Java Full Stack with React Interview Questions for 3 Years Experience
40 questions with answers for candidates with 3 years of experience — 3 easy, 35 medium, 2 hard.
What interviewers expect: 3 years experience
Three years is a common switch point, and interviews become deeper. Expect concurrency, HashMap and JVM internals, microservice patterns like circuit breakers and API gateways, caching, query tuning with indexes and EXPLAIN, and Docker basics. Interviewers want design reasoning: why you chose a certain approach and what trade-offs you saw. You may also get a low-level design round for a module such as a cart or booking system.
This set is weighted towards JPA and Hibernate (8), Collections and Streams (8), REST APIs, Security and Microservices (6), Core Java (5).
Java concurrency and JVM Microservice patterns SQL tuning Low-level design
Solved at this levelStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
What is the difference between lazy and eager fetching?
Lazy fetching loads an association only when it is first accessed, using a proxy. Eager fetching loads it immediately with the parent. By default, @OneToMany and @ManyToMany are lazy, while @ManyToOne and @OneToOne are eager. Best practice is to make all associations lazy and fetch what each use case needs with JOIN FETCH or entity graphs, because eager loading often pulls large object graphs and causes extra queries.
02
You need a thread-safe singleton for a configuration loader. How do you implement it?
The simplest safe options are an enum singleton or the holder idiom. With the holder idiom, a private static nested class holds the instance, and the JVM's class loading guarantees lazy, thread-safe initialisation without synchronization. Double-checked locking also works but needs a volatile field. In a Spring application you usually do not write singletons at all, because beans are singleton-scoped by default and the container manages them.
03
Compare monolithic and microservices architecture.
A monolith is one deployable application. It is simpler to build, test and debug, and suits small teams and early products. Microservices split the system into independently deployable services owned by separate teams, such as orders, payments and inventory, each with its own database. They allow independent scaling and releases but add network latency, distributed data, monitoring and deployment complexity. Many teams start with a modular monolith and split only when needed.
04
How do indexes improve performance, and when can they hurt?
An index, usually a B-tree, lets the database find rows without scanning the whole table, which speeds up WHERE, JOIN and ORDER BY on indexed columns. Indexes cost disk space and slow down INSERT, UPDATE and DELETE because each index must also be updated. They help little on low-selectivity columns like a boolean flag. Functions on the column, such as WHERE LOWER(email) = ?, or a leading wildcard in LIKE also prevent normal index use.
05
Inserting one lakh rows with saveAll takes many minutes. How do you speed it up?
Enable JDBC batching with hibernate.jdbc.batch_size of 50 or so, plus order_inserts and order_updates. IDENTITY ID generation disables insert batching in Hibernate, so use a SEQUENCE generator with an allocation size on PostgreSQL or Oracle. Flush and clear the persistence context every batch to keep memory low. For very large loads, use JdbcTemplate batchUpdate or the database's bulk loader like COPY or LOAD DATA, which is much faster than ORM.
06
What is the difference between authentication and authorization?
Authentication verifies who the user is, for example by checking a password, OTP or token. Authorization decides what that authenticated user is allowed to do, for example only admins can delete products. In Spring Security, authentication produces an Authentication object with granted authorities, and authorization uses those authorities in URL rules or annotations like @PreAuthorize("hasRole('ADMIN')"). A failed authentication gives 401 and a failed authorization gives 403.
07
What is the difference between persist and merge, and between save and saveAndFlush?
persist makes a new entity managed and assigns its ID; it fails for detached entities. merge copies the state of a detached entity onto a managed copy and returns that copy. Spring Data save calls persist for new entities and merge otherwise. saveAndFlush also calls flush, pushing pending SQL to the database immediately, which helps when you need a constraint error or trigger result now. The commit still happens at the end of the transaction.
08
Write global exception handling for a REST API in Spring Boot.
Java 17 brought records for immutable data carriers, sealed classes to restrict inheritance, text blocks for multi-line JSON or SQL, and pattern matching for instanceof. Java 21, the current widely used LTS alongside 17, added virtual threads for cheap blocking concurrency, pattern matching for switch, record patterns and sequenced collections. Spring Boot 3 needs Java 17 or later, and from Boot 3.2 virtual threads can be enabled with one property.
10
What is the difference between a clustered and a non-clustered index?
A clustered index defines the physical order of rows, so the table data itself is stored in the index and there can be only one. In MySQL InnoDB the primary key is the clustered index. A non-clustered or secondary index is a separate structure holding the indexed columns and a pointer, or the primary key in InnoDB, to the row. That is why a short primary key keeps every secondary index smaller.
11
How do profiles and application.yml work in Spring Boot?
Common settings go in application.yml, and environment-specific values go in files like application-dev.yml or application-prod.yml. You activate a profile with spring.profiles.active=prod, an environment variable SPRING_PROFILES_ACTIVE or a command-line argument. Profile files override the default values. Beans can also be limited with @Profile("dev"). Environment variables and command-line arguments have higher priority than files, which is useful in Docker and Kubernetes.
12
What changed when moving from Spring Boot 2 to Spring Boot 3?
Spring Boot 3 requires Java 17 or later and is built on Spring Framework 6. The biggest migration task is the switch from javax.* to jakarta.* packages for persistence, validation and servlet APIs. Spring Security 6 removed WebSecurityConfigurerAdapter in favour of SecurityFilterChain beans. Boot 3 also supports GraalVM native images, Micrometer observation and tracing, and from 3.2 the RestClient and virtual thread support.
13
How do you learn a new framework or library quickly when a project needs it?
I start with the official getting-started guide and build a tiny working example, then read how it is used in our codebase. For example, when our team adopted Flyway, I created a sample project, tried failure cases like a bad migration and wrote a one-page guide for the team. Within a week I was handling migrations in the main project. I also note questions and clarify them with seniors early instead of guessing.
14
You are designing a new feature. When would you choose a relational database and when a NoSQL database?
Choose a relational database like PostgreSQL or MySQL when data is structured, relationships matter and you need transactions and joins, such as orders, payments and inventory. Choose NoSQL when you need a flexible schema or huge horizontal scale for simple access patterns: MongoDB for documents, Redis for caching and sessions, Cassandra for high-write time series and Elasticsearch for search. Many systems use both, with SQL as the source of truth.
The heap stores objects and is shared by all threads; it is managed by the garbage collector and split into young and old generations. Each thread has its own stack holding method frames, local variables and references. Metaspace, in native memory since Java 8, stores class metadata. There is also the program counter per thread and the code cache for JIT-compiled code. Stack overflow comes from deep recursion, while OutOfMemoryError usually means heap or metaspace is full.
16
What roles do an API gateway and service discovery play in microservices?
An API gateway, such as Spring Cloud Gateway, is the single entry point for clients. It handles routing, authentication, rate limiting, CORS and request logging. Service discovery lets services find each other without hard-coded addresses: with Eureka or Consul, services register themselves, and clients look them up. On Kubernetes, built-in Services and DNS usually replace a separate discovery server, and an ingress or gateway handles external traffic.
17
Your team is starting a new React project. Would you use Create React App or something else?
Create React App is deprecated and no longer recommended. For a single-page app backed by a Spring Boot API, Vite is the usual choice because of its fast dev server and optimised builds. If you need server-side rendering, SEO or file-based routing, a framework like Next.js or React Router in framework mode is recommended by the React team. Choose based on SEO needs, hosting and the team's experience.
HashMap stores entries in an array of buckets. The key's hashCode is spread and masked to find a bucket index. Collisions are kept in a linked list, and since Java 8 a bucket converts to a red-black tree after 8 entries when capacity is at least 64, giving O(log n) worst case. When size exceeds capacity times load factor 0.75, the table doubles and entries are redistributed. get uses hashCode to find the bucket and equals to find the key.
19
Why is constructor injection preferred over field injection?
Constructor injection makes dependencies explicit and lets fields be final, so the object is always fully initialised and immutable. It allows plain unit tests without Spring or reflection, because you can pass mocks to the constructor. A long constructor also signals that a class has too many responsibilities. Field injection with @Autowired hides dependencies and needs a container or reflection in tests. With a single constructor, @Autowired is not even needed.
20
Users must upload files up to 200 MB. How do you design the upload API?
Avoid streaming large files through the application server. Generate a pre-signed URL for object storage like S3 or Azure Blob so the browser uploads directly, then the client calls the API to confirm and save the metadata. If uploads must go through Spring, raise spring.servlet.multipart.max-file-size, stream the input to storage instead of loading it into memory, validate type and size, and scan files for malware before use.
21
What are intermediate and terminal operations in Java Streams?
Intermediate operations such as filter, map, sorted and distinct return a new stream and are lazy; nothing runs until a terminal operation is called. Terminal operations such as collect, forEach, count, reduce and findFirst trigger processing and produce a result. Laziness allows short-circuiting: with findFirst, elements are processed one by one only until a match is found. A stream can be consumed only once.
22
Using streams, group employees by department and count them.
Map<String, Long> countByDept = employees.stream()
.collect(Collectors.groupingBy(
Employee::getDepartment,
Collectors.counting()));
// Average salary per department:
Map<String, Double> avgSalary = employees.stream()
.collect(Collectors.groupingBy(
Employee::getDepartment,
Collectors.averagingDouble(Employee::getSalary)));
// Use TreeMap::new as the second argument to get sorted keys.
23
How do derived query methods work in Spring Data JPA?
Spring Data parses the method name in a repository interface and builds the query. For example, findByEmailAndActiveTrue(String email) or findTop5ByCategoryOrderByPriceDesc(String category). Supported keywords include And, Or, Between, LessThan, Like, In, IsNull and OrderBy. Return types can be Optional, List, Page or Stream. For complex logic, use @Query with JPQL or native SQL, because very long method names become hard to read.
Cascade propagates operations from a parent to its children: PERSIST, MERGE, REMOVE, REFRESH, DETACH or ALL. For example, saving an Order with CascadeType.ALL also saves its items. orphanRemoval = true deletes a child row when it is removed from the parent's collection. Use them for true parent-child aggregates like order and items, but never cascade REMOVE on @ManyToOne or shared references like Category, or deleting one product could delete the category.
25
You are loading about five lakh records into an ArrayList and a HashMap and memory spikes during loading. What can you do?
Both collections resize by copying when they grow, which causes temporary memory spikes. Pre-size them, for example new ArrayList<>(500000) and HashMap with capacity of expected size divided by 0.75. Better still, avoid holding everything at once: process the data in batches or stream it from the database with pagination. Use primitive-friendly structures or IntStream where possible to avoid boxing overhead.
26
Sort a list of products by category, then by price descending, then by name.
Apply rate limiting at the edge first, in the API gateway, Nginx or the cloud load balancer, keyed by API key, user ID or IP. In Spring Cloud Gateway use the Redis rate limiter, or inside a service use Bucket4j with a token bucket backed by Redis so limits work across instances. Return 429 Too Many Requests with a Retry-After header. Different plans or endpoints like login can have stricter limits.
28
Tell me about a difficult bug you fixed in a Java project.
Situation: our order API sometimes returned another user's cart. Task: I had to find the root cause quickly. Action: I reproduced it with a load test, found a Spring singleton service storing the current user in an instance field, and moved that state into a method parameter. I added a concurrent test to prevent regressions. Result: the issue disappeared and I shared the learning about stateless beans with the team.
29
Describe a time you disagreed with a teammate during a code review.
Situation: a teammate used nested loops over two large lists to match records. Task: I felt it would be slow at production volume. Action: instead of just rejecting it, I wrote a quick benchmark showing the HashMap-based approach was much faster, and explained it calmly in a call. Result: he agreed, we merged the faster version, and we added a team guideline to back performance comments with data.
useEffect runs after the component renders. With no dependency array it runs after every render, with an empty array it runs once after mount, and with values like [userId] it runs again whenever those values change. Return a cleanup function to cancel subscriptions, timers or requests before the next run or on unmount. Missing dependencies cause stale data, so follow the exhaustive-deps lint rule. Effects are for syncing with external systems, not for computing derived values.
31
What causes LazyInitializationException and how do you fix it properly?
It occurs when a lazy association is accessed after the persistence context has closed, for example in a controller or during JSON serialisation outside the transaction. The proper fix is to fetch the data inside the service transaction using JOIN FETCH or @EntityGraph and map it to a DTO. Avoid enabling spring.jpa.open-in-view as a crutch, and avoid switching associations to eager, because both hide performance problems.
32
Returning an entity from a REST API causes infinite recursion in JSON. Why, and how do you fix it?
Bidirectional relationships, such as Order having items and each item referencing its order, make Jackson serialise back and forth endlessly, leading to StackOverflowError. The cleanest fix is to return DTOs instead of entities, so you control exactly what is exposed. Quick fixes include @JsonManagedReference with @JsonBackReference or @JsonIgnore on one side. DTOs also stop lazy loading during serialisation and avoid leaking internal fields.
After a successful login, the server issues a JSON Web Token containing a header, a payload of claims such as user ID, roles and expiry, and a signature made with a secret or private key. The client sends it in the Authorization: Bearer header with each request. The server verifies the signature and expiry without a session lookup, which suits stateless APIs. Keep access tokens short-lived, do not store sensitive data in the payload because it is only encoded, and use refresh tokens for renewal.
34
Write a record and use pattern matching in a switch expression.
I built a job portal using React with Vite, Spring Boot 3, Spring Security with JWT and MySQL. Recruiters could post jobs and candidates could apply and track status. I designed the REST APIs, implemented role-based access, added pagination and search, and used TanStack Query on the frontend. I deployed it with Docker and a CI pipeline. The hardest part was file upload for resumes, which I solved with pre-signed object storage URLs.
36
Where should a React app store the JWT, and what are the trade-offs?
localStorage is simple but any XSS script can read it. In-memory storage is safer but is lost on refresh. The commonly recommended pattern is a short-lived access token kept in memory and a refresh token in an HttpOnly, Secure, SameSite cookie that JavaScript cannot read, used to get new access tokens. Cookies need CSRF protection for state-changing calls. Whatever you choose, prevent XSS with proper escaping and a Content Security Policy.
Actuator adds production-ready endpoints for monitoring and management, such as /actuator/health, /actuator/info, /actuator/metrics and /actuator/prometheus. Kubernetes uses health liveness and readiness groups for probes. Metrics are collected through Micrometer and can be exported to Prometheus, Datadog or other systems. Only expose the endpoints you need with management.endpoints.web.exposure.include and secure them, because endpoints like env or heapdump can leak sensitive data.
HashMap is not synchronized and allows one null key and null values. Hashtable is a legacy class where every method is synchronized, so it is slow and allows no nulls. ConcurrentHashMap is the modern thread-safe choice: reads are mostly lock-free, writes lock only a single bucket using CAS and synchronized blocks, and it offers atomic methods such as computeIfAbsent and merge. It also does not allow null keys or values.
useMemo caches the result of an expensive calculation until its dependencies change, such as filtering and sorting a big list. useCallback caches a function reference, which matters when passing callbacks to children wrapped in React.memo or used in effect dependencies. Do not wrap everything, because memoization itself has a cost. The React Compiler, released as stable in 2025, can add much of this memoization automatically in supported projects.
String text = "java is fun and java is fast";
Map<String, Long> freq = Arrays.stream(text.toLowerCase().split("\\s+"))
.collect(Collectors.groupingBy(
Function.identity(),
LinkedHashMap::new,
Collectors.counting()));
System.out.println(freq);
// {java=2, is=2, fun=1, and=1, fast=1}
Frequently asked questions
What is asked in Java Full Stack with React interviews for 3 years of experience?
Three years is a common switch point, and interviews become deeper. Expect concurrency, HashMap and JVM internals, microservice patterns like circuit breakers and API gateways, caching, query tuning with indexes and EXPLAIN, and Docker basics. Interviewers want design reasoning: why you chose a certain approach and what trade-offs you saw. You may also get a low-level design round for a module such as a cart or booking system.
How many questions should I practise before a Java Full Stack with React interview?
Work through all 40 questions here, then the company-wise sets for the employers you are targeting. Quality matters more than count: be able to explain why each answer is right.
Which topics matter most for 3 years of experience?
Focus first on Java concurrency and JVM, Microservice patterns, SQL tuning, Low-level design.