50 Engineering Interview Questions That Actually Work

1. How would you design a rate limiter for a public API?

Good answers discuss token bucket vs sliding window, where to store state (Redis), and what happens when the rate limiter itself fails. Red flag: jumping straight to code without discussing the failure scenario.

2. Explain the difference between SQL and NoSQL and when you would choose each.

Good answers connect the choice to the data model and access patterns, not trends. "Use SQL when you have relational data with complex joins; use NoSQL when you need horizontal write scalability or flexible schemas" is the floor.

3. How do you handle database migrations in a production system with zero downtime?

Good answers cover: expand-contract pattern, backward-compatible changes first, feature flags to gate new schema usage, and rolling deploys. Red flag: "just run the migration script" with no mention of downtime.

4. What is the difference between eventual consistency and strong consistency? Give a real-world example of where each is appropriate.

Good example: eventual consistency for social media likes (does not matter if the count is off by 1 for a second), strong consistency for bank balance reads (always must be accurate).

5. Walk me through how you would debug a Node.js API that is responding slowly under load.

Good answers: check slow query logs, add APM tracing, look for N+1 queries, check connection pool exhaustion, look at garbage collection pauses. Red flag: "add more servers" as a first answer.

6. What is a database index, and what are the trade-offs of adding too many?

Good answers: faster reads, slower writes, increased storage. Covering indexes, composite index column order, and how the query planner uses indexes. Red flag: "indexes make everything faster."

7. Explain how JWT authentication works and what the risks are.

Good answers cover: header.payload.signature structure, stateless verification, the problem with revoking tokens before expiry, and the choice between short-lived JWTs plus refresh tokens vs session storage.

8. How would you design a background job queue for sending emails?

Good answers mention: a queue (Redis, SQS, RabbitMQ), idempotency keys, retry logic with exponential backoff, dead letter queues, and monitoring for stuck jobs.

9. What is connection pooling and why does it matter?

Good answers explain the cost of establishing a database connection, what pool size to use (not always more is better), and what happens when the pool is exhausted.

10. How do you handle secrets management in a backend application?

Good answers: environment variables at minimum, but ideally secrets managers (AWS Secrets Manager, Vault). Never hardcoded, never in version control, rotation strategy.

11. Explain the difference between server-side rendering, static site generation, and client-side rendering. When would you use each?

Good answers connect rendering choice to SEO requirements, data freshness needs, and initial load performance. Not "SSR is always better."

12. How do you prevent layout shift (CLS) on a page that loads images dynamically?

Good answers: reserve space with aspect ratio boxes or explicit width/height attributes, use placeholder images, lazy-load below the fold only.

13. Walk me through how you would optimize a React component that is re-rendering too often.

Good answers: identify with React DevTools Profiler, check for unstable reference props, use useMemo and useCallback appropriately, split components so expensive ones re-render less.

14. How does the browser rendering pipeline work, from HTML to pixels?

Good answers: parse HTML to DOM, parse CSS to CSSOM, combine to render tree, layout, paint, composite. Explains why certain CSS properties trigger layout vs paint vs composite only.

15. How would you implement a search input that calls an API as the user types, without overwhelming the server?

Good answers: debounce the input (300-500ms), cancel in-flight requests when a new keystroke fires (AbortController), handle race conditions where a slow response arrives after a faster one.

16. What is the difference between localStorage, sessionStorage, and cookies? When would you use each?

Good answers: persistence duration, accessibility from JS vs server, size limits, and use cases: cookies for auth tokens sent to server, localStorage for user preferences, sessionStorage for tab-specific state.

17. How would you approach accessibility on a custom dropdown component?

Good answers: ARIA roles (listbox, option), keyboard navigation (arrow keys, Enter, Escape), focus management, visible focus styles, and testing with a screen reader.

18. Explain code splitting in a Next.js application. How does it work automatically and when do you need to do it manually?

Good answers: Next.js splits per page automatically, dynamic imports split components on demand, lazy-loading heavy libraries (charts, editors) manually with next/dynamic.

19. How do you handle form state in a complex multi-step form?

Good answers: React Hook Form or similar for performance (avoid re-rendering on every keystroke), storing state across steps in a parent component or URL params, validation per step vs on final submit.

20. What is hydration in the context of SSR and what causes hydration errors?

Good answers: hydration attaches event listeners to server-rendered HTML. Hydration errors occur when server and client render different markup - common cause is reading browser APIs (window, document) during server-side render.

21. What is the difference between a Docker container and a virtual machine?

Good answers: containers share the host OS kernel (faster, lighter), VMs emulate full hardware. Containers are better for microservices; VMs provide stronger isolation for security-sensitive workloads.

22. Explain blue-green deployment. What are its trade-offs vs canary deployment?

Good answers: blue-green runs two identical environments and switches traffic; canary gradually increases traffic to a new version. Blue-green is faster to roll back; canary reduces blast radius for bugs.

23. How would you set up monitoring and alerting for a production API?

Good answers: structured logging, metrics (error rate, latency p50/p95/p99, throughput), traces (distributed tracing for multi-service), and alerts on SLO breaches not just raw error counts.

24. What happens when you type a URL into a browser? Walk me through the full network path.

Good answers: DNS resolution, TCP handshake, TLS negotiation, HTTP request, server processing, response, browser rendering. Good candidates mention caching at multiple layers.

25. What is Kubernetes and what problem does it solve? When is it overkill?

Good answers: container orchestration - scheduling, scaling, self-healing, service discovery. Overkill for: small teams with one or two services, when managed container services (ECS, Cloud Run) cover the use case.

26. How would you design a CI/CD pipeline for a monorepo with 5 services?

Good answers: detect which service changed (path-based triggers), run affected tests only, build affected images only, deploy in stages with automated rollback on health check failure.

27. Explain infrastructure as code. What are the trade-offs between Terraform and Pulumi?

Good answers: Terraform uses HCL (declarative, large ecosystem, state management complexity), Pulumi uses general-purpose programming languages (more powerful, better for complex logic, smaller community). Both use state to track drift.

28. How do you investigate a production incident where CPU usage is 100%?

Good answers: check which process, look at recent deploys, capture a flame graph or profiling sample, check for runaway loops or memory leaks, check external dependencies for slow responses causing request queuing.

29. What is a service mesh and when would you introduce one?

Good answers: infrastructure layer for service-to-service communication (Istio, Linkerd). Provides: mutual TLS, traffic management, observability. Worth introducing when managing more than 5-10 services and spending significant engineering time on cross-cutting concerns.

30. How would you handle secrets rotation for a running production service?

Good answers: secrets manager with rotation support (AWS Secrets Manager, Vault), application reads secrets at startup or via sidecar, graceful restart on rotation, never embed secrets in images or environment bake-in at build time.

31. Design a URL shortening service (like bit.ly).

Good answers: unique ID generation (base62 encoding), read-heavy so optimized with caching (Redis), collision handling, custom slugs, analytics storage decoupled from redirect path. Discuss scale assumptions first.

32. Design a notification system that sends push, email, and SMS.

Good answers: event-driven with a message queue, notification preference stored per user, retry logic per channel, rate limiting per user, deduplication to avoid double-sends.

33. Design a real-time chat system.

Good answers: WebSockets for real-time delivery, message storage with read receipts, fan-out for group messages, offline message queuing, message ordering guarantees.

34. How would you design the backend for a ride-sharing app's trip matching feature?

Good answers: geospatial indexing (PostGIS, geohash), low-latency matching service, driver location updates via WebSocket or long-poll, state machine for trip lifecycle.

35. Design a content delivery network (CDN).

Good answers: edge nodes close to users, cache invalidation strategies (TTL, event-driven purge), origin shield to protect the origin server, TLS termination at edge, routing to nearest edge node via anycast DNS.

36. Design a product search system for an e-commerce platform.

Good answers: Elasticsearch or OpenSearch for full-text and faceted search, ingestion pipeline from product database, relevance tuning (boosts for in-stock, popular, recent), autocomplete with a separate index for performance.

37. How would you design a distributed rate limiter?

Good answers: central state in Redis with atomic increment, sliding window vs fixed window trade-offs, cluster-aware design where token buckets are shared across nodes, what happens if Redis is unavailable (fail open vs closed).

38. Design a system for processing 10 million IoT sensor events per hour.

Good answers: stream processing (Kafka, Kinesis), partitioning by device ID, batch aggregation to reduce storage, separate hot and cold paths (real-time alerts vs historical analysis), schema evolution.

39. How would you architect a multi-tenant SaaS application?

Good answers: tenant isolation models (separate DB, schema-per-tenant, shared DB with row-level filtering), performance isolation, tenant-specific configuration, data residency requirements.

40. Design a global leaderboard for a mobile game.

Good answers: Redis sorted sets for real-time top-N, periodic batch jobs for full ranking at scale, partitioning for regional leaderboards, eventual consistency acceptable for global rank, TTL for inactive users.

41. Tell me about a time you pushed back on a technical decision made by someone senior to you. What happened?

Look for: how they built their case (data, prototypes, documented risks), whether they influenced the outcome, and how they behaved when overruled. Red flag: never disagreed, or nuclear escalation as first move.

42. Describe the most complex debugging problem you have solved. Walk me through your process.

Look for: systematic elimination of hypotheses, use of observability tools, documentation of findings. Red flag: "I just tried things until it worked."

43. Tell me about a feature or product you shipped that you are not proud of. What would you do differently?

Look for: self-awareness, specific technical or process failures, what they learned. Red flag: "I'm proud of everything I have shipped."

44. How do you decide when code is good enough to ship vs when it needs more work?

Look for: understanding of the business context, not just perfect code standards. "Good enough to learn from users" is a valid answer for early-stage products. Red flag: either "never ship until it's perfect" or "ship fast, fix later" without nuance.

45. Describe how you have mentored or helped a colleague become more effective.

Look for: specifics, patience, ability to explain at different levels. Red flag: no examples at all, or examples that make the colleague look bad.

46. Tell me about a time your team was significantly behind schedule. What did you do?

Look for: scope negotiation, transparent communication upward, focus on highest-value work, realistic assessment of trade-offs. Red flag: worked 16-hour days as the only solution.

47. How do you stay current with technology changes in your field?

Look for: specific sources (not just "I read blogs"), applied learning (side projects, contributions), and judgment about what to learn vs ignore. Red flag: no concrete answer, or chasing every new framework.

48. Describe a time you had to work with a codebase or system you found very difficult to understand.

Look for: patience, documentation as they learned, asking for help appropriately, systematic approach. Red flag: immediate criticism of previous team without understanding the original constraints.

49. How do you handle being wrong in a code review?

Look for: grace, curiosity, updating their understanding, thanking the reviewer. Red flag: defensiveness, dismissiveness, or "it depends on who is reviewing."

50. What do you do when you are blocked on a task for more than a day?

Look for: proactive communication, escalation before it becomes a crisis, attempts to unblock independently first. Red flag: "I wait until standup" or "I figure it out myself and never tell anyone."