Backend Interview Questions

Table of Contents

Overview

Backend interviews usually test three things:
1) how you think,
2) how you design systems,
3) whether you can work with real production constraints.

This chapter collects common backend interview questions, grouped by theme, and explains what interviewers are looking for and how you might answer. Treat this as a practice field, not a script to memorize.

Use these questions to:

Check what you already know.
Discover gaps to study.
Practice saying answers out loud, clearly and briefly.

Core Backend Concepts

Conceptual questions

These test whether you understand the basics of backend development.

Examples

What is the difference between frontend and backend?
Focus on:

Frontend runs in the browser, handles UI and user interaction.
Backend runs on servers, handles business logic, data storage, authentication, security.

Explain the client server model.
Mention:

Client sends a request (over HTTP or another protocol).
Server processes it, uses databases or other services, returns a response.
Stateless vs stateful behavior.

What happens when you enter a URL in your browser?
At a high level:

DNS resolution from domain to IP.
TCP connection to server port (usually 80 or 443).
HTTP or HTTPS request sent.
Server processes request, generates response.
Browser renders HTML, CSS, JS.

What is the difference between a web server and an application server?
Typical answer:

Web server: serves static content, handles HTTP connections, may reverse proxy.
Application server: runs your backend code, implements business logic and dynamic responses.

What is an API?

An interface that defines how software components communicate.
For web backends, usually an HTTP based contract defined by URLs, methods, request/response formats.

HTTP and REST

HTTP basics

Explain the HTTP request response cycle.

Client opens a connection, sends request line, headers, and optional body.
Server reads request, runs logic, sends back status line, headers, and optional body.
Connection may be kept alive or closed.

What are idempotent HTTP methods and which ones are idempotent?

Idempotent: multiple identical requests have the same effect as one.
Typically: GET, PUT, DELETE, HEAD, OPTIONS.
POST is usually not idempotent.

Important rule: In REST API design, idempotency helps clients safely retry requests without causing unintended side effects.

Difference between PUT and PATCH?

PUT: replace the whole resource. Client sends full representation.
PATCH: partially update resource. Client sends only changes.

When would you use GET vs POST?

GET: safe, read only operations, no side effects, parameters in URL.
POST: create resources, actions with side effects, usually send body.

REST and API design

What is a RESTful API?
Mention:

Uses HTTP methods to represent actions on resources.
Resources are identified by URLs.
Stateless, uses standard status codes and content types.

How would you design endpoints for a simple blog (posts and comments)?
For example:

| Action | Method | URL |
|---------------------------|--------|---------------------------------|
| List posts | GET | /posts |
| Get single post | GET | /posts/{id} |
| Create post | POST | /posts |
| Update full post | PUT | /posts/{id} |
| Partial update post | PATCH | /posts/{id} |
| Delete post | DELETE | /posts/{id} |
| List comments for a post | GET | /posts/{id}/comments |
| Add comment to a post | POST | /posts/{id}/comments |

How do you handle versioning in APIs?
Common approaches:

URI versioning: /v1/users, /v2/users
Header based: Accept: application/vnd.myapp.v1+json

What are common HTTP status codes you use in APIs?
Examples:

200 OK success.
201 Created resource created.
204 No Content success, no body.
400 Bad Request validation errors.
401 Unauthorized not authenticated.
403 Forbidden authenticated but not allowed.
404 Not Found resource does not exist.
409 Conflict version or state conflict.
500 Internal Server Error unexpected server error.

Databases and SQL

Data modeling questions

Relational vs NoSQL databases: when to use which?
Key points:

Relational: structured data, strong consistency, complex queries, transactions.
NoSQL: flexible schema, high write throughput, horizontal scaling.

Explain primary key and foreign key.

Primary key: unique identifier of a row in a table.
Foreign key: column that refers to a primary key in another table, creates relationships.

Describe one to many and many to many relationships.

One to many: one record relates to many, like User to Posts.
Many to many: both sides have many, needs join table, like Student and Course.

How would you model an e commerce order with items?
Usually:

users
products
orders (belongs to user)
order_items (references order and product, with quantity and price snapshot)

SQL and querying

Write a query to select all users who have placed more than 5 orders.

Example in SQL:

sql

   SELECT u.id, u.name, COUNT(o.id) AS order_count
   FROM users u
   JOIN orders o ON o.user_id = u.id
   GROUP BY u.id, u.name
   HAVING COUNT(o.id) > 5;

Interviewers check your understanding of JOIN, GROUP BY, HAVING.

How would you find the top 10 most sold products?

sql

   SELECT
       p.id,
       p.name,
       SUM(oi.quantity) AS total_sold
   FROM products p
   JOIN order_items oi ON oi.product_id = p.id
   GROUP BY p.id, p.name
   ORDER BY total_sold DESC
   LIMIT 10;

What is an index and when would you create one?

Index is a data structure that speeds up reads by ordering values.
You create indexes on columns used in WHERE, JOIN, ORDER BY.
Trade off: faster reads, slower writes, more disk use.

Important rule: Only create indexes on columns that are frequently used in filters or joins and monitor write performance when adding many indexes.

What are transactions and why are they important?
Mention:

Group multiple operations into a single unit.
Either all succeed or none, which keeps data consistent.
ACID properties: Atomicity, Consistency, Isolation, Durability.

Caching and Performance

Caching questions

What is caching and why is it used?

Storing frequently accessed data in memory or a faster store.
Reduces database load and latency.
Used for: common queries, session data, configuration, pre computed responses.

Where can you cache data in a web application?
Layers:

Client side (browser cache, local storage).
CDN for static assets.
Reverse proxy (like Nginx or API gateway).
Application cache (in memory or Redis).
Database caching mechanisms.

What is cache invalidation and why is it hard?
Briefly:

Removing or updating stale cached entries when data changes.
Hard because the same data can be cached in many places and you must keep all in sync.

Explain TTL in caching.

TTL (time to live) defines how long a cache entry is valid.
After TTL expires, the entry is considered stale and must be refreshed.

Performance and scalability

Difference between vertical and horizontal scaling.

| Type | Description | Example |
|--------------------|----------------------------------------------|---------------------------------|
| Vertical scaling | Add more power to one server | More CPU, RAM on same machine |
| Horizontal scaling | Add more servers and distribute traffic | Load balancer + more instances |

What is a stateless application and why is it useful for scaling?

Stateless: server does not keep client session state between requests.
State is in cookies, tokens, or external stores like Redis.
Any instance can handle any request, so scaling horizontally is easier.

How do you identify performance bottlenecks in a backend?
Mention:

Logging latency for endpoints.
Profiling CPU vs I/O usage.
Database slow query log.
Metrics and monitoring dashboards.

Concurrency, Async, and Background Work

Concurrency concepts

Difference between concurrency and parallelism?

Concurrency: multiple tasks make progress in overlapping time periods.
Parallelism: tasks run at the same time on multiple cores.

What is the difference between CPU bound and I/O bound work?

CPU bound: dominated by computations, encryption, image processing.
I/O bound: spends time waiting for network, disk, database.

Why do many web backends use asynchronous frameworks?

To handle many I/O bound operations per process, such as many concurrent requests that wait on databases or external APIs.

Background and scheduled tasks

Why would you offload work to a background job instead of doing it in the request?

To keep response time low.
For tasks that are slow or do not need immediate completion, such as sending emails, generating reports, processing images.

How would you design a system for sending emails using background jobs?
High level:

API endpoint validates request and creates a job message.
Message is pushed to a queue (Redis, RabbitMQ, SQS).
Worker processes pull messages, send emails via SMTP, handle retries on failure.

How do you deal with failed background jobs?

Store attempts count.
Implement retry policies with backoff.
Move permanently failing jobs to a dead letter queue.
Alert or monitor on DLQ size.

Authentication and Authorization

Authentication questions

Difference between authentication and authorization?

Authentication: verifying identity, "who are you?".
Authorization: checking permissions, "what can you do?".

How should passwords be stored in a database?

Never plain text.
Use strong hashing algorithms designed for passwords, such as bcrypt, Argon2, or scrypt.
Use salt to prevent rainbow table attacks.
Prefer libraries over writing your own crypto.

Important rule: Never store raw passwords or reversible encryption of passwords. Always use a strong, slow, salted password hashing algorithm.

What is a JWT and when would you use it?

JWT (JSON Web Token) encodes claims, such as user id and expiration.
Signed with a secret or private key.
Common for stateless authentication between client and server.

What are some drawbacks of JWTs?

Hard to revoke individually without extra infrastructure.
Tokens can grow large.
Misconfigured expiration can cause security issues.

Authorization and access control

What is role based access control (RBAC)?

Users get roles, roles have permissions.
Example: roles admin, editor, user, each with different allowed actions.

How would you protect an endpoint so that only the resource owner can access it?

Extract user id from authentication token or session.
Query resource and check its owner id.
Deny access if they do not match or user is not privileged.

Security and Reliability

Common web security topics

Explain SQL injection and how to prevent it.

Attack: injecting SQL into queries via user input.
Prevention: always use parameterized queries or ORM, never build SQL by string concatenation.

What is XSS and how do you mitigate it?

Cross site scripting: injecting malicious JS into pages.
Prevention: output escaping, content security policy, input validation, avoiding unsafe HTML rendering.

What is CSRF and how is it mitigated?

Cross site request forgery: attacker tricks browser into sending authenticated requests.
Mitigation: CSRF tokens, SameSite cookies, double submit cookies, checking headers for same origin.

Why is HTTPS important for backend systems?

Encrypts traffic, protects data in transit.
Prevents man in the middle attacks and credential theft.
Required for secure cookies and modern browser features.

Reliability and resilience

How do you make a backend more fault tolerant?
Ideas:

Retry logic for transient errors.
Timeouts on external calls.
Circuit breakers to stop calling failing dependencies.
Graceful shutdown and health checks.

What is a health check endpoint and how is it used?

Simple endpoint like /health or /status.
Returns status of the application, possibly checks database or dependencies.
Load balancers use it to decide if instance should receive traffic.

How would you design for graceful shutdown?

Stop accepting new requests.
Finish ongoing requests within a timeout.
Close database connections and background workers cleanly.

System Design and Architecture

High level design questions

These are common in mid level and senior interviews, but juniors may get simpler versions.

Design a URL shortener. What components would you use?
Main points:

API to create short URLs.
Data store to map short code to full URL.
Redirection endpoint.
Choice of database, unique key generation, caching popular URLs.
Handling analytics, expiration, custom aliases.

Design a simple social feed (following users, seeing posts).
Focus on:

Tables for users, follows, posts.
How to fetch feed: on read (query followers posts) or on write (pre compute feeds).
Caching, pagination, ordering by time.

How would you design rate limiting for an API?
Pieces:

Identify client by API key or user id.
Store counts per key and time window in a fast store like Redis.
Reject with 429 Too Many Requests when over limit.
Consider sliding window or token bucket algorithms.

Difference between monolith and microservices architectures?
Brief contrast:

Monolith: single deployable unit, simpler to develop and deploy, harder to scale individually.
Microservices: many small services with clear boundaries, independent deployment, more complexity in communication and operations.

Trade off questions

Interviewers like to ask "why this, not that".

When would you choose a monolith over microservices for a new project?
Possible answer:

Small team, early stage.
Simpler development and debugging.
You can modularize inside a monolith and split later when needed.

When would you choose eventual consistency instead of strong consistency?

When you need high availability and partition tolerance.
When stale reads are acceptable for some features, such as analytic counters or secondary views.

Language, Framework, and Tooling

Language specific questions (for example Python)

What is the difference between a process and a thread?

Process: separate memory space, independent execution.
Thread: shares memory inside a process, lighter weight.
Concurrency issues, need for synchronization.

What is the GIL (Global Interpreter Lock) in Python and how does it affect web backends?

GIL allows only one Python bytecode thread at a time per process.
Limits CPU bound parallelism in threads.
For I/O bound web backends, GIL impact is less, because threads spend time waiting.

Why use virtual environments?

Isolate dependencies per project.
Avoid conflicts between library versions.
Make deployments more predictable.

How do you structure a medium size backend project?

Separate modules for routes, services, models, repositories, schemas.
Configuration management and environment handling.
Tests directory with unit and integration tests.

Framework and tooling questions

Explain middleware in a web framework.

Code that runs before and after your endpoint handler.
Used for logging, authentication, CORS, error handling.

How do you handle configuration for multiple environments (dev, staging, prod)?

Use environment variables for secrets and environment specific values.
Config files with overrides.
Avoid hard coding credentials.

What is Docker and why is it useful for backend development?

Containerization tool that packages app and its dependencies.
Ensures consistent environment between dev and prod.
Makes it easier to run databases and caches locally.

Testing and Quality

Testing questions

Why is automated testing important for backend systems?

Catches regressions when you change code.
Increases confidence to refactor.
Documents expected behavior.

Difference between unit tests and integration tests.

| Type | Focus | Example |
|-----------------|-----------------------------------|------------------------------------------|
| Unit tests | Small pieces of logic in isolation | Testing a function that validates input |
| Integration tests | Multiple components working together | API endpoint with real database |

How would you test an API endpoint that creates a new user?

Arrange: start test app, use test database.
Act: send HTTP request with valid and invalid inputs.
Assert: check status codes, response body, database state.

What is mocking and when would you use it?

Replace real dependencies like email services or external APIs with controlled fakes.
Ensures tests are fast, deterministic, and do not depend on external services.

Behavioral and Practical Questions

How you work and learn

Describe a backend project you worked on. What was your role?
Prepare:

Brief context.
Your responsibilities.
Technologies used.
One challenge and how you solved it.

Tell me about a time you debugged a hard production issue.
Use a simple structure:

Situation.
What you observed.
How you investigated (logs, metrics, reproduction).
Root cause and fix.
What you learned or improved afterward.

How do you keep your backend skills up to date?

Reading documentation and official guides.
Building side projects.
Following blogs or talks.
Learning from code reviews.

Practical coding style

What do you consider clean code in backend development?
Examples:

Small, focused functions.
Clear naming.
Separation of concerns (handlers vs business logic vs data layer).
Good error handling.
Tests that are easy to read.

How do you handle errors in your APIs?

Centralized error handling middleware.
Consistent error response format.
Proper logging without leaking sensitive data.
Proper use of HTTP status codes.

How to Use These Questions to Prepare

Practice strategy

Use the questions above as a checklist:

Write your own answers.

For each question, write a short, 3 to 6 sentence answer.
Use examples like small API designs or SQL snippets.

Say answers out loud.

Time yourself for 1 to 2 minutes per answer.
Aim for clarity and structure, not memorization.

Turn gaps into study tasks.

If you cannot explain a concept simply, review the relevant course chapter.
Implement a small example in code: for example a simple caching layer or a background task.

Simulate mini interviews.

Ask a friend to pick random questions from this chapter.
Or shuffle them yourself and answer without preparation.

By the time you are comfortable answering most of these backend interview questions, you will have a solid base to tackle real interviews and to grow further as a backend developer.