.NET Full Stack Developer Interview Questions &amp; Answers

Show answer

// entity query with parameters (interpolation becomes SqlParameter) var orders = await db.Orders .FromSql($"SELECT * FROM Orders WHERE City = {city}") .Where(o => o.Total > 1000) .ToListAsync(); // non-entity results var totals = await db.Database .SqlQuery<decimal>($"SELECT SUM(Total) AS Value FROM Orders") .ToListAsync(); // stored procedure await db.Database.ExecuteSqlAsync($"EXEC usp_CloseMonth {month}"); Never build SQL by string concatenation; FromSqlRaw with concatenated input invites SQL injection.

Protect an Angular route so only logged-in users can open it.

Show answer

import { CanActivateFn, Router } from '@angular/router'; import { inject } from '@angular/core'; export const authGuard: CanActivateFn = () => { const auth = inject(AuthService); return auth.isLoggedIn() ? true : inject(Router).createUrlTree(['/login']); }; // app.routes.ts export const routes = [ { path: 'dashboard', component: DashboardComponent, canActivate: [authGuard] }, { path: 'login', component: LoginComponent } ]; Guards only improve user experience; the API must still enforce [Authorize] on the server.

Write custom middleware that logs how long each request takes.

Show answer

public class TimingMiddleware(RequestDelegate next, ILogger<TimingMiddleware> logger) { public async Task InvokeAsync(HttpContext context) { var sw = Stopwatch.StartNew(); await next(context); sw.Stop(); logger.LogInformation("{Method} {Path} -> {Status} in {Ms} ms", context.Request.Method, context.Request.Path, context.Response.StatusCode, sw.ElapsedMilliseconds); } } // Program.cs app.UseMiddleware<TimingMiddleware>(); Code before next runs on the request, code after it runs on the response.

Describe an API you designed end to end and the decisions you made.

Show answer

In my last project (Situation) we needed a leave-management API for 3,000 employees. My task was the full design. I modelled resources like /employees/{id}/leaves, used DTOs separate from EF entities, JWT with role policies for managers, FluentValidation, ProblemDetails errors and paging on every list. I documented it in OpenAPI and agreed the contract with the Angular team first. Result: front and back ends were built in parallel and launched on time.

What types of filters exist in ASP.NET Core MVC?

Show answer

Authorization filters run first and can block a request. Resource filters run before model binding, useful for caching. Action filters run before and after an action, for logging or validation. Exception filters handle errors thrown by actions. Result filters run around the result execution, for example to add headers. Filters apply globally, per controller or per action. Unlike middleware, they can access MVC details like action arguments.

Where do you see yourself in five years?

SQL Server and T-SQLEasy

Show answer

In five years I want to be a senior full stack engineer who can design a complete .NET system, from database and APIs to front end and cloud deployment, and guide newer developers. In the near term I want to master ASP.NET Core, EF Core and SQL Server performance, then grow into Azure and system design. I would like to grow inside one company where I can take on bigger modules over time.

Implement global exception handling that returns ProblemDetails.

Show answer

public class GlobalExceptionHandler(ILogger<GlobalExceptionHandler> logger) : IExceptionHandler { public async ValueTask<bool> TryHandleAsync(HttpContext ctx, Exception ex, CancellationToken ct) { logger.LogError(ex, "Unhandled error"); var status = ex is KeyNotFoundException ? 404 : 500; ctx.Response.StatusCode = status; await ctx.Response.WriteAsJsonAsync(new ProblemDetails { Status = status, Title = status == 404 ? "Not found" : "Server error" }, ct); return true; } } // Program.cs builder.Services.AddExceptionHandler<GlobalExceptionHandler>(); builder.Services.AddProblemDetails(); app.UseExceptionHandler();

What is the difference between .NET Framework, .NET Core and modern .NET?

C# FundamentalsEasy

Show answer

.NET Framework is the original Windows-only runtime, now in maintenance mode at version 4.8.1. .NET Core was the cross-platform, open-source rewrite. From .NET 5 onwards the name became just .NET, and it runs on Windows, Linux and macOS. In 2026, .NET 10 is the current LTS release. New projects should use modern .NET; Framework is kept only for legacy apps such as old Web Forms or WCF services.

Your product API runs on four instances behind a load balancer and needs caching. Which ASP.NET Core caching options would you consider?

ASP.NET Core Web APIHard

Show answer

IMemoryCache stores data in the server's memory, fast but not shared across instances. IDistributedCache uses Redis or SQL Server so all instances share the cache. HybridCache, added in .NET 9, combines an in-memory layer with a distributed one and prevents cache stampedes. Output caching stores whole HTTP responses on the server, while response caching sets HTTP headers for browsers and proxies. Always set expiry and invalidate when data changes.

A query that used to run in 1 second now takes 30 seconds. How do you troubleshoot it?

Show answer

Capture the actual execution plan and look for table or index scans on large tables, key lookups, big differences between estimated and actual rows, and warnings like implicit conversions or spills to tempdb. Check missing or fragmented indexes and outdated statistics, and update them. Use Query Store to compare the old and new plans; if a plan regressed, you can force the good plan while fixing the root cause.

What are useMemo and useCallback used for in React?

Show answer

useMemo caches the result of an expensive calculation and recalculates only when its dependencies change, such as filtering 10,000 rows. useCallback caches a function reference so that a child wrapped in React.memo does not re-render just because a new function was created. Both are optimisations and add complexity, so use them where profiling shows a problem. The React Compiler, stable since late 2025, can apply much of this memoisation automatically.

Tell me about a time you led a team to deliver a complex feature.

Angular and React Front EndHard

Show answer

As tech lead (Situation) I owned a vendor-payments module touching Angular, three APIs and SQL Server. My task was to deliver it in six weeks with four developers. I broke it into vertical slices, defined API contracts first, set up feature flags and reviewed every pull request within a day. When one developer struggled with EF Core, I paired with them. Result: we released on time with no critical bugs and two juniors grew into module owners.

What is the difference between reactive forms and template-driven forms in Angular?

Show answer

Template-driven forms are defined mainly in HTML with ngModel and directives; they are quick for simple forms but harder to test. Reactive forms are defined in TypeScript with FormGroup, FormControl and Validators, giving explicit, strongly typed models, easy dynamic fields, custom and async validators, and straightforward unit testing. For enterprise apps such as loan application or KYC forms, reactive forms are the usual choice.

Configure a one-to-many relationship between Customer and Order using the Fluent API.

Show answer

public class Customer { public int Id { get; set; } public List<Order> Orders { get; set; } = []; } public class Order { public int Id { get; set; } public int CustomerId { get; set; } public Customer Customer { get; set; } = null!; } protected override void OnModelCreating(ModelBuilder mb) { mb.Entity<Order>() .HasOne(o => o.Customer) .WithMany(c => c.Orders) .HasForeignKey(o => o.CustomerId) .OnDelete(DeleteBehavior.Restrict); mb.Entity<Order>().Property(o => o.Total).HasPrecision(18, 2); } Restrict prevents deleting a customer who still has orders.

Your Angular app's first load is slow on mobile because the main bundle is very large. How does lazy loading of routes help?

Show answer

Lazy loading splits the app into chunks that download only when the user navigates to that route, so the initial bundle is smaller and the first page loads faster, especially on mobile data. In Angular use loadComponent or loadChildren with a dynamic import in the route config; in React use React.lazy with Suspense or the router's lazy option. Angular's @defer blocks can also delay heavy parts of a page.

An admin page renders 20,000 rows in a table and the browser freezes. How do you fix it?

Show answer

Do not send or render everything at once. Add server-side paging, sorting and filtering in the ASP.NET Core API so the page loads perhaps 50 rows at a time. If users truly need to scroll a long list, use virtual scrolling, such as Angular CDK virtual scroll or TanStack Virtual in React, so only visible rows exist in the DOM. Also use trackBy or keys, and debounce search inputs.

How do model binding and validation work in ASP.NET Core Web API?

Show answer

Model binding maps request data into action parameters from the route, query string, headers or body, using [FromRoute], [FromQuery] and [FromBody]. Validation uses data annotations like [Required], [StringLength] and [Range] on DTOs. With [ApiController], invalid models automatically return 400 Bad Request with ProblemDetails listing the errors, so you do not need to check ModelState manually. FluentValidation is popular for complex rules.

How does EF Core handle many-to-many relationships?

Show answer

Since EF Core 5, you can define collection navigations on both sides, such as Student.Courses and Course.Students, and EF Core creates a hidden join table automatically. If the join needs extra data, like EnrolledOn or Grade, create an explicit join entity Enrollment with two foreign keys and configure it with UsingEntity or two one-to-many relationships. Querying works naturally with Include or projections through the navigations.

Write an Angular HTTP interceptor that adds a JWT to every API request.

Show answer

import { HttpInterceptorFn } from '@angular/common/http'; import { inject } from '@angular/core'; export const authInterceptor: HttpInterceptorFn = (req, next) => { const token = inject(AuthService).token(); if (token) { req = req.clone({ setHeaders: { Authorization: `Bearer ${token}` } }); } return next(req); }; // app.config.ts provideHttpClient(withInterceptors([authInterceptor])); Requests are immutable, so clone() creates a modified copy. The ASP.NET Core JWT middleware then reads the header.

Write a SQL Server query to find the second highest salary.

SQL Server and T-SQLEasy

Show answer

-- using DENSE_RANK (handles ties) SELECT Salary FROM ( SELECT Salary, DENSE_RANK() OVER (ORDER BY Salary DESC) AS rnk FROM Employees ) t WHERE rnk = 2; -- using OFFSET SELECT DISTINCT Salary FROM Employees ORDER BY Salary DESC OFFSET 1 ROW FETCH NEXT 1 ROW ONLY; Change 2 to N for the Nth highest salary.

What are services and dependency injection in Angular?

Show answer

A service is a class, marked @Injectable, that holds logic or data shared across components, such as API calls, authentication or a cart. Angular's DI creates the service and provides it to components that request it in the constructor or with the inject() function. With providedIn: 'root', one shared instance exists for the whole app. This keeps components focused on UI and makes logic easy to test.

Write a stored procedure that transfers money between accounts with TRY-CATCH and a transaction.

Show answer

CREATE OR ALTER PROCEDURE usp_Transfer @From INT, @To INT, @Amt DECIMAL(18,2) AS BEGIN SET NOCOUNT ON; SET XACT_ABORT ON; BEGIN TRY BEGIN TRAN; UPDATE Accounts SET Balance = Balance - @Amt WHERE Id = @From AND Balance >= @Amt; IF @@ROWCOUNT = 0 THROW 50001, 'Insufficient balance', 1; UPDATE Accounts SET Balance = Balance + @Amt WHERE Id = @To; COMMIT; END TRY BEGIN CATCH IF @@TRANCOUNT > 0 ROLLBACK; THROW; END CATCH END

What is the difference between a primary key and a unique key in SQL Server?

SQL Server and T-SQLEasy

Show answer

Both enforce uniqueness. A table can have only one primary key, it cannot contain NULLs, and by default SQL Server creates a clustered index for it. A table can have many unique constraints, each allowing a single NULL in SQL Server, and they create non-clustered indexes by default. Use the primary key for row identity, such as EmployeeId, and unique keys for business rules like a unique email or PAN.

Explain the transient, scoped and singleton service lifetimes.

ASP.NET Core Web APIEasy

Show answer

Transient services are created every time they are requested, suitable for lightweight stateless helpers. Scoped services are created once per HTTP request and shared within it; DbContext is registered as scoped. Singleton services are created once for the whole application lifetime, suitable for caches and configuration. Choose based on state: anything holding per-request data must not be singleton, and singletons must be thread-safe.

A complex reporting query written in EF Core is slow and hard to tune. When would you move it to Dapper?

Entity Framework CoreHard

Show answer

Dapper is a micro-ORM that maps raw SQL results to objects with very low overhead. It suits read-heavy reports, complex hand-tuned queries and stored procedures where you want full SQL control. EF Core offers change tracking, migrations, LINQ and relationships, which speed up CRUD development. Many projects use both: EF Core for writes and normal features, Dapper for performance-critical queries, sharing the same connection string.

A page listing 100 orders with customer names runs 101 SQL queries. What is the problem and how do you fix it?

Show answer

This is the N+1 problem: one query loads the orders, then lazy loading fires a separate query for each order's Customer. Fix it by loading everything in one query, either with Include(o => o.Customer) or better with a projection: Select(o => new OrderListDto(o.Id, o.Total, o.Customer.Name)), which fetches only needed columns via a join. Turn on EF Core logging to spot such patterns early.

What is the difference between authentication and authorization in ASP.NET Core?

ASP.NET Core Web APIEasy

Show answer

Authentication answers who you are: middleware reads a cookie or JWT, validates it and builds a ClaimsPrincipal for HttpContext.User. Authorization answers what you may do: it checks that user against rules such as [Authorize(Roles = "Admin")] or a policy like requiring an Employee claim with a certain department. A missing or invalid identity gives 401 Unauthorized, while a valid user without permission gets 403 Forbidden.

What are components and standalone components in Angular?

Angular and React Front EndEasy

Show answer

A component is a TypeScript class with the @Component decorator, a template and styles, representing one piece of UI such as a product card. Earlier, every component had to be declared in an NgModule. Standalone components import their own dependencies directly through the imports array and need no module; since Angular 19 they are the default. This simplifies apps, enables easier lazy loading and is the recommended approach in 2026.

What is a view and what is an indexed view?

Show answer

A view is a saved SELECT query that acts like a virtual table; it simplifies complex joins and can restrict which columns users see, but by default it stores no data. An indexed view has a unique clustered index, so SQL Server physically stores and maintains its results, which speeds up heavy aggregations. The cost is slower writes on base tables, and it requires SCHEMABINDING and deterministic expressions.

Fetch products from an ASP.NET Core API in React with loading and error states.

Show answer

How do you manage application state in Angular and React apps?

Show answer

Start simple: local component state, then share through a parent or a service. In Angular, a service holding signals covers most needs, and NgRx or NgRx SignalStore suits large apps with complex flows. In React, Context works for low-frequency data like theme or user, Redux Toolkit or Zustand for complex client state, and TanStack Query for server data with caching. Keep server data and UI state separate.

Show the difference between ROW_NUMBER, RANK and DENSE_RANK with a query.

Show answer

SELECT Name, Department, Salary, ROW_NUMBER() OVER (PARTITION BY Department ORDER BY Salary DESC) AS RowNum, RANK() OVER (PARTITION BY Department ORDER BY Salary DESC) AS Rnk, DENSE_RANK() OVER (PARTITION BY Department ORDER BY Salary DESC) AS DenseRnk FROM Employees; -- salaries 90, 90, 80 give -- ROW_NUMBER: 1, 2, 3 -- RANK: 1, 1, 3 -- DENSE_RANK: 1, 1, 2 PARTITION BY restarts numbering for each department.

Show how to bind configuration from appsettings.json using the Options pattern.

Show answer

// appsettings.json // "Smtp": { "Host": "smtp.example.com", "Port": 587 } public class SmtpOptions { public string Host { get; set; } = ""; public int Port { get; set; } } builder.Services.Configure<SmtpOptions>(builder.Configuration.GetSection("Smtp")); public class EmailService(IOptions<SmtpOptions> options) { private readonly SmtpOptions _smtp = options.Value; } appsettings.{Environment}.json and environment variables override base values. Use IOptionsMonitor to pick up changes without restart.

Tell me about a disagreement with the front-end team over an API contract and how you resolved it.

Show answer

On a dashboard feature (Situation) the React team wanted one endpoint returning everything, while I worried about payload size. My task was to agree a design quickly. I set up a short call, we listed exact screen needs, and I proposed one aggregated endpoint with paging and optional fields. We wrote the OpenAPI spec together. Result: payload dropped by half, the UI got one call, and the spec became our template for later features.

Your team debates wrapping EF Core in a generic repository. What is your view?

Entity Framework CoreHard

Show answer

DbContext already implements Repository and Unit of Work, so a thin generic repository with GetAll and Add often adds code while hiding useful features like Include, projections and AsNoTracking. I prefer either using DbContext directly in services, or specific repositories with meaningful methods like GetOverdueInvoicesAsync that encapsulate queries. For tests, use the SQLite in-memory provider or Testcontainers rather than mocking DbSet.

What is the difference between controllers and Minimal APIs?

Show answer

Controllers group actions into classes with attributes for routing, filters and model binding, which suits large APIs with many conventions. Minimal APIs map endpoints directly with app.MapGet and lambdas, with less ceremony and slightly better performance, ideal for microservices and small APIs. Since .NET 7 they support filters, route groups and OpenAPI, and .NET 10 adds built-in validation, so both are production-ready choices.

A read-only product listing endpoint in EF Core uses a lot of memory and CPU. What simple change helps, and why?

Show answer

By default, EF Core tracks every entity it loads so it can detect changes on SaveChanges, which costs memory and CPU. AsNoTracking tells EF Core not to track the results, making read-only queries faster and lighter. Use it for lists, reports and GET endpoints where you will not update the data. AsNoTrackingWithIdentityResolution avoids duplicate instances of the same entity in results while still skipping tracking.

What is the difference between an RxJS Observable and a Promise?

Show answer

A Promise represents a single future value, starts immediately and cannot be cancelled. An Observable can emit many values over time, is lazy until subscribed, and can be cancelled by unsubscribing. RxJS operators like map, debounceTime, switchMap and retry make it powerful for streams such as search boxes or WebSocket data. Angular's HttpClient returns Observables; use the async pipe or toSignal to avoid manual unsubscribe.

Show bulk update and delete with ExecuteUpdate and ExecuteDelete.