Backend interview practice

Real backend interview questions as two-minute exercises. Commit to an answer first, then check it and read the full explanation with runnable Python and SQL.

Try a 2-minute question

Prefer to just read? Every question has Show answer. Progress is saved on this device only, separately from the iOS and Android courses.

  1. PredictPick what you think happens, or tap the line with the bug.
  2. CheckSee whether you were right, and why every other option is wrong.
  3. Learn itRead the 30-second answer, then the deep dive and follow-ups.

– interview-ready · 200 questions

– of 200 tried

Saved on this device. Interview-ready means you got it right on two different days. Guesses and hints count for less.

Daily 5

The same five questions for everyone today, with a grid to share. Needs JavaScript. Start with the first question.

Open today's Daily 5 page

Readiness by topic

Your progress is saved in this browser only. With JavaScript on, this shows each topic's readiness and lets you export your progress to a file or import it on another device.

Topics

Transactions, isolation and locking

ACID, isolation levels as PostgreSQL implements them, lost updates and write skew, row locks, MVCC, deadlocks and retries.

14 questions

SQL, indexing and PostgreSQL

B-tree and other index types, reading EXPLAIN, N+1 queries, upserts, pagination, NULL rules, pooling and migrations that don't lock production.

14 questions

Distributed systems

CAP and consistency models, replication, quorums, consensus, partitioning, clocks, retries, timeouts, sagas and the outbox pattern.

18 questions

API design: REST, HTTP, GraphQL and gRPC

Resources and methods, status codes, idempotency keys, ETags, pagination, versioning, errors, rate limits, webhooks and when to pick GraphQL or gRPC.

22 questions

Caching and Redis

Cache-aside and write strategies, invalidation, stampedes, TTL jitter, eviction, HTTP and CDN caching, Redis data structures and durability.

12 questions

Queues, Kafka and event-driven systems

Queues vs pub/sub, Kafka partitions and consumer groups, delivery semantics, ordering, dead letters, backpressure, event sourcing and schema evolution.

14 questions

NoSQL and choosing a database

Document, key-value, wide-column, search, time-series and graph stores, JSONB in PostgreSQL, and how to choose.

10 questions

Concurrency in Python services

Threads, processes and asyncio, the GIL and free-threaded Python, races in async code, blocking calls, cancellation, limits and request context.

12 questions

Authentication and authorization

Sessions and tokens, JWT validation, refresh rotation, OAuth 2.0 with PKCE, OpenID Connect, password hashing, MFA, API keys, service identity and access control models.

12 questions

Backend security

Object-level authorization, injection, SSRF, CSRF, XSS, secrets, request signing, credential stuffing, TLS, mass assignment, supply chain and security headers.

12 questions

Performance and scaling

Load balancing, tail latency, Little's law, profiling, scaling up and out, read replicas, batching, compression, autoscaling, load testing, hot spots and memory.

12 questions

Observability and operations

Structured logs, metrics and cardinality, tracing, SLOs and alerts, health checks, RED and USE, sensitive data in logs, incidents, postmortems and audit logs.

10 questions

Testing backends

The test pyramid, fakes and mocks, real-database tests, contract tests, time and randomness, flaky tests, fixtures, migrations, property-based tests and chaos experiments.

10 questions

Cloud, deploys and infrastructure

Expand-and-contract deploys, graceful shutdown, containers, Kubernetes basics, canary releases, feature flags, config, infrastructure as code, disaster recovery and serverless.

10 questions

System design

Estimates, layering, monolith or microservices, and full designs: URL shortener, news feed, chat, payments, rate limiter service, autocomplete and file storage.

10 questions

Backends for mobile apps

Push at scale, time zones, backend-for-frontend, offline sync, minimum app versions, image delivery, purchase verification and API performance on mobile networks.

8 questions

All questions

Transactions, isolation and locking

  1. Write skew under REPEATABLE READPredict
  2. What ACID really promisesPick the fix
  3. Isolation levels in PostgreSQLPick the fix
  4. The lost update problemFill the blank
  5. SELECT FOR UPDATE and SKIP LOCKEDFill the blank
  6. Optimistic vs pessimistic lockingPick the fix
  7. Retrying serialization failuresSpot the bug
  8. MVCC, dead tuples and VACUUMPredict
  1. Deadlocks and lock orderingSpot the bug
  2. Why long transactions hurtPick the fix
  3. Errors inside a transactionPredict
  4. Advisory locksPredict
  5. Where transactions begin and end in codeOrder the steps
  6. Two-phase commit and why services avoid itPick the fix

SQL, indexing and PostgreSQL

  1. How a B-tree index speeds up a queryPick the fix
  2. Column order in a composite indexPick the fix
  3. Index-only scans and INCLUDEFill the blank
  4. Reading EXPLAIN ANALYZEOrder the steps
  5. B-tree, GIN, GiST, BRIN and hashPick the fix
  6. Partial and expression indexesPredict
  7. The N+1 query problemSpot the bug
  8. Upserts with ON CONFLICTPredict
  1. OFFSET vs keyset paginationPredict
  2. NULL, three-valued logic and NOT INPredict
  3. Window functionsPredict
  4. Normalization and when to denormalizePick the fix
  5. Connection pooling and PgBouncerPick the fix
  6. Schema changes without downtimeOrder the steps

Distributed systems

  1. What CAP actually saysPick the fix
  2. Consistency models from strong to eventualPick the fix
  3. Leader-follower replication and lagOrder the steps
  4. Quorum reads and writesPredict
  5. Consensus and RaftPredict
  6. Leader election, leases and fencing tokensSpot the bug
  7. Locks in Redis: when they're safePick the fix
  8. Consistent hashingPredict
  1. Sharding: range, hash and directoryPick the fix
  2. Retries with exponential backoff and jitterPredict · timeline
  3. Timeouts and deadline propagationPredict
  4. Circuit breakers and bulkheadsPredict
  5. At-most-once, at-least-once and 'exactly once'Spot the bug
  6. The transactional outbox patternPick the fix
  7. Sagas: orchestration vs choreographyPredict
  8. CQRS and read modelsPick the fix
  9. Clocks, timestamps and ordering eventsPredict
  10. Detecting failures and avoiding split brainPick the fix

API design: REST, HTTP, GraphQL and gRPC

  1. Designing REST resourcesPick the fix
  2. Safe and idempotent HTTP methodsPredict
  3. Choosing HTTP status codesPick the fix
  4. Idempotency keys for POSTFill the blank
  5. ETags and conditional requestsPredict
  6. Paginating API responsesPredict
  7. Versioning an APIPick the fix
  8. Which API changes are breakingPick the fix
  1. A consistent error formatPredict
  2. Rate limiting with a token bucketPredict
  3. 429, Retry-After and rate-limit headersPick the fix
  4. When GraphQL fits and what it costsPick the fix
  5. gRPC vs RESTPick the fix
  6. Designing reliable webhooksPredict
  7. Long-running operations: 202 and pollingOrder the steps
  8. CORS: what it protects and how to configure itPick the fix
  9. JSON pitfalls: money, big ids and datesPredict
  10. PATCH: merge patch vs JSON PatchPredict
  11. Uploading large filesOrder the steps
  12. Polling, SSE and WebSocketsPick the fix
  13. Batch and bulk endpointsPredict
  14. What an API gateway doesPick the fix

Caching and Redis

  1. Cache-aside: the default caching patternOrder the steps
  2. Write-through, write-behind and write-aroundPick the fix
  3. Keeping a cache consistent with the databaseOrder the steps
  4. Cache stampede on a hot keyPick the fix
  5. Spreading expiries with TTL jitterPredict
  6. Eviction: LRU, LFU and maxmemoryPredict
  7. HTTP caching headersPick the fix
  8. What to put behind a CDNPick the fix
  1. Choosing Redis data structuresPredict
  2. Scaling a cache cluster and hot keysPick the fix
  3. Cache penetration and negative cachingPredict
  4. Redis durability: RDB, AOF and when Redis is a databasePick the fix

Queues, Kafka and event-driven systems

  1. Work queues vs publish/subscribePick the fix
  2. Background job queuesOrder the steps
  3. Kafka partitions, keys and orderingPick the fix
  4. Consumer groups and rebalancingPredict
  5. Committing offsets: at-most-once vs at-least-onceSpot the bug
  6. Keeping messages in orderPredict
  7. Dead-letter queues and poison messagesPick the fix
  8. Idempotent consumers and deduplicationPredict
  1. Backpressure when consumers fall behindPredict
  2. Event sourcingPredict
  3. Evolving event schemasPick the fix
  4. Kafka or RabbitMQ?Pick the fix
  5. Scheduled jobs that run oncePredict
  6. Monitoring consumer lagPredict

NoSQL and choosing a database

  1. Document store or relational database?Pick the fix
  2. JSONB in PostgreSQLPredict
  3. Partition keys in DynamoDB-style storesPick the fix
  4. Wide-column stores like CassandraPick the fix
  5. Search with Elasticsearch or OpenSearchPredict
  6. Storing time-series dataPredict
  7. When a graph database helpsPredict
  8. Embedding vs referencing in MongoDBPick the fix
  9. Choosing a database for a new serviceOrder the steps
  10. Object storage for filesPick the fix

Concurrency in Python services

  1. The GIL, threads and processesPick the fix
  2. How asyncio worksPredict
  3. Blocking calls inside async codeFill the blank
  4. Race conditions in async codePredict
  5. Sharing state between threads safelyFill the blank
  6. Limiting concurrency with semaphoresPredict
  7. Cancellation and cleanup in asyncioPredict
  8. WSGI vs ASGI serversPredict
  1. Request-scoped context with contextvarsPredict
  2. Producer-consumer with asyncio.QueueOrder the steps
  3. Deadlocks with application locksPick the fix
  4. TaskGroup vs gatherPredict

Authentication and authorization

  1. Server sessions vs stateless tokensPick the fix
  2. Validating a JWT properlyPredict
  3. Access tokens, refresh tokens and rotationOrder the steps
  4. OAuth 2.0 authorization code with PKCEOrder the steps
  5. OpenID Connect and ID tokensPick the fix
  6. Storing passwordsPredict
  7. MFA and TOTP codesPredict
  8. API keys done rightPick the fix
  1. Authenticating service-to-service callsPick the fix
  2. RBAC, ABAC and resource ownershipPick the fix
  3. Revoking tokens and sessionsPredict
  4. Cookie flags for session securityPick the fix

Backend security

  1. Broken object level authorization (BOLA)Spot the bug
  2. SQL injection and parameterised queriesPredict
  3. Server-side request forgery (SSRF)Predict
  4. CSRF and how cookies cause itPick the fix
  5. XSS from a backend's point of viewPredict
  6. Managing secretsOrder the steps
  7. Signing requests and webhooks with HMACPredict
  8. Credential stuffing and brute forcePick the fix
  1. Encryption in transit and at restPick the fix
  2. Mass assignmentSpot the bug
  3. Dependency and supply-chain securityPick the fix
  4. HTTP security headersPick the fix

Performance and scaling

  1. Load balancing strategiesPredict
  2. Why percentiles, not averagesPredict
  3. Capacity with Little's lawPredict
  4. Finding where time goesOrder the steps
  5. Scaling up vs scaling outPick the fix
  6. Scaling reads with replicasPick the fix
  7. Batching database writesPick the fix
  8. Compressing API responsesPredict
  1. Autoscaling servicesPick the fix
  2. Load testing a backendOrder the steps
  3. Hot keys and hot partitionsPredict
  4. Memory growth in Python servicesSpot the bug

Observability and operations

  1. Structured loggingPredict
  2. Metrics and label cardinalityPredict
  3. Distributed tracingOrder the steps
  4. SLOs, error budgets and alertsPredict
  5. Liveness and readiness checksPick the fix
  6. RED and USE dashboardsPick the fix
  7. Keeping secrets and personal data out of logsPredict
  8. Running an incidentOrder the steps
  9. Blameless postmortemsPick the fix
  10. Audit logsPick the fix

Testing backends

  1. The test pyramid for a backendPick the fix
  2. Fakes, stubs and mocksPredict
  3. Integration tests with a real databasePredict
  4. Contract testing between servicesOrder the steps
  5. Testing code that uses time and randomnessPredict
  6. Flaky testsPick the fix
  7. Test data and fixturesPredict
  8. Testing database migrationsPick the fix
  9. Property-based testingPredict
  10. Chaos experiments and failure testingOrder the steps

Cloud, deploys and infrastructure

  1. Expand and contract changesOrder the steps
  2. Graceful shutdownPredict
  3. Containers and imagesPick the fix
  4. Kubernetes basics for backend developersPick the fix
  5. Blue-green and canary releasesOrder the steps
  6. Feature flags on the serverPredict
  7. Configuration across environmentsPredict
  8. Infrastructure as codePick the fix
  9. Backups, RPO, RTO and multi-regionPredict
  10. When serverless fitsPick the fix

System design

  1. Back-of-the-envelope estimatesPredict
  2. Layering a backend servicePick the fix
  3. Monolith or microservicesPick the fix
  4. Design a URL shortenerPredict
  5. Design a news feedPick the fix
  6. Design a chat backendOrder the steps
  7. Design a payment flowPredict
  8. Design a distributed rate limiterPick the fix
  9. Design search autocompletePick the fix
  10. Design file uploads and storagePick the fix

Backends for mobile apps

  1. Sending push notifications at scaleOrder the steps
  2. Time zones and timestampsPredict
  3. Backend for frontend (BFF)Pick the fix
  4. An API for offline syncPredict
  5. Minimum supported app versionsPredict
  6. Serving images to mobile appsPick the fix
  7. Verifying in-app purchases on the serverOrder the steps
  8. API performance on mobile networksPick the fix

Sources: Topic outline informed by System Design Primer by Donne Martin and the Zalando RESTful API Guidelines, both licensed under CC BY 4.0. Every question and answer is written by Best Latest Apps. Credits and license