PhonePe Java Full Stack with React Interview Questions & Answers
Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About PhonePe hiring for Java Full Stack with React roles
PhonePe is an Indian digital payments and financial services company, majority-owned by Walmart, known for UPI payments, insurance and investment distribution, and the Pincode commerce app. Its engineering teams build high-scale payments systems. It hires for software engineers, SDETs, data analysts, data engineers and data scientists.
For Java Full Stack with React roles, this PhonePe practice set focuses most on REST APIs, Security and Microservices (7), Spring Boot (7), JPA and Hibernate (4), Collections and Streams (4). It has 5 easy, 21 medium, 4 hard questions, so you can start easy and work up to the harder ones.
Company type
Fintech
Headquarters
Bengaluru, India
Main India offices
Bengaluru, Pune
PhonePe Java Full Stack with React interview process
Online coding assessment
Machine coding round
DSA or problem solving round
Design or hiring manager round
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for PhonePeStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
Events bubble up from the target element to its ancestors. With event delegation you attach one listener to a parent, such as a ul, and use event.target.closest('li') to find which child was clicked. This saves memory compared with a listener on every item and automatically works for items added later. It is commonly used for dynamic tables and lists. React uses a similar idea by attaching listeners at the root.
02
What is the difference between authentication and authorization?
Authentication verifies who the user is, for example by checking a password, OTP or token. Authorization decides what that authenticated user is allowed to do, for example only admins can delete products. In Spring Security, authentication produces an Authentication object with granted authorities, and authorization uses those authorities in URL rules or annotations like @PreAuthorize("hasRole('ADMIN')"). A failed authentication gives 401 and a failed authorization gives 403.
03
Return only a few columns using an interface-based projection.
Each keystroke starts a request, and responses can arrive out of order. Debounce the input by about 300 milliseconds so fewer requests are sent. In the effect, cancel the previous request with AbortController in the cleanup function, or keep an ignore flag so stale responses are discarded. Libraries like TanStack Query handle this automatically by keying queries on the search term and ignoring outdated results.
07
What is the difference between a primary key and a unique key?
A primary key uniquely identifies each row, cannot be null, and a table has only one, although it may span several columns. A unique key also enforces uniqueness but a table can have many, and most databases allow null values in it. Both create an index automatically. For example, id is the primary key of a users table while email and mobile have unique constraints.
08
Your application logs show database deadlock errors during peak hours. How do you resolve them?
A deadlock happens when two transactions lock rows in opposite order and wait for each other; the database kills one. Read the deadlock report, such as SHOW ENGINE INNODB STATUS, to find the statements. Fix by updating rows in a consistent order, keeping transactions short, avoiding user interaction or remote calls inside transactions and adding indexes so updates lock fewer rows. Also add a retry for the deadlock error because occasional ones are normal.
09
Compare monolithic and microservices architecture.
A monolith is one deployable application. It is simpler to build, test and debug, and suits small teams and early products. Microservices split the system into independently deployable services owned by separate teams, such as orders, payments and inventory, each with its own database. They allow independent scaling and releases but add network latency, distributed data, monitoring and deployment complexity. Many teams start with a modular monolith and split only when needed.
10
How do you work with frontend developers and testers on API changes?
I agree on the API contract first using an OpenAPI spec or Swagger UI, so frontend and QA can start in parallel with mock data. I share example requests and error responses, and I tell the team early if a field must change. For example, in my last sprint I gave QA a Postman collection with test cases for every endpoint. This reduced back-and-forth and our feature passed testing on the first cycle.
11
Write code that runs tasks in parallel using ExecutorService and collects results.
Spring Boot 3 requires Java 17 or later and is built on Spring Framework 6. The biggest migration task is the switch from javax.* to jakarta.* packages for persistence, validation and servlet APIs. Spring Security 6 removed WebSecurityConfigurerAdapter in favour of SecurityFilterChain beans. Boot 3 also supports GraalVM native images, Micrometer observation and tracing, and from 3.2 the RestClient and virtual thread support.
13
Bind custom properties from application.yml into a type-safe class.
With Spring Security enabled, CSRF protection is on by default and blocks POST, PUT and DELETE that lack a CSRF token, while GET is allowed. For a stateless JWT API, disable CSRF in the SecurityFilterChain. If you use session cookies, keep CSRF and send the token with CookieCsrfTokenRepository. Also check CORS, because a rejected preflight OPTIONS request or a missing role in authorization rules can produce the same symptom.
15
What causes LazyInitializationException and how do you fix it properly?
It occurs when a lazy association is accessed after the persistence context has closed, for example in a controller or during JSON serialisation outside the transaction. The proper fix is to fetch the data inside the service transaction using JOIN FETCH or @EntityGraph and map it to a DTO. Avoid enabling spring.jpa.open-in-view as a crutch, and avoid switching associations to eager, because both hide performance problems.
16
What are the options for spring.jpa.hibernate.ddl-auto and which should be used in production?
none does nothing, validate checks that the schema matches entities, update alters tables to add missing columns, create drops and recreates the schema at startup and create-drop also drops it at shutdown. update and create are fine for learning but risky in production because they cannot handle renames or data migrations safely. In production use validate or none, and manage schema changes with Flyway or Liquibase scripts.
SELECT department_id, name, salary
FROM (
SELECT department_id, name, salary,
DENSE_RANK() OVER (
PARTITION BY department_id
ORDER BY salary DESC) AS rnk
FROM employees
) ranked
WHERE rnk <= 3
ORDER BY department_id, rnk;
-- DENSE_RANK keeps ties; use ROW_NUMBER for exactly 3 rows.
21
What is CORS and how do you configure it for a React frontend?
CORS is a browser rule that blocks JavaScript from calling a different origin unless the server allows it with response headers like Access-Control-Allow-Origin. A React app on localhost:5173 calling an API on localhost:8080 is cross-origin. In Spring, define a CorsConfigurationSource bean with the allowed origins, methods and headers, and enable http.cors() in the security chain so preflight OPTIONS requests pass. Never use a wildcard origin together with credentials.
22
What are window functions and how are they different from GROUP BY?
Window functions compute a value over a set of related rows while keeping every row in the result, unlike GROUP BY which collapses rows into one per group. They use the OVER clause with optional PARTITION BY and ORDER BY. Examples are ROW_NUMBER, RANK, DENSE_RANK, LAG, LEAD and running SUM. For instance, you can show each employee with their department's average salary in the same row.
23
Database passwords and API keys are committed in application.properties. How do you fix this?
Remove the secrets from the repository, rotate the exposed credentials immediately, and clean the history if needed. Replace values with placeholders such as ${DB_PASSWORD} and supply them through environment variables, Kubernetes Secrets or a vault like HashiCorp Vault or a cloud secrets manager. Add a pre-commit secret scanner, keep local values in an ignored file, and give each environment its own credentials with least privilege.
24
Write a controller slice test with @WebMvcTest and MockMvc.
Situation: a client demo was moved forward by a week and the reporting module was not ready. Task: deliver the core report screens and APIs in five days. Action: I split the work into must-have and later items with my lead, reused existing query components, and wrote tests for the critical paths only. Result: the demo went well, and the remaining features shipped in the next sprint without bugs.
26
Find the second highest salary from a list of employees using streams.
Both collections resize by copying when they grow, which causes temporary memory spikes. Pre-size them, for example new ArrayList<>(500000) and HashMap with capacity of expected size divided by 0.75. Better still, avoid holding everything at once: process the data in batches or stream it from the database with pagination. Use primitive-friendly structures or IntStream where possible to avoid boxing overhead.
28
A user's JWT is stolen and you need to invalidate it before expiry. How would you design for this?
Pure JWTs cannot be revoked, so keep access tokens short-lived, around 10 to 15 minutes, and use refresh tokens stored server-side and rotated on each use. On logout or theft, revoke the refresh token. For immediate blocking, keep a denylist of token IDs or a per-user token version in Redis and check it in the filter. Send refresh tokens in HttpOnly, Secure, SameSite cookies to reduce theft through XSS.
29
Write global exception handling for a REST API in Spring Boot.
Fail-fast iterators, used by ArrayList and HashMap, track a modification count and throw ConcurrentModificationException if the collection is structurally changed during iteration, except through the iterator's own remove. Fail-safe or weakly consistent iterators, used by CopyOnWriteArrayList and ConcurrentHashMap, work on a snapshot or tolerate concurrent changes and never throw that exception, but they may not show the latest updates.
Tips to crack the PhonePe Java Full Stack with React interview
Practise machine coding problems and focus on clean, extensible object-oriented design within the time limit.
Understand how UPI transactions work at scale, including idempotency, retries and reconciliation.
For analyst roles, prepare cases on transaction success rates, merchant adoption and fraud detection metrics.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; PhonePe interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the PhonePe Java Full Stack with React interview?
Candidates usually go through 5 stages: Online coding assessment; Machine coding round; DSA or problem solving round; Design or hiring manager round; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the PhonePe Java Full Stack with React interview?
This practice set leans on REST APIs, Security and Microservices (7), Spring Boot (7), JPA and Hibernate (4), Collections and Streams (4). Revise those first, then practise explaining one or two of your own projects end to end, because most PhonePe interviewers ask you to walk through real work.
Are these the exact questions asked at PhonePe?
No. These are curated practice questions that match the skills and difficulty usually tested in fintech interviews like PhonePe's. They are not a leaked or verified list of past questions.
Where does PhonePe hire Java Full Stack with React professionals in India?
PhonePe has large teams in Bengaluru, Pune. Openings and locations change often, so check the PhonePe careers page and filter by city and experience.
Java Full Stack with React questions for similar companies