Full-stack engineer technical fundamentals interview questions

As asked

What is CORS and why does the browser enforce it? Walk me through how a preflight request works, and what Access-Control headers you need to set on an Express API so that a React app on a different origin can make authenticated POST requests.

Sample answer outline

CORS is enforced by the browser to prevent a malicious website from making authenticated requests to a different origin using the user's credentials. For cross-origin POST with credentials, the browser first sends an OPTIONS preflight request. The server must respond with Access-Control-Allow-Origin (the specific origin, not * when credentials are involved), Access-Control-Allow-Methods, Access-Control-Allow-Headers, and Access-Control-Allow-Credentials: true. The candidate should know that * is not allowed when credentials are used, that the cors npm package configures this, and that CORS is a browser policy (server-to-server calls are not affected).

Expect these follow-ups

• Why does setting Access-Control-Allow-Origin: * not work with credentials, and what do you do instead for multiple allowed origins?

As asked

Walk me through the decision process you use to choose between Postgres and a document database like MongoDB for a new project. What data characteristics and access patterns push you toward each?

Sample answer outline

Postgres shines when: data has complex relationships (foreign keys, joins), you need ACID transactions across multiple entities, the schema is relatively stable, or you need strong consistency. MongoDB/document DBs suit: document-oriented data with highly variable shapes, high-volume write workloads that benefit from horizontal sharding, or when schema flexibility during rapid development is more important than relational integrity. The candidate should note that Postgres's JSONB column bridges the gap for semi-structured data. They should avoid the common mistake of treating 'NoSQL = scale' as a binary rule.

Expect these follow-ups

• In what scenario would you use both Postgres and MongoDB in the same application?

As asked

A Coinbase transaction fee is 1.49% of the trade amount. A user buys 0.00312 BTC at $42,385.50 per BTC. Your backend calculates the fee in JavaScript using floating-point arithmetic. What can go wrong and how do you fix it?

Sample answer outline

The candidate should explain that IEEE 754 floating-point representation cannot exactly represent many decimals (0.1 + 0.2 !== 0.3 in JS), which means fee calculations can be off by fractional cents at scale. The fix is to use integer arithmetic in the smallest unit (satoshis for BTC, cents for USD) or a big-decimal library like Decimal.js or bignumber.js. They should also mention how the fee should be rounded (floor, ceil, or banker's rounding) and that the rounding rule should be consistent with regulatory requirements.

Expect these follow-ups

• If a user makes 10,000 trades per day, what is the worst-case cumulative error from naive float arithmetic?
• How do you test your fee calculation code to catch rounding bugs before production?

As asked

A junior engineer wrote this Node.js query to fetch a user's trade history: `db.query('SELECT * FROM trades WHERE user_id = ' + req.params.userId + ' AND asset = \'' + req.query.asset + '\'')` What is wrong with this code, what is the worst-case exploit, and how do you fix it?

Sample answer outline

The candidate should identify string concatenation as the vulnerability, demonstrate a payload like `' OR '1'='1` that returns all trades or `'; DROP TABLE trades;--` as a destructive example, and fix it with parameterized queries or a prepared statement. They should also mention that in a financial context a compromised trades table could expose all user transaction history and PII. A bonus point for mentioning ORMs as a layer of protection and the importance of a security code review gate for database queries.

Expect these follow-ups

• How would you detect if this vulnerability had already been exploited in production?
• What other injection vectors would you check in this same codebase?

As asked

Figma's engineering team receives reports that about 100 users are experiencing a crash when opening a specific file type, but your local reproduction attempts have all failed. The crash shows up only in production. How do you investigate, and what instrumentation or tools do you use?

Sample answer outline

A strong answer covers structured investigation: gather signal from error reporting (Sentry or Datadog) to find the common stack trace, correlate with attributes like browser version, OS, file size, and network conditions to find what the 100 affected users have in common. If a specific file is implicated, request a copy (with user consent) and test with that. Add targeted logging around the suspected code path and deploy behind a feature flag to the affected cohort. A great answer discusses how to safely add canary instrumentation to production without adding latency to the hot path, and how to communicate status to affected users during the investigation.

Expect these follow-ups

• What if the crash is non-deterministic and only occurs 1 in 1000 times, making even targeted reproduction difficult?
• How do you decide when to declare the issue resolved and remove the extra instrumentation?

As asked

IBM client engagements frequently hand off software to the client's own team, so the quality and maintainability of your test suite reflects directly on IBM's reputation. You are building a new Java microservice from scratch that other teams will depend on. Walk me through the full testing strategy you would put in place, from unit tests to production monitoring, including what you test at each layer and how you decide how much coverage is enough.

Sample answer outline

A strong answer covers unit tests for business logic in isolation using mocks (JUnit and Mockito), integration tests for database and external service interactions using a test container or embedded DB, contract tests (Pact or Spring Cloud Contract) since other teams will consume the API, end-to-end smoke tests for the critical paths after deployment, and production observability with structured logging, metrics, and health checks. Coverage targets should be principled (high for core logic, lower for glue code) rather than an arbitrary 80% number.

Expect these follow-ups

• How do you test a method that calls a third-party API with unpredictable response times?
• What is your approach when a bug slips past all your tests into production?

As asked

Microsoft asks this frequently in their OOP/LLD round. Design an elevator control system for a building with N floors and M elevators. Define your classes, their responsibilities, and the core scheduling algorithm. How do you decide which elevator responds to a floor request?

Sample answer outline

Key classes include Elevator (current floor, direction, state, queue of requests), ElevatorController or Dispatcher (receives external requests and assigns them), Floor (with up/down call buttons), and Request. The scheduling algorithm options range from simple FCFS to the SCAN (elevator) algorithm where the elevator sweeps in one direction serving all requests along the way before reversing. Strong candidates explain why SCAN reduces average wait time compared to FCFS and how they handle edge cases like an elevator at capacity or out of service.

Expect these follow-ups

• How would your design change if you needed to support VIP floors that always get priority?
• How would you add an emergency mode that sends all elevators to the ground floor?

As asked

Another classic Microsoft LLD question: design a parking lot system that supports multiple levels, different vehicle sizes (motorcycle, car, truck), automated ticket issuance on entry, and fee calculation on exit based on time parked. Walk me through classes, relationships, and state management.

Sample answer outline

Core classes: ParkingLot (has levels, entry/exit gates), ParkingLevel (has spots), ParkingSpot (type: small/medium/large, occupied/available), Vehicle (type, license plate), Ticket (entry time, spot reference), and FeeCalculator (implements pricing strategy). The spot-finding algorithm traverses levels top-down or with a heap indexed by available spots per level. The candidate should show they know to use an interface or strategy pattern for fee calculation so different pricing models can be swapped. Microsoft tests both class modeling and thinking about concurrency when two cars race to the same spot.

Expect these follow-ups

• How do you handle two cars simultaneously trying to take the last spot on a level?
• How would you extend this to support monthly pass holders who have reserved spots?

As asked

A business analyst wants to automate a process where creating a high-value Opportunity automatically creates a follow-up Task and sends a Slack message. They are asking you whether to use Salesforce Flow or Apex. How do you decide?

Sample answer outline

Strong answers show the candidate knows the 'automate with clicks first, code second' principle Salesforce promotes. Flow handles this scenario well: record-triggered flows can create child records and call HTTP callouts (or named credentials) for Slack. Apex is justified when logic is complex, requires bulkification beyond what Flow supports, or performance is critical. The candidate should also mention that mixing flows and Apex on the same object can cause ordering and recursion issues that need careful management.

Expect these follow-ups

• What are the performance risks of deeply nested flows on high-volume objects?
• How would you test a Flow in a sandbox?

As asked

Your API can return a success payload, a validation error, or a server error. How would you model this with TypeScript discriminated unions, and how does that affect error handling in the calling React component?

Sample answer outline

Define a union type with a shared discriminant field such as type: 'success' | 'validation-error' | 'server-error'. TypeScript narrows the type in each branch of a switch or if-else on that field, giving you type-safe access to payload fields that only exist on certain variants. In the React component you switch on result.type and render appropriate UI for each case. The candidate should mention that this is safer than optional fields because it makes impossible states unrepresentable.

Expect these follow-ups

• How would you use the satisfies operator in TypeScript to validate your discriminant literal types?

As asked

What are the key differences between HTTP/2 and HTTP/1.1 that matter for a fullstack web developer? How do they change the way you should optimize a React app?

Sample answer outline

HTTP/2 introduces multiplexing (multiple requests on a single TCP connection, eliminating head-of-line blocking at the application layer), header compression (HPACK), and server push. For React apps this changes bundling strategy: HTTP/1.1 favored large bundles to minimize connections; HTTP/2 makes smaller more granular chunks viable because they can be sent in parallel. The candidate should mention that domain sharding (a common HTTP/1.1 optimization) is counterproductive with HTTP/2. They should know that HTTP/3 (QUIC) solves head-of-line blocking at the transport layer.

Expect these follow-ups

• What is head-of-line blocking at the TCP layer and why does HTTP/3 address it when HTTP/2 did not?

As asked

Walk me through what a browser does from the moment it receives the first bytes of an HTML response to the moment pixels are painted on screen. Name each stage and explain where JavaScript and CSS block or delay rendering.

Sample answer outline

Parse HTML bytes into the DOM. While parsing, encounter a CSS link tag and fetch/parse CSS into the CSSOM (this blocks rendering). JavaScript in a script tag blocks DOM parsing unless async or defer. Combine DOM and CSSOM into the Render Tree (excludes display:none elements). Layout (reflow): calculate geometry of each element. Paint: rasterize each element into layers. Composite: combine layers and send to the GPU. The candidate should know that JS blocks the HTML parser unless async/defer, that CSS blocks rendering but not parsing, and that layout and paint are expensive operations triggered by JS style changes.

Expect these follow-ups

• What is compositing and why is animating transform/opacity cheaper than animating top/left?

As asked

Explain CAP theorem and tell me how it applies to choosing between Postgres and MongoDB for a user profile service. Which guarantees does each system provide in a network partition?

Sample answer outline

CAP: a distributed system cannot simultaneously guarantee Consistency, Availability, and Partition tolerance during a network partition. Postgres in a primary/replica setup is CP: in a partition, the primary stops accepting writes rather than risk inconsistency. MongoDB's behavior depends on write concern. Before MongoDB 5.0 the default write concern was 1 (acknowledge from just the primary), which made it lean AP. Since MongoDB 5.0 the default write concern is 'majority', making it CP like Postgres in practice. The candidate should note that for a single-server deployment CAP is less relevant and becomes important only with replication or sharding. They should also note that 'consistency' in CAP means linearizability, which is distinct from ACID consistency.

Expect these follow-ups

• What does PACELC add to the CAP theorem, and why is it more useful for real-world system design?

As asked

A developer on your team is trying to position a tooltip above a modal, but the tooltip always appears behind the modal regardless of the z-index value. Explain what a stacking context is and why this happens.

Sample answer outline

A stacking context is an element that creates a new local 3D rendering layer. Elements inside a stacking context are painted together and z-index only competes within the same stacking context. A stacking context is created by: opacity less than 1, position with a z-index other than auto, transform, filter, will-change, isolation:isolate, and others. If the tooltip's parent has opacity:0.99 or transform:translateY(0), it creates a stacking context and the tooltip cannot escape it regardless of z-index. Fixes: move the tooltip to a portal at the document root (React portals), or remove the property that creates the stacking context on the ancestor.

Expect these follow-ups

• How does a React Portal solve the stacking context problem for modals and tooltips?

As asked

Explain what idempotency means for a REST API. How would you implement an idempotency key mechanism for a POST /payments endpoint so that a client retry never results in a double charge?

Sample answer outline

An idempotent operation produces the same result no matter how many times it is applied. GET, PUT, and DELETE are naturally idempotent; POST is not. The client generates a unique idempotency key (UUID) and sends it in an Idempotency-Key header. The server stores the key and the response in a database or Redis (keyed by idempotency-key + user-id) before processing. If the same key arrives again, return the cached response without reprocessing. The key should expire after a reasonable window (24 hours). The candidate should address race conditions: use an atomic INSERT or SETNX so that two concurrent requests with the same key only process once.

Expect these follow-ups

• How do you handle an idempotency key for a request where the payment succeeded but the response was never received by the client?

As asked

Design the classes and interfaces for a font management library similar to Adobe Fonts. It should support browsing fonts by family and weight, activating a font for use in an application, and tracking which fonts a user has recently used. Walk me through your class hierarchy and the responsibilities of each class.

Sample answer outline

A strong answer separates Font (a specific weight/style), FontFamily (groups fonts), FontLibrary (the collection and search interface), FontActivation (the act of making a font available), and RecentFontsTracker (a bounded history with LRU semantics). The candidate should discuss the open/closed principle when adding new activation sources (local vs cloud), and how to make FontLibrary searchable by multiple criteria without a combinatorial explosion of subclasses. They should mention the observer pattern to notify applications when fonts activate.

Expect these follow-ups

• How do you handle a font that exists both locally and in the cloud and they are different versions?
• How would you serialize a user's font activation state so it persists across restarts?

As asked

Adobe Creative Cloud apps like Photoshop ship on Windows and macOS. Walk me through how you would design a CI/CD pipeline that runs tests, enforces code quality, builds native installers for both platforms, signs them for distribution, and rolls out to users incrementally with the ability to halt a bad release.

Sample answer outline

The pipeline has distinct stages: build (cross-compiled in cloud or on platform-specific agents), unit and integration test (fastest first to fail fast), code signing (separate secure environment with HSM-stored keys), artifact storage (versioned, immutable), and staged rollout (1% of Creative Cloud users via feature flags, automated smoke tests, then progressive percentage increases). Halt mechanism: a global kill switch in the Creative Cloud desktop app that checks a remote config and blocks the update from applying. A strong answer mentions delta updates (only ship changed files, not the full 2 GB installer every time) and the app store constraints on macOS notarization.

Expect these follow-ups

• A security vulnerability is found in the code-signing key. What is your immediate response and how do you re-sign already-shipped artifacts?
• How do you ensure deterministic builds so that two build agents on the same source commit produce byte-identical installers?

As asked

The Figma Plugin API exposes complex node types with dozens of optional and required properties. Write a TypeScript generic utility type DeepPartial<T> that makes every property at every level of nesting optional. Then write a function that deep-merges two partial nodes, with the second argument taking priority on conflicts.

Sample answer outline

A strong answer correctly defines DeepPartial<T> using a mapped type that conditionally recurses into object types while leaving primitives, arrays, and function types alone. The deep merge function should use recursion, handle null vs undefined correctly, and not mutate either input. A great candidate discusses edge cases: merging arrays (overwrite vs concatenate), merging class instances (prototype chain), and the behavior when one side has a key with value undefined vs the key being absent.

Reference implementation (typescript)

type DeepPartial<T> = {
  // your implementation
};

function deepMerge<T extends object>(
  base: DeepPartial<T>,
  override: DeepPartial<T>
): DeepPartial<T> {
  // your implementation
}

Expect these follow-ups

• How does your DeepPartial handle an array property like children?: FigmaNode[], should it become (Partial<FigmaNode>)[] or just FigmaNode[]?
• What happens if you pass a deeply nested class instance instead of a plain object to your merge function?

As asked

Google uses Protocol Buffers as the standard serialization format for most internal service communication. What are the concrete technical reasons for this choice over JSON, and in what situations would you still prefer JSON?

Sample answer outline

Protobuf is smaller (binary encoding with field numbers instead of string keys), faster to serialize and deserialize, and enforces a schema with typed fields and backward-compatible evolution rules. JSON is human-readable, easier to debug without tooling, and the natural choice for external-facing APIs or browser clients. A strong candidate mentions field number evolution (adding optional fields is backward-compatible), the generated code across languages, and the fact that schema enforcement catches type errors at build time rather than runtime.

Expect these follow-ups

• How does Protobuf handle schema evolution when you remove a field that old clients still send?
• When would you choose MessagePack over Protobuf?

As asked

Explain consistent hashing. Why is it better than simple modulo hashing for distributing keys across a cluster of servers? Describe a concrete scenario inside a large distributed system, like a cache or a distributed storage layer, where consistent hashing solves a real problem.

Sample answer outline

A strong answer explains that with modulo hashing, adding or removing one server remaps nearly all keys. Consistent hashing maps both servers and keys onto a ring, so adding a server only remaps the keys between its position and its predecessor. The candidate should mention virtual nodes (each physical server occupies multiple ring positions) to handle uneven load distribution, and ground it in a concrete example like Memcached or a distributed file system metadata layer.

Expect these follow-ups

• How do virtual nodes help with hotspots?
• What happens during a server failure in consistent hashing, and how is data recovered?

As asked

IBM clients in regulated industries (banking, healthcare, government) hold IBM engineers to a high security bar. Walk me through a specific security vulnerability you found in your own code or a teammate's code, ideally from the OWASP Top 10. What was the vulnerability, how did you find it, what was the potential impact, and what exactly did you change to fix it?

Sample answer outline

Strong answers are concrete: they name the specific vulnerability class (SQL injection, broken access control, insecure deserialization, etc.), describe how it was discovered (code review, SAST tool, penetration test), explain what an attacker could have done with it, and walk through the fix with enough detail to show real understanding. Vague answers about 'sanitizing inputs' without explaining where or how score poorly.

Expect these follow-ups

• What static analysis tools have you used to catch security issues before code review?
• How do you prioritize fixing security findings when you have a long backlog of feature work?

As asked

Your team's CI pipeline has a 25 percent flaky-test rate, meaning 1 in 4 builds fails due to test non-determinism rather than real bugs. Engineers are re-running builds as a habit and starting to ignore red builds. How do you diagnose and fix this?

Sample answer outline

Strong answers start with classification (identify which tests are flaky, categorize causes: timing dependencies, shared state, external service calls, random data), apply targeted fixes (deterministic seeding, mocking external calls, test isolation, retry-with-detection rather than blind retry), and track flakiness rate as a metric on a dashboard. They also describe the cultural fix: quarantine chronically flaky tests rather than let them erode trust in the suite.

Expect these follow-ups

• How do you get engineers to actually fix flaky tests rather than just quarantine them forever?
• What would you instrument to catch a new flaky test within 24 hours of it being introduced?

As asked

A colleague's .NET API endpoint works fine in integration tests but hangs indefinitely in production. After reviewing the code you find they are calling .Result on an async Task inside a classic ASP.NET application that uses a SynchronizationContext. Explain what causes the deadlock and how you would fix it. What is the situation in ASP.NET Core, and why does the same pattern behave differently there?

Sample answer outline

The deadlock occurs in classic ASP.NET because the AspNetSynchronizationContext serializes continuations onto the same thread that is blocked by .Result, creating a circular wait. ASP.NET Core does not install a SynchronizationContext, so calling .Result there does not produce this specific deadlock, which is why the classic pattern can silently go unnoticed when teams migrate. The correct fix everywhere is to await all the way up the call stack and never call .Result or .Wait on Tasks in any context that might have a SynchronizationContext. ConfigureAwait(false) breaks the deadlock in classic ASP.NET by allowing the continuation to run on a thread pool thread, but it is not a substitute for proper async all the way up and should not be used as a default.

Expect these follow-ups

• When is ConfigureAwait(false) the right answer and when is it not?
• How would you find all places in a large codebase where this pattern is being used?

As asked

You are reviewing a TypeScript codebase and see generics used without constraints, causing type errors that only appear at runtime. Explain what generic constraints are, give a concrete example of a bug they prevent, and show how you would fix the offending code.

Sample answer outline

A strong answer explains that constraints with 'extends' restrict the type parameter to a subset of types, letting the compiler verify property accesses at compile time rather than at runtime. A concrete bug: a generic function accessing .length on T without constraining T to { length: number } compiles but throws at runtime for number inputs. The fix adds the constraint. The candidate should also contrast constraints with conditional types and mapped types for bonus depth.

Expect these follow-ups

• What is the difference between T extends object and T extends Record<string, unknown>?
• When would you use a conditional type instead of a constraint?

As asked

You are reviewing a new service that uses OAuth 2.0 Authorization Code flow integrated with Azure Active Directory. The developer stores the access token in localStorage, does not validate the state parameter, and forwards the token to a third-party analytics service. Identify every security issue you see and explain how to fix each one.

Sample answer outline

Three issues: localStorage is vulnerable to XSS attacks because any injected script can read it, the fix is to use httpOnly cookies or in-memory storage. Not validating the state parameter opens the app to CSRF attacks on the authorization endpoint, the fix is to generate a cryptographically random state, store it in session, and verify it on redirect. Forwarding the access token to a third-party service exposes it to a potentially untrusted party that could impersonate the user, the fix is to never share access tokens and to use scoped tokens with minimum permissions.

Expect these follow-ups

• How do you securely handle token refresh in a single-page application?
• What is PKCE and when is it required vs. recommended in the auth code flow?