Spring Boot Backend Developer Interview Questions & Answers
40 questions for Spring Boot Backend Developer interviews — 5 easy, 32 medium, 3 hard.
About the Spring Boot Backend Developer role
A backend developer focuses on server-side logic using Java and Spring Boot. Responsibilities include designing APIs, modelling data with JPA, writing efficient SQL, integrating with other services and message queues, handling transactions and securing the application. Strong core Java, collections and database skills are expected, and banks and fintech companies hire heavily for this role. They also monitor services in production, improve performance and work closely with frontend, QA and DevOps teams.
Core Java and collections Spring Data JPA Spring Security Microservice patterns JUnit and Mockito
Solved for this roleStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
It is a convenience annotation combining three annotations. @SpringBootConfiguration marks the class as a configuration source. @EnableAutoConfiguration tells Boot to configure beans based on the classpath and properties, for example a DataSource when a JDBC driver is present. @ComponentScan scans the package of the main class and its sub-packages for components. That is why the main class should sit in the root package of your project.
singleton is the default: one instance per application context. prototype creates a new instance every time the bean is requested. Web applications also have request, session and application scopes, and websocket scope. Singleton beans must be stateless or thread-safe because many requests share them. If a singleton needs a prototype or request-scoped bean, inject an ObjectProvider or use a scoped proxy so each use gets the correct instance.
04
How do you handle a requirement that is unclear or keeps changing?
Situation: a product manager asked for a discount feature with vague rules. Task: build it without wasting effort. Action: I wrote down my understanding with examples, asked specific questions about edge cases like stacking coupons, and built the rules as configurable data instead of hard-coded logic. I shared a small demo early for feedback. Result: two rule changes later in the sprint needed only configuration updates, not code changes.
05
Write a unit test for a service method using JUnit 5 and Mockito.
Spring Framework provides dependency injection, MVC, data access and transactions, but traditionally needed a lot of manual configuration and an external server. Spring Boot sits on top of Spring and adds auto-configuration, starter dependencies, an embedded Tomcat, Jetty or Undertow server, externalised configuration and production features like Actuator. You can run an application as a single executable jar with java -jar, which makes it ideal for microservices and containers.
The JVM runs Java bytecode and handles memory, garbage collection and JIT compilation. The JRE is the JVM plus core class libraries needed to run programs. The JDK is the JRE plus development tools such as javac, jar, jshell and jdb. Since Java 11 a separate JRE is no longer shipped by Oracle, so developers install a JDK such as Temurin or Oracle JDK 17 or 21 and build smaller runtimes with jlink if needed.
08
Users in different countries see wrong order times. How do you handle dates and time zones in Java?
Store timestamps in UTC using Instant or OffsetDateTime, and map them to TIMESTAMP WITH TIME ZONE or a UTC timestamp column. Convert to the user's zone only when displaying, using ZonedDateTime with ZoneId such as Asia/Kolkata. Avoid java.util.Date and SimpleDateFormat, which are mutable and not thread-safe. Use DateTimeFormatter, send ISO-8601 strings in JSON and set hibernate.jdbc.time_zone to UTC.
09
Returning an entity from a REST API causes infinite recursion in JSON. Why, and how do you fix it?
Bidirectional relationships, such as Order having items and each item referencing its order, make Jackson serialise back and forth endlessly, leading to StackOverflowError. The cleanest fix is to return DTOs instead of entities, so you control exactly what is exposed. Quick fixes include @JsonManagedReference with @JsonBackReference or @JsonIgnore on one side. DTOs also stop lazy loading during serialisation and avoid leaking internal fields.
10
Your public API is being hit by too many requests from a few clients. How do you add rate limiting?
Apply rate limiting at the edge first, in the API gateway, Nginx or the cloud load balancer, keyed by API key, user ID or IP. In Spring Cloud Gateway use the Redis rate limiter, or inside a service use Bucket4j with a token bucket backed by Redis so limits work across instances. Return 429 Too Many Requests with a Retry-After header. Different plans or endpoints like login can have stricter limits.
11
What is a custom hook and why would you write one?
A custom hook is a function whose name starts with use and which calls other hooks, letting you reuse stateful logic across components. Examples are useFetch for loading data, useDebounce for search input and useAuth for the current user. Each component calling the hook gets its own independent state. Custom hooks keep components focused on rendering and make logic easier to test, much like extracting a service in backend code.
12
What are intermediate and terminal operations in Java Streams?
Intermediate operations such as filter, map, sorted and distinct return a new stream and are lazy; nothing runs until a terminal operation is called. Terminal operations such as collect, forEach, count, reduce and findFirst trigger processing and produce a result. Laziness allows short-circuiting: with findFirst, elements are processed one by one only until a match is found. A stream can be consumed only once.
13
What is the difference between authentication and authorization?
Authentication verifies who the user is, for example by checking a password, OTP or token. Authorization decides what that authenticated user is allowed to do, for example only admins can delete products. In Spring Security, authentication produces an Authentication object with granted authorities, and authorization uses those authorities in URL rules or annotations like @PreAuthorize("hasRole('ADMIN')"). A failed authentication gives 401 and a failed authorization gives 403.
14
What causes LazyInitializationException and how do you fix it properly?
It occurs when a lazy association is accessed after the persistence context has closed, for example in a controller or during JSON serialisation outside the transaction. The proper fix is to fetch the data inside the service transaction using JOIN FETCH or @EntityGraph and map it to a DTO. Avoid enabling spring.jpa.open-in-view as a crutch, and avoid switching associations to eager, because both hide performance problems.
15
Tell me about a time you delivered a feature under a tight deadline.
Situation: a client demo was moved forward by a week and the reporting module was not ready. Task: deliver the core report screens and APIs in five days. Action: I split the work into must-have and later items with my lead, reused existing query components, and wrote tests for the critical paths only. Result: the demo went well, and the remaining features shipped in the next sprint without bugs.
16
What is CORS and how do you configure it for a React frontend?
CORS is a browser rule that blocks JavaScript from calling a different origin unless the server allows it with response headers like Access-Control-Allow-Origin. A React app on localhost:5173 calling an API on localhost:8080 is cross-origin. In Spring, define a CorsConfigurationSource bean with the allowed origins, methods and headers, and enable http.cors() in the security chain so preflight OPTIONS requests pass. Never use a wildcard origin together with credentials.
17
You need a thread-safe singleton for a configuration loader. How do you implement it?
The simplest safe options are an enum singleton or the holder idiom. With the holder idiom, a private static nested class holds the instance, and the JVM's class loading guarantees lazy, thread-safe initialisation without synchronization. Double-checked locking also works but needs a volatile field. In a Spring application you usually do not write singletons at all, because beans are singleton-scoped by default and the container manages them.
18
Your React app gets 403 Forbidden on POST requests to Spring Boot, but GET works. What is the likely cause?
With Spring Security enabled, CSRF protection is on by default and blocks POST, PUT and DELETE that lack a CSRF token, while GET is allowed. For a stateless JWT API, disable CSRF in the SecurityFilterChain. If you use session cookies, keep CSRF and send the token with CookieCsrfTokenRepository. Also check CORS, because a rejected preflight OPTIONS request or a missing role in authorization rules can produce the same symptom.
19
Why is constructor injection preferred over field injection?
Constructor injection makes dependencies explicit and lets fields be final, so the object is always fully initialised and immutable. It allows plain unit tests without Spring or reflection, because you can pass mocks to the constructor. A long constructor also signals that a class has too many responsibilities. Field injection with @Autowired hides dependencies and needs a container or reflection in tests. With a single constructor, @Autowired is not even needed.
The most common approach is URI versioning, like /api/v1/orders and /api/v2/orders, because it is visible and easy to route and cache. Other options are a custom header or the Accept media type. Spring Framework 7 adds first-class API versioning support. Version only for breaking changes; adding optional fields is backward compatible. Keep old versions running for a published deprecation period, and document every version with OpenAPI.
21
What is the difference between volatile and synchronized?
volatile guarantees visibility: a write by one thread is immediately visible to others and reordering around it is restricted, but it does not make compound operations like count++ atomic. synchronized gives both mutual exclusion and visibility by acquiring a monitor lock, so only one thread runs the block at a time. Use volatile for simple flags such as a shutdown signal, synchronized or locks for check-then-act logic, and AtomicInteger or LongAdder for counters.
22
How do profiles and application.yml work in Spring Boot?
Common settings go in application.yml, and environment-specific values go in files like application-dev.yml or application-prod.yml. You activate a profile with spring.profiles.active=prod, an environment variable SPRING_PROFILES_ACTIVE or a command-line argument. Profile files override the default values. Beans can also be limited with @Profile("dev"). Environment variables and command-line arguments have higher priority than files, which is useful in Docker and Kubernetes.
23
Tell me about a difficult bug you fixed in a Java project.
Situation: our order API sometimes returned another user's cart. Task: I had to find the root cause quickly. Action: I reproduced it with a load test, found a Spring singleton service storing the current user in an instance field, and moved that state into a method parameter. I added a concurrent test to prevent regressions. Result: the issue disappeared and I shared the learning about stateless beans with the team.
24
Call another microservice from Spring Boot using RestClient with a timeout.
Avoid streaming large files through the application server. Generate a pre-signed URL for object storage like S3 or Azure Blob so the browser uploads directly, then the client calls the API to confirm and save the metadata. If uploads must go through Spring, raise spring.servlet.multipart.max-file-size, stream the input to storage instead of loading it into memory, validate type and size, and scan files for malware before use.
26
Which features from Java 17 and Java 21 are useful for a full stack developer?
Java 17 brought records for immutable data carriers, sealed classes to restrict inheritance, text blocks for multi-line JSON or SQL, and pattern matching for instanceof. Java 21, the current widely used LTS alongside 17, added virtual threads for cheap blocking concurrency, pattern matching for switch, record patterns and sequenced collections. Spring Boot 3 needs Java 17 or later, and from Boot 3.2 virtual threads can be enabled with one property.
27
In a bidirectional @OneToMany relationship, what does mappedBy mean?
mappedBy marks the inverse side and names the field on the other entity that owns the relationship. The owning side, usually the @ManyToOne with the foreign key column, is the one Hibernate uses to write the join column. For example, Order has @OneToMany(mappedBy = "order") and OrderItem has @ManyToOne @JoinColumn(name = "order_id"). Always update both sides in helper methods such as addItem to keep the object graph consistent.
28
What is the difference between == and === in JavaScript?
== compares after type coercion, so 0 == '0' and null == undefined are true, which leads to surprising results. === compares both type and value without coercion, so 0 === '0' is false. Always use === and !== in application code. The only common exception is value == null, which checks for both null and undefined in one expression.
29
Write a repository query that loads orders with their items in one query.
public interface OrderRepository extends JpaRepository<Order, Long> {
@Query("""
select distinct o from Order o
join fetch o.items i
where o.customer.id = :customerId
""")
List<Order> findWithItems(@Param("customerId") Long customerId);
@EntityGraph(attributePaths = {"items", "customer"})
Optional<Order> findWithGraphById(Long id);
}
30
Write a record and use pattern matching in a switch expression.
A circuit breaker stops calling a failing downstream service so failures do not cascade. It is closed during normal operation, opens when the failure rate crosses a threshold, returns a fallback immediately while open, and moves to half-open after a wait to test recovery. In Spring Boot it is implemented with Resilience4j using @CircuitBreaker(name = "payment", fallbackMethod = "fallback"), usually combined with timeouts, retries with backoff and bulkheads.
32
Your code has frequent NullPointerExceptions from repository lookups. How would you redesign it?
Return Optional from lookup methods so callers must handle the missing case, for example findById(id).orElseThrow(). Validate inputs at the API boundary with Bean Validation, initialise collections to empty lists instead of null and use Objects.requireNonNull in constructors. Java 17 helpful NPE messages show which variable was null, which speeds debugging. Do not use Optional for fields or method parameters; it is meant for return values.
33
Implement pagination and sorting for a product list API.
A new or transient entity is just a Java object not known to the persistence context. A managed entity is attached to the context; changes are tracked and flushed automatically through dirty checking. A detached entity was managed but the context has closed, so changes are not tracked unless you merge it. A removed entity is scheduled for deletion on flush. Understanding these states explains why setters inside a transaction update the database without calling save.
35
Configure Spring Security 6 for a stateless JWT-secured REST API.
A monolith is one deployable application. It is simpler to build, test and debug, and suits small teams and early products. Microservices split the system into independently deployable services owned by separate teams, such as orders, payments and inventory, each with its own database. They allow independent scaling and releases but add network latency, distributed data, monitoring and deployment complexity. Many teams start with a modular monolith and split only when needed.
After a successful login, the server issues a JSON Web Token containing a header, a payload of claims such as user ID, roles and expiry, and a signature made with a secret or private key. The client sends it in the Authorization: Bearer header with each request. The server verifies the signature and expiry without a session lookup, which suits stateless APIs. Keep access tokens short-lived, do not store sensitive data in the payload because it is only encoded, and use refresh tokens for renewal.
The heap stores objects and is shared by all threads; it is managed by the garbage collector and split into young and old generations. Each thread has its own stack holding method frames, local variables and references. Metaspace, in native memory since Java 8, stores class metadata. There is also the program counter per thread and the code cache for JIT-compiled code. Stack overflow comes from deep recursion, while OutOfMemoryError usually means heap or metaspace is full.
39
What is the difference between persist and merge, and between save and saveAndFlush?
persist makes a new entity managed and assigns its ID; it fails for detached entities. merge copies the state of a detached entity onto a managed copy and returns that copy. Spring Data save calls persist for new entities and merge otherwise. saveAndFlush also calls flush, pushing pending SQL to the database immediately, which helps when you need a constraint error or trigger result now. The commit still happens at the end of the transaction.
Cascade propagates operations from a parent to its children: PERSIST, MERGE, REMOVE, REFRESH, DETACH or ALL. For example, saving an Order with CascadeType.ALL also saves its items. orphanRemoval = true deletes a child row when it is removed from the parent's collection. Use them for true parent-child aggregates like order and items, but never cascade REMOVE on @ManyToOne or shared references like Category, or deleting one product could delete the category.
Frequently asked questions
What does a Spring Boot Backend Developer do?
A backend developer focuses on server-side logic using Java and Spring Boot. Responsibilities include designing APIs, modelling data with JPA, writing efficient SQL, integrating with other services and message queues, handling transactions and securing the application. Strong core Java, collections and database skills are expected, and banks and fintech companies hire heavily for this role. They also monitor services in production, improve performance and work closely with frontend, QA and DevOps teams.
Which skills are tested in a Spring Boot Backend Developer interview?
Expect questions on Core Java and collections, Spring Data JPA, Spring Security, Microservice patterns, JUnit and Mockito. Most rounds also ask you to explain a project and solve one practical problem live.
How do I prepare for a Spring Boot Backend Developer interview?
Revise Core Java, Spring Boot, JPA and Hibernate, REST APIs, Security and Microservices first using the topic sheets, practise the questions on this page aloud, then do one full mock interview to practise timing.