Interview Questions and Answers

Our short answer

Give your notice period plus any personal buffer you genuinely need (e.g., time off between roles), and note you can be flexible if there's a business reason to move faster or slower.

Our short answer

REST models the API as resources identified by URLs, manipulated with standard HTTP methods, using stateless requests and standard status codes and representations. Good practice: noun-based plural resources, correct methods and status codes, consistent JSON, pagination, filtering, versioning and clear errors.

Our short answer

Likely an empty or partial input (empty export, upstream outage), a renamed or missing column loaded as NULL, or a filter/date bug. Prevent it with volume and freshness monitors, schema and not-null checks on key measures, inputs that fail loudly when empty, and blocking publication on critical test failures.

Our short answer

Ask about success metrics for the role, current team pain points, how decisions get made, and what the first 90 days typically look like.

Our short answer

Clients keep persistent WebSocket connections to gateway servers; messages are persisted to a partitioned store, then fanned out to online recipients through a pub/sub layer that knows which gateway holds each user's connection, with push notifications for offline users.

Our short answer

Stubs return canned answers; mocks additionally verify that expected interactions happened; fakes are working lightweight implementations (in-memory repository); spies wrap real objects and record calls. All are 'test doubles'.

Our short answer

Explain what caused the miss, how early you flagged it (or wish you had), how you communicated with stakeholders, and what you changed in your planning process afterward.

Our short answer

Count requests per key (user, API key, IP) in a shared fast store like Redis using a token bucket or sliding-window algorithm executed atomically, enforce it in a gateway or middleware, and return 429 with Retry-After when limits are exceeded.

Our short answer

The client redirects the user to the authorization server with a code challenge; after login and consent, the server redirects back with a one-time authorization code, which the client exchanges (with the original code verifier) for tokens at the token endpoint. PKCE prevents intercepted codes from being redeemed by attackers.