts as integers, how do you display them correctly to users in different locales?

As asked

Your API can return a success payload, a validation error, or a server error. How would you model this with TypeScript discriminated unions, and how does that affect error handling in the calling React component?

Sample answer outline

Define a union type with a shared discriminant field such as type: 'success' | 'validation-error' | 'server-error'. TypeScript narrows the type in each branch of a switch or if-else on that field, giving you type-safe access to payload fields that only exist on certain variants. In the React component you switch on result.type and render appropriate UI for each case. The candidate should mention that this is safer than optional fields because it makes impossible states unrepresentable.

Expect these follow-ups

• How would you use the satisfies operator in TypeScript to validate your discriminant literal types?