Backend Engineering interview guide
Every question carries the same frame: the production situation behind it, what it is actually testing, what a strong answer sounds like, and the flags on both sides. The red flags are specific wrong answers a confident engineer really gives — not 'does not know the topic'.
A checkout listing endpoint in a service that has not been rewritten, only deployed to. Error rate is unchanged; nobody is paging, but support tickets mention "the page hangs sometimes". Tuesday had four deploys and a marketing email.
A publishing product. Today all four steps run inline in the POST handler; it usually finishes, and sometimes the browser times out and the author clicks Publish again.
A mobile client on a flaky network. It sends a payment, sees a timeout, and retries — while the first request is still in flight and about to succeed.
The current handler opens a transaction at the top, does all four steps, and commits at the bottom. It works in staging. In production, under load, the service intermittently exhausts its connection pool.
Two teams, two services, one broker. The consuming team reports that occasionally they receive an event for an order that the API says does not exist, and occasionally an order exists that they never heard about.
An e-commerce catalogue. Product data changes when merchants edit listings, which they do all day. Traffic is heavily skewed towards a few hundred products, and there is a long tail of everything else.
A single service behind a load balancer, two instances, one Postgres primary, one Redis, one queue with three workers. Nothing is currently on fire.
Your service exposes POST /webhooks/payments. The provider retries on any non-2xx and does not guarantee ordering. Your handler currently parses JSON, updates the order, sends a receipt email, and returns 200.
A B2B SaaS with a shared schema and a tenant_id column on every table. A recent incident: a report endpoint returned another customer's rows because one query was missing its tenant filter.
A finance app. Invoice ids are sequential integers. The endpoint requires a valid session and returns the invoice found by id.
A Node service, pool size 20, running four instances against one Postgres primary. Database CPU is low. The database's own slow query log is empty.
One dependency is a payment provider, one is an address-lookup service, one is an internal service owned by another team. All three are called during a single user-facing request.
The handler reads the seat count, checks it is greater than zero, decrements it in application code, and writes the new value back.
A product with a web app, a mobile app and a small number of internal services that need to call each other. Requirements include "log out on all devices" and "revoke access immediately when an employee leaves".
The request has a date range, a room id, a guest count and a promo code. The team has a schema library on the route, and someone has proposed moving "all validation" into the database as constraints.
A service where the current error middleware catches everything and returns 500 with the exception message in the body. A pentest flagged that a database error revealed table names.
A containerised service behind a load balancer, rolling deploy, three replicas. The container receives SIGTERM and the process exits immediately.
A rolling deploy means old and new application versions run simultaneously for several minutes. The table has tens of millions of rows.
A Node service. The CSV endpoint is called a few times an hour. During those calls, health checks occasionally fail and p99 across every route rises.
The application is well-tested but the test suite takes 40 minutes, one team's change occasionally breaks another's, and a memory-heavy report feature has twice taken the whole app down.
A support-assistant feature. Tools are exposed to the model as function definitions and dispatched by a service that holds an internal API key.
A public API. The rate limiter keys on the authenticated user id and falls back to IP when there is no user. Body parsing accepts up to 10 MB.
Today the file is posted to your API, buffered in memory, and written to object storage from the handler. Memory spikes during video uploads have caused restarts.
The service runs in a cloud VPC alongside internal admin services and has an instance metadata endpoint available on the standard link-local address.