Groww Full Stack with Node.js Interview Questions & Answers
Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About Groww hiring for Full Stack with Node.js roles
Groww is an Indian investment platform offering stocks, mutual funds, futures and options, fixed deposits and other financial products. Its engineering and analytics teams work on trading systems, user experience, risk and growth. It hires for software engineers, SDETs, data analysts and data scientists. Many users are first-time retail investors.
For Full Stack with Node.js roles, this Groww practice set focuses most on Deployment, Scaling and Performance (5), Databases: MongoDB, SQL and Redis (5), REST API Design (4), Node.js Core and Event Loop (4). It has 5 easy, 21 medium, 4 hard questions, so you can start easy and work up to the harder ones.
Company type
Fintech
Headquarters
Bengaluru, India
Main India offices
Bengaluru
Groww Full Stack with Node.js interview process
Online assessment or assignment
Technical round (coding or SQL)
Design or problem solving round
Hiring manager round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for GrowwStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
How do you design a consistent error response format for an API?
Use one structure everywhere, for example { "error": { "code": "VALIDATION_FAILED", "message": "Email is invalid", "details": [{ "field": "email" }], "requestId": "abc123" } }. Many teams follow RFC 9457 Problem Details with type, title, status and detail. Use machine-readable codes for clients, human messages for display, and never leak stack traces or SQL errors.
02
What are health check endpoints and what is the difference between liveness and readiness?
Health endpoints let orchestrators check the app. Liveness answers whether the process is alive; if it fails, the container is restarted, so keep it simple. Readiness answers whether the instance can serve traffic, checking database and cache connections; if it fails, the load balancer stops sending requests but does not restart it. During shutdown, fail readiness first.
03
How do you implement graceful shutdown in a Node.js server?
PUT replaces the entire resource with the representation sent, so missing fields may be reset; it is idempotent. PATCH applies a partial update, sending only changed fields, such as { "phone": "..." }. PATCH is more efficient for large objects. With JSON Merge Patch, repeated identical PATCH requests are effectively idempotent, but operations like increment are not.
05
What is the difference between throwing an error and rejecting a promise inside an async function?
Inside an async function they behave the same: throw new Error() causes the returned promise to reject with that error. Outside async functions, a throw inside a plain callback such as setTimeout is not caught by promise handlers and becomes an uncaught exception. Always reject with Error objects, not strings, so you keep a stack trace.
06
Your JWT secret has leaked. What steps do you take?
Treat it as an incident. Generate a new secret and deploy it immediately, which invalidates all existing tokens and forces re-login. Revoke refresh tokens in the database, check logs for suspicious tokens or admin actions, and find how it leaked, for example a committed .env or logs. Move to a secrets manager, consider asymmetric RS256 keys with key IDs to rotate safely, and document the incident.
Express is a minimal, unopinionated web framework for Node.js that adds routing, middleware and helpers for requests and responses on top of the http module. It is widely used because it is simple, flexible and has a large ecosystem of middleware for logging, auth, validation and security. Many teams also use it as the base for frameworks like NestJS.
09
What is the MongoDB aggregation pipeline? Give an example.
Your JavaScript runs on a single main thread, but Node.js itself is not purely single-threaded. libuv, the C library under Node, provides the event loop and a thread pool (default 4 threads, set with UV_THREADPOOL_SIZE) used for file system work, DNS lookups, crypto and zlib. Network I/O uses OS async mechanisms like epoll or IOCP instead of threads.
11
How would you handle uncaughtException and unhandledRejection in production?
Log both with full stack traces and context, then exit the process after flushing logs, because state may be corrupted. A process manager like PM2, systemd or Kubernetes restarts it. Never use uncaughtException to keep running as if nothing happened. Since Node 15, unhandled rejections crash the process by default, so every promise chain should have proper error handling.
12
What is Redis and how is it used with Node.js backends?
Redis is an in-memory key-value store with data types like strings, hashes, lists, sets, sorted sets and streams. Node apps use it for caching database results, session storage, rate limiting counters, distributed locks, leaderboards, pub/sub between instances and job queues through BullMQ. Data lives in memory, so use TTLs and eviction policies and do not treat it as the only copy of important data.
Never store plain text or use fast hashes like MD5 or SHA-256 alone. Use a slow, salted password hashing algorithm such as bcrypt with a cost factor around 10 to 12, or Argon2id, which is the current recommendation. The library generates a unique salt per password. On login, compare using the library's compare function, which is timing-safe.
14
What is contract testing and why is it useful for microservices?
Contract testing verifies that a provider API and its consumers agree on request and response formats without running the whole system. With Pact, the consumer writes expectations that become a contract, and the provider runs them in its own CI. It catches breaking changes like a renamed field before deployment, and is faster and less flaky than full end-to-end environments.
15
What are XSS and CSRF and how do you protect a Node.js app from them?
XSS injects malicious script into pages other users view; prevent it by escaping output, using templating or React auto-escaping, sanitising rich HTML with DOMPurify and setting a strong Content-Security-Policy. CSRF tricks a logged-in browser into sending unwanted requests; prevent it with SameSite cookies, CSRF tokens for cookie-based auth and checking Origin headers on state-changing requests.
16
How do you design Express middleware that checks user roles for a route?
Create a factory: const authorize = (...roles) => (req, res, next) => roles.includes(req.user?.role) ? next() : res.status(403).json({ error: 'Forbidden' }). Use it after authentication, for example router.delete('/:id', authenticate, authorize('admin'), handler). Keep roles and permissions in config or the database, and for complex rules move to permission-based checks or a policy library.
17
How do you handle a breaking API change request from a product manager close to a release?
I would first understand why it is needed and who consumes the API. Then I explain the impact on existing clients, propose a non-breaking path such as adding a new field or a v2 endpoint, and estimate effort and risk. Result in a past case: we shipped the additive change on time and scheduled removal of the old field for the next quarter.
18
Users report seeing stale prices after an update because of caching. How do you solve it?
Invalidate or update the cache key in the same code path that updates the price, preferably after the database commit. Use reasonable TTLs as a safety net, and version keys if needed. If several services update prices, publish a price-changed event and have consumers delete the cache. For CDN-cached responses, purge the relevant URLs or use short max-age with stale-while-revalidate.
Use .select() to fetch only needed fields, and .lean() to return plain objects instead of full Mongoose documents, which cuts memory and CPU. Make sure the filter and sort use an index, checked with explain. Paginate results, avoid populating deep references, and cache frequently read data. For large exports, use a cursor with for await instead of loading everything.
21
What is an API gateway and what does it do in a Node.js microservice setup?
An API gateway is a single entry point in front of services. It routes requests, terminates TLS, validates tokens, applies rate limits, handles CORS, aggregates responses and collects logs and metrics. Examples are Kong, AWS API Gateway, Nginx and Envoy-based gateways. It keeps cross-cutting concerns out of each service, but must be highly available so it does not become a single point of failure.
22
What is backpressure in streams and how does pipeline handle it?
Backpressure happens when a readable source produces data faster than the writable destination can consume it, causing memory to grow. write() returns false when the internal buffer exceeds highWaterMark, and the producer should pause until the drain event. stream.pipeline and pipe handle this automatically, and pipeline also forwards errors and destroys all streams on failure, which pipe does not.
23
A security audit finds that users can see other users' orders by changing the order ID in the URL. How do you fix it?
This is broken object level authorisation. Every query must be scoped to the authenticated user: Order.findOne({ _id: id, userId: req.user.id }), returning 404 if not found. Put this check in a shared service or middleware so no route can skip it, add tests that try other users' IDs, and consider non-guessable IDs like UUIDs as defence in depth, not as the fix.
24
How do you implement filtering and sorting safely from query parameters?
A compound index covers multiple fields, such as { userId: 1, createdAt: -1 }. It supports queries that use a prefix of the fields, so it helps queries on userId alone or userId plus createdAt, but not createdAt alone. A good rule in MongoDB is ESR: put equality fields first, then sort fields, then range fields, to avoid in-memory sorts.
26
Your Express API needs to support multiple client apps with different rate limits. How would you design it?
Identify the client through an API key or OAuth client ID in authentication middleware and attach the plan to req. Then use express-rate-limit or a custom limiter with a Redis store, keyed by client ID, with limits read from the plan. Return 429 with Retry-After and RateLimit headers. Redis keeps limits consistent across multiple server instances.
27
Write a basic GitHub Actions workflow that tests and builds a Node.js app.
PM2 is a process manager for Node.js on virtual machines. It keeps apps running and restarts them on crashes, runs cluster mode across CPU cores, supports zero-downtime reloads, log management and startup scripts. In Docker or Kubernetes you usually do not need PM2, because the orchestrator restarts containers and you scale with replicas, so you run node directly.
29
How do you serve a React build and an API from the same Express server?
const path = require('path');
app.use('/api', apiRouter);
app.use(express.static(path.join(__dirname, 'client/dist'), { maxAge: '1y' }));
// SPA fallback for client-side routes
app.get(/^\/(?!api).*/, (req, res) => {
res.sendFile(path.join(__dirname, 'client/dist/index.html'));
});
// Register API routes first so they are not caught by the fallback.
Macrotasks are scheduled work like setTimeout, setInterval, setImmediate and I/O callbacks, handled phase by phase by the event loop. Microtasks are promise reactions and queueMicrotask callbacks; they run right after the current synchronous code finishes and before the next macrotask. In Node, process.nextTick callbacks run even before promise microtasks. A long microtask chain can delay timers and I/O.
Tips to crack the Groww Full Stack with Node.js interview
Learn stock market basics like orders, settlement, mutual fund NAV and SEBI regulations for domain discussion.
Practise test scenarios for order placement, market hours and payment failures for QA roles.
Prepare analytics cases on first-time investor activation and retention, which are central to Groww's growth.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; Groww interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the Groww Full Stack with Node.js interview?
Candidates usually go through 4 stages: Online assessment or assignment; Technical round (coding or SQL); Design or problem solving round; Hiring manager round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the Groww Full Stack with Node.js interview?
This practice set leans on Deployment, Scaling and Performance (5), Databases: MongoDB, SQL and Redis (5), REST API Design (4), Node.js Core and Event Loop (4). Revise those first, then practise explaining one or two of your own projects end to end, because most Groww interviewers ask you to walk through real work.
Are these the exact questions asked at Groww?
No. These are curated practice questions that match the skills and difficulty usually tested in fintech interviews like Groww's. They are not a leaked or verified list of past questions.
Where does Groww hire Full Stack with Node.js professionals in India?
Groww has large teams in Bengaluru. Openings and locations change often, so check the Groww careers page and filter by city and experience.
Full Stack with Node.js questions for similar companies