Backend Developer question bank
100 questions. Filter by level and skill, track what you've solved, and see how many people get each one right.
- Status code after creating a resource
- The non-idempotent method
- Stopping SQL injection
- How to store passwords
- Purpose of a database index
- What stateless means in REST
- 401 or 403
- Keeping secrets out of code
- Updating only one field
- Status code for too many requests
- Rows returned by a LEFT JOIN
- What a foreign key enforces
- Atomicity in a money transfer
- Browser blocks a call that curl allows
- What a 504 from Nginx means
- Docker image versus container
- Redis TTL after SET with EX
- Undoing a bad commit on main
- Promise and setTimeout order
- COUNT and AVG with NULLs
- Filtering grouped results
- Naming a test that uses a real DB
- Why structured logs help
- What HttpOnly does on a cookie
- Storing times for global users
- A GET that deletes data
- Embed or reference in MongoDB
- Slow email during signup
- Duplicate emails despite a check
- Python default list surprise
- What EXPLAIN tells you
- Content-Type versus Accept
- What HTTPS leaves visible
- Database user for the app
- The N+1 query problem
- Cache-aside pattern
- Logging out with JWTs
- Isolation levels and dirty reads
- Offset or cursor pagination
- Token bucket rate limiter
- At-least-once delivery
- Composite index column order
- More consumers than partitions
- Two awaits that could run together
- A 64-bit id changes after parsing
- Response to a matching If-None-Match
- Optimistic lock update hits 0 rows
- Why access tokens are short-lived
- Webhook signature never matches
- Errors during every deploy
- Liveness probe restarts every pod
- Retrying after a shared outage
- What a circuit breaker does
- Redis structure for a leaderboard
- Index ignored for lower(email)
- Benefit of INCLUDE in an index
- Risk of "import image from URL"
- Any user can read any invoice
- Saving req.body directly
- Testing code that calls a payment API
- Following one request across services
- Fine average, unhappy users
- Docker rebuild reinstalls everything
- One bad message blocks the queue
- Worker crash with auto-ack
- Async callback inside forEach
- Keeping a cached price fresh
- CDN serves one user's profile to another
- Safe retries for payments
- CAP during a network partition
- Lost update on a wallet balance
- Cache stampede on a hot key
- Saving to DB and publishing an event
- One slow route freezes Node.js
- Connection pools and autoscaling
- Why a lock alone is not enough
- NOT IN with a NULL in the list
- Workers block each other on a jobs table
- Deadlocks between two transfers
- Two doctors go off call at once
- Account events processed out of order
- JWT verified with an attacker-chosen algorithm
- Comparing secrets with ===
- Retries stacked at every layer
- Profile shows old data after saving
- Adding a fifth cache node
- Sharding orders by creation date
- Table bloat that VACUUM will not fix
- Stale value returns after cache delete
- Work continues after the client gives up
- Trusting a Bloom filter answer
- Index for the few pending rows
- Inserts slow down with UUID keys
- Burst at a fixed window boundary
- return versus return await in try
- Sorting by a user-chosen column
- Pool exhausted during payments
- Deep merge of untrusted JSON
- Concurrent requests from throughput
- Adding an index to a live big table