Backend Engineering interview guide

Every question carries the same frame: the production situation behind it, what it is actually testing, what a strong answer sounds like, and the flags on both sides. The red flags are specific wrong answers a confident engineer really gives — not 'does not know the topic'.

24 of 24 questions
This endpoint used to answer in about 100 ms. Since Tuesday, p99 is around 3 s and p50 has barely moved. Where do you start?Debugging

A checkout listing endpoint in a service that has not been rewritten, only deployed to. Error rate is unchanged; nobody is paging, but support tickets mention "the page hangs sometimes". Tuesday had four deploys and a marketing email.

A user clicks "Publish". That has to write the post, reindex it for search, generate three thumbnail sizes, and email 4,000 subscribers. What runs in the request and what does not?Async

A publishing product. Today all four steps run inline in the POST handler; it usually finishes, and sometimes the browser times out and the author clicks Publish again.

POST /payments must not charge a customer twice, even if the client retries and even if two retries arrive at the same moment. Design it.Idempotency

A mobile client on a flaky network. It sends a payment, sees a timeout, and retries — while the first request is still in flight and about to succeed.

Placing an order writes an order row, decrements stock, charges a card through Stripe, and writes a ledger entry. What is in the transaction?Transactions

The current handler opens a transaction at the top, does all four steps, and commits at the bottom. It works in staging. In production, under load, the service intermittently exhausts its connection pool.

When an order is placed, another team's service needs to know. Your handler commits the order and publishes an OrderPlaced event. What is wrong with that sentence?Events

Two teams, two services, one broker. The consuming team reports that occasionally they receive an event for an order that the API says does not exist, and occasionally an order exists that they never heard about.

The product page endpoint is the slowest thing we have. Someone suggests putting Redis in front of it. What do you want to know before agreeing?Caching

An e-commerce catalogue. Product data changes when merchants edit listings, which they do all day. Traffic is heavily skewed towards a few hundred products, and there is a long tail of everything else.

Your service handles today's traffic comfortably. Marketing says 10x is coming in six weeks. What do you do?Scaling

A single service behind a load balancer, two instances, one Postgres primary, one Redis, one queue with three workers. Nothing is currently on fire.

Design the endpoint that receives payment webhooks from a provider. Everything that can go wrong, and what you do about it.Webhooks

Your service exposes POST /webhooks/payments. The provider retries on any non-2xx and does not guarantee ordering. Your handler currently parses JSON, updates the order, sends a receipt email, and returns 200.

One database, many customers. How do you make it structurally hard for tenant A to read tenant B's data?Authz

A B2B SaaS with a shared schema and a tenant_id column on every table. A recent incident: a report endpoint returned another customer's rows because one query was missing its tenant filter.

GET /invoices/:id returns an invoice. What has to be true for that to be safe, and where does the check go?Authz

A finance app. Invoice ids are sequential integers. The endpoint requires a valid session and returns the invoice found by id.

Under load, every request to your service takes about the same long time and then some start failing with "timeout acquiring connection". What is happening?Data Access

A Node service, pool size 20, running four instances against one Postgres primary. Database CPU is low. The database's own slow query log is empty.

Your service calls three third-party APIs. Give me your timeout and retry policy, and defend the numbers.Integrations

One dependency is a payment provider, one is an address-lookup service, one is an internal service owned by another team. All three are called during a single user-facing request.

Two requests arrive at the same instant to book the last seat. Both read "1 available". Walk me through what happens and how you stop it.Concurrency

The handler reads the seat count, checks it is greater than zero, decrements it in application code, and writes the new value back.

A new service needs to authenticate users. Server-side sessions or JWTs — and what makes the answer different for a mobile app versus a browser?Authn

A product with a web app, a mobile app and a small number of internal services that need to call each other. Requirements include "log out on all devices" and "revoke access immediately when an employee leaves".

A user submits a booking. What do you validate, and where does each check live?Validation

The request has a date range, a room id, a guest count and a promo code. The team has a schema library on the route, and someone has proposed moving "all validation" into the database as constraints.

Something fails inside your handler. What does the client get, what goes in the logs, and how do you decide?Observability

A service where the current error middleware catches everything and returns 500 with the exception message in the body. A pentest flagged that a database error revealed table names.

You deploy. Users report a handful of failed requests and two duplicate emails every time. Why, and what do you change?Deployment

A containerised service behind a load balancer, rolling deploy, three replicas. The container receives SIGTERM and the process exits immediately.

You need to rename a column that a live, heavily-used endpoint reads and writes. Zero downtime. How?Deployment

A rolling deploy means old and new application versions run simultaneously for several minutes. The table has tens of millions of rows.

One endpoint parses a large uploaded CSV in memory. When it runs, unrelated endpoints in the same service also get slow. Explain.Runtimes

A Node service. The CSV endpoint is called a few times an hour. During those calls, health checks occasionally fail and p99 across every route rises.

A ten-engineer team has one deployable application. Deploys are getting scary. Someone proposes splitting into services. What do you say?Architecture

The application is well-tested but the test suite takes 40 minutes, one team's change occasionally breaks another's, and a memory-heavy report feature has twice taken the whole app down.

An LLM agent in your product can call your internal tools: read customer records, issue refunds, send emails. What does the backend owe here?Agentic

A support-assistant feature. Tools are exposed to the model as function definitions and dispatched by a service that holds an internal API key.

Your pipeline is: logging, body parsing, rate limiting, authentication, authorization, handler. What is wrong with that order?Middleware

A public API. The rate limiter keys on the authenticated user id and falls back to IP when there is no user. Body parsing accepts up to 10 MB.

Users upload profile photos and, occasionally, 2 GB videos. Design the upload path.Files

Today the file is posted to your API, buffered in memory, and written to object storage from the handler. Memory spikes during video uploads have caused restarts.

A feature lets users give a URL and your backend fetches it to build a link preview. What can go wrong?Security

The service runs in a cloud VPC alongside internal admin services and has an instance metadata endpoint available on the standard link-local address.