Mobile engineer technical fundamentals interview questions

As asked

Explain how a TLS handshake works at a conceptual level and what the mobile OS checks by default when your app makes an HTTPS request without any custom URLSession configuration.

Sample answer outline

TLS: client hello, server sends certificate chain, client verifies chain against the OS trust store (checks signature, expiry, revocation via OCSP stapling on iOS, CRL/OCSP on Android), key exchange (ECDHE for forward secrecy), symmetric session keys derived, encrypted channel established. iOS default: ATS requires TLS 1.2+, forward secrecy ciphers, and 2048-bit RSA or 256-bit ECC keys. Android trusts the system CA store by default.

Expect these follow-ups

• What is OCSP stapling and why does it matter for app startup latency?
• How does Android's Network Security Config let you customize trust for debug builds only?

As asked

Why must all UIKit (iOS) and View (Android) updates happen on the main thread? What happens if you violate this rule, and how does each platform enforce or detect violations?

Sample answer outline

UI toolkits are single-threaded to avoid lock contention on the enormous shared view hierarchy. Violating this on iOS can cause visual glitches, crashes in drawing code, or silent corruption. iOS provides the Main Thread Checker (enabled by default in Xcode) that crashes the app when a UIKit property is mutated off the main thread. Android does the same: ViewRootImpl.checkThread throws CalledFromWrongThreadException. Candidate should mention DispatchQueue.main.async / runOnUiThread as the fix.

Expect these follow-ups

• Are there any UIKit operations that are safe to call from a background thread?
• How does SwiftUI change the thread safety requirement compared to UIKit?

As asked

Explain why a ViewModel survives a configuration change like screen rotation on Android, but does not survive a process death. What is the difference between these two scenarios from the OS's perspective?

Sample answer outline

On rotation, Android destroys and recreates the Activity, but the ViewModelStore is retained by the NonConfigurationInstance mechanism, so the ViewModel's onCleared is not called and its data survives. On process death, the entire JVM process is killed and all in-memory state is lost. To survive process death, use SavedStateHandle (which serializes to a Bundle via the onSaveInstanceState mechanism) or persist to Room/SharedPreferences.

Expect these follow-ups

• What types can you store in a SavedStateHandle and what happens if you try to store a large Bitmap?
• How does the ViewModel interact with the SavedStateHandle on Android 12 and later?

As asked

Explain the practical difference between structs (value types) and classes (reference types) in Swift. In the context of a mobile app, when would you choose a class over a struct for a data model, and what are the thread-safety implications of each?

Sample answer outline

Structs are copied on assignment, so mutations do not propagate unexpectedly; they are safe to pass between threads because each thread has its own copy. Classes share identity and are passed by reference, so mutations are visible everywhere and require synchronization. Choose class for objects with identity (a UIViewController, a network session, a shared cache). Choose struct for data models (a Post, a User record) where copying is cheap and you want value semantics. SwiftUI's @Observable requires a class; Codable models are typically structs.

Expect these follow-ups

• What is copy-on-write and how do Swift's standard collections implement it?
• What does the mutating keyword on a struct method signal to the compiler?

As asked

How does HTTP/2 multiplexing differ from HTTP/1.1 pipelining, and how does it change the way you should batch or parallelize network requests in a mobile app?

Sample answer outline

HTTP/1.1: one request per connection (pipelining was broken in practice), so browsers opened 6 connections per host. HTTP/2: multiple streams over one connection without head-of-line blocking at the HTTP layer. For mobile: you can fire multiple requests in parallel over a single connection without the overhead of connection setup per request. URLSession and OkHttp both use HTTP/2 automatically when the server supports it. The tradeoff: still one TCP connection, so TCP packet loss still causes HOL blocking (solved by QUIC in HTTP/3).

Expect these follow-ups

• What is HTTP/3 and what does QUIC fix that HTTP/2 over TCP does not?
• How do you verify that your app is actually using HTTP/2 for its API calls?

As asked

Compare how iOS and Android manage memory at runtime. What are the practical consequences for mobile developers, and what kinds of memory issues are unique to each platform?

Sample answer outline

iOS uses ARC (compile-time reference counting): deterministic deallocation, no GC pauses, but requires the developer to manage strong/weak cycles explicitly. Android uses a JVM/ART garbage collector: handles cycles automatically but introduces GC pauses (though generational GC minimizes pauses in practice). iOS-specific issues: retain cycles causing leaks. Android-specific issues: large allocations triggering full GC (bitmap handling was notorious pre-API 26), OutOfMemoryError on Dalvik heap limit, and memory churn from allocation-heavy code in onDraw.

Expect these follow-ups

• What tools do you use to detect memory leaks in production for each platform?
• How does LeakCanary work differently from Instruments Leaks template?

As asked

You have a SQLite table on device with 500,000 rows storing messages (id, conversationId, senderId, timestamp, body). Your app queries for the 50 most recent messages in a conversation. What index would you create and why?

Sample answer outline

Composite index on (conversationId, timestamp DESC) covers the WHERE conversationId = ? ORDER BY timestamp DESC LIMIT 50 query as a covering index for those columns. Without the index, SQLite does a full table scan (500k rows). Candidate should mention running EXPLAIN QUERY PLAN to verify the index is used, and note that adding body to the index would make it too wide and slow writes.

Expect these follow-ups

• What is a covering index and how would you add the sender name to the result without a join?
• What does WAL mode do for SQLite on mobile and when would you enable it?

As asked

A user reports the app uses 500 MB of memory when displaying a grid of 50 photos, each only 1 MB on disk. Explain why this happens and what strategies you would use to fix it.

Sample answer outline

JPEG is compressed; a 4000x3000 JPEG decoded to an RGBA bitmap is 4000*3000*4 bytes = 48 MB. 50 such images would be 2.4 GB. Fix: downsample to the display size before creating the UIImage/Bitmap (CGImageSourceCreateThumbnailAtIndex on iOS, BitmapFactory.Options.inSampleSize or Bitmap.createScaledBitmap on Android). Use an image loading library (Kingfisher/Nuke on iOS, Coil/Glide on Android) that handles downsampling, memory caching with size limits, and disk caching automatically.

Expect these follow-ups

• What is the difference between a UIImage loaded from disk and one decoded into memory?
• How does Glide's memory cache size scale with the device's available memory?

As asked

Why does an iOS device token for APNs change over time, and what is the correct place in the app lifecycle to register and send the new token to your backend?

Sample answer outline

Tokens can change after app reinstall, restore from backup, or APNs system maintenance. Apple says to always call registerForRemoteNotifications at launch and send the token to your server every time didRegisterForRemoteNotificationsWithDeviceToken is called, even if it looks the same. The server should deduplicate by device token. When sending a push via the APNs HTTP/2 provider API, a 410 response with reason Unregistered means the token is no longer valid; the server should remove that token immediately. The legacy APNs feedback service was deprecated in 2020 and should not be used. Note that a 400 BadDeviceToken response means the token is malformed or belongs to a different environment (production vs sandbox).

Expect these follow-ups

• How does the APNs feedback service differ from the delivery receipt API?
• What happens to push notifications queued while a user restores to a new device?

As asked

What is the difference between an Android APK and an Android App Bundle, and why did Google mandate the App Bundle format for Play Store submissions? What does the build toolchain do differently when producing each?

Sample answer outline

An APK contains all resources and native libraries for all device configurations. An App Bundle (AAB) contains all configurations; Play Store generates optimized APKs per device (ABI split, screen density split, language split) via Play's Dynamic Delivery. This reduces download size significantly (30 to 70% is common). The build toolchain for an AAB does not produce a single installable file; you need bundletool or Play to produce APKs for testing. This is why you cannot sideload an AAB directly.

Expect these follow-ups

• How do you test the generated split APKs locally without uploading to Play?
• What is a dynamic feature module and how does it extend App Bundle?

As asked

What is the difference between animating a UIView's properties directly versus animating the underlying CALayer, and when would you drop down to CALayer for an animation that UIView cannot produce?

Sample answer outline

UIView.animate is a convenience wrapper that creates implicit CABasicAnimations on the view's layer. Direct CALayer animation (CABasicAnimation, CAKeyframeAnimation, CAAnimationGroup) gives control over timing functions, keyframes, fill mode, and properties that UIView does not expose (strokeEnd for path drawing, transform.rotation.z, shadowOffset). Use CALayer directly for: custom drawing animations, particle emitters (CAEmitterLayer), and animations on non-animatable UIView properties.

Expect these follow-ups

• What is the presentation layer versus the model layer in Core Animation?
• How do you synchronize Core Animation with UIKit layout passes?