Capstone: A Customer Portal in Angular

• Feature areas (accounts, transfers, cards, statements, public) as lazy-loaded route trees owned by teams; shared UI components and design tokens in a library; core services (auth, HTTP interceptors, error handling) provided at the root.
• Dependency rules enforced with lint boundaries: features don't import each other's internals.
• Standalone components with signal inputs/outputs; OnPush-style signal-driven rendering.

Look for lazy feature areas aligned with team ownership, shared libraries and enforced boundaries.

• Server data through httpResource/services with caching per account and query; signal-based stores (or NgRx SignalStore) for feature state such as filters and transfer drafts.
• Transactions: server-side paging and filtering with query params as the source of truth (shareable URLs); virtual scrolling for long lists; track by transaction ID.
• Optimistic UI only where safe (card freeze), with rollback; transfers always confirmed by the server.

Strong answers separate server data from UI state, use paging and virtualization, and avoid optimistic updates for money movement.

• Signal Forms for the transfer wizard: one model across steps, schema rules (required, amount limits, IBAN pattern), cross-field validation (amount within daily limit), async validation of the payee via the API.
• submit() maps server errors (insufficient funds, limit exceeded) to fields; a confirmation step with an idempotency key so retries don't duplicate transfers.
• Accessible errors: labels, aria-describedby, focus management on errors.

Look for a typed form model with sync, cross-field and async validation, server error mapping, idempotency and accessibility.

• OIDC authorization code flow with PKCE via a backend-for-frontend holding tokens in httpOnly cookies; functional guards redirect to login; step-up MFA guard for transfers.
• Interceptors add CSRF headers and handle 401 (re-auth) and 403; the API enforces all authorization.
• Angular's sanitization and no bypassSecurityTrust* on user data; strict CSP with nonces (ngCspNonce), Trusted Types; no secrets in the bundle.

Strong answers keep tokens out of JavaScript, treat guards as UX, and use Angular's XSS protections with a strict CSP.

• SSR with prerendering for public pages (rates, help) and client rendering for authenticated areas; hydration with event replay; @defer for charts and below-the-fold widgets.
• Bundle budgets in CI; lazy routes; image optimization with NgOptimizedImage.
• Tests: component tests with TestBed (signals, forms, defer states), HTTP tests with HttpTestingController, router tests with RouterTestingHarness, end-to-end tests (Playwright) for login and transfers, and automated accessibility checks.

Look for per-route rendering choices, deferred loading, budgets, and layered tests including accessibility.