Skip to content
Full Stack with Node.js
All coursesPlacement Report
‹ Back to previous sectionCourse homeAll page URLs

Full Stack with Node.js Interview Questions in Gurgaon

36 practice questions with answers for Full Stack with Node.js interviews in Gurgaon.

Full Stack with Node.js jobs in Gurgaon

Gurgaon (Gurugram) is home to many multinational, consulting, fintech and consumer-internet offices. Interviews often expect strong business understanding along with technical skills, especially for analytics and product-facing roles.

Below are 36 questions that match the mix of service, product and domain employers hiring node.js developers in Gurgaon.

Solved for GurgaonStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

What is an API gateway and what does it do in a Node.js microservice setup?

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
An API gateway is a single entry point in front of services. It routes requests, terminates TLS, validates tokens, applies rate limits, handles CORS, aggregates responses and collects logs and metrics. Examples are Kong, AWS API Gateway, Nginx and Envoy-based gateways. It keeps cross-cutting concerns out of each service, but must be highly available so it does not become a single point of failure.
02

What is the difference between OAuth 2.0 and OpenID Connect?

Authentication and SecurityMedium
Save to ▾
Show answer
OAuth 2.0 is an authorisation framework that issues access tokens for calling APIs; it does not define who the user is. OpenID Connect is an identity layer on top of OAuth 2.0 that adds an ID token, a JWT with user identity claims, and a userinfo endpoint. For social or enterprise single sign-on you use OIDC; for API access delegation you use OAuth scopes.
03

You must change a response field name used by many clients. How do you do it without breaking them?

REST API DesignMedium
Save to ▾
Show answer
Treat it as a breaking change. Option one: add the new field alongside the old one, mark the old field deprecated in docs and response headers, track usage through logs and remove it after clients migrate. Option two: release it in /v2 and keep /v1 for a deprecation window. Communicate timelines clearly and add contract tests for both.
04

What metrics would you monitor for a Node.js API in production?

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
Use the RED method for requests: rate, errors and duration with p50, p95 and p99. Add Node-specific metrics: event loop lag, heap used, garbage collection time and active handles, plus CPU, memory and restarts. Monitor dependencies such as database query time, pool usage and cache hit ratio. Export with prom-client or OpenTelemetry and alert on symptoms users feel.
05

Tell me about a production incident you handled and what you did after it.

Testing and DebuggingMedium
Save to ▾
Show answer
Situation: our payment callback endpoint started failing after a deploy on a Friday evening. Task: I was on call. Action: I checked error logs, saw a missing environment variable, rolled back within ten minutes, then added startup config validation and a post-deploy smoke test. Result: impact was limited to a few failed callbacks we replayed, and I wrote a blameless postmortem the team used to improve deploy checks.
06

How do you design a consistent error response format for an API?

REST API DesignMedium
Save to ▾
Show answer
Use one structure everywhere, for example { "error": { "code": "VALIDATION_FAILED", "message": "Email is invalid", "details": [{ "field": "email" }], "requestId": "abc123" } }. Many teams follow RFC 9457 Problem Details with type, title, status and detail. Use machine-readable codes for clients, human messages for display, and never leak stack traces or SQL errors.
07

What are XSS and CSRF and how do you protect a Node.js app from them?

Authentication and SecurityMedium
Save to ▾
Show answer
XSS injects malicious script into pages other users view; prevent it by escaping output, using templating or React auto-escaping, sanitising rich HTML with DOMPurify and setting a strong Content-Security-Policy. CSRF tricks a logged-in browser into sending unwanted requests; prevent it with SameSite cookies, CSRF tokens for cookie-based auth and checking Origin headers on state-changing requests.
08

What is PM2 and when do you need it?

Deployment, Scaling and PerformanceEasy
Save to ▾
Show answer
PM2 is a process manager for Node.js on virtual machines. It keeps apps running and restarts them on crashes, runs cluster mode across CPU cores, supports zero-downtime reloads, log management and startup scripts. In Docker or Kubernetes you usually do not need PM2, because the orchestrator restarts containers and you scale with replicas, so you run node directly.
09

How do you serve a React build and an API from the same Express server?

Express.js FrameworkMedium
Save to ▾
Show answer
const path = require('path'); app.use('/api', apiRouter); app.use(express.static(path.join(__dirname, 'client/dist'), { maxAge: '1y' })); // SPA fallback for client-side routes app.get(/^\/(?!api).*/, (req, res) => { res.sendFile(path.join(__dirname, 'client/dist/index.html')); }); // Register API routes first so they are not caught by the fallback.
10

What is NoSQL injection in MongoDB and how do you prevent it?

Authentication and SecurityMedium
Save to ▾
Show answer
If you pass req.body directly into a query, an attacker can send { "password": { "$ne": null } } and bypass checks. Prevent it by validating and casting input types with zod or Joi, rejecting objects where strings are expected, enabling Mongoose strictQuery and sanitizeFilter, and never building queries from raw user objects. Avoid $where and server-side JavaScript evaluation.
11

How do you use a message queue to process background jobs in Node.js?

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
const { Queue, Worker } = require('bullmq'); const connection = { host: 'redis', port: 6379 }; const emailQueue = new Queue('email', { connection }); await emailQueue.add('welcome', { userId }, { attempts: 5, backoff: { type: 'exponential', delay: 1000 }, jobId: `welcome:${userId}` }); new Worker('email', async (job) => { await sendWelcomeEmail(job.data.userId); }, { connection, concurrency: 10 });
12

How do you enable CORS in an Express app and why is it needed?

Express.js FrameworkEasy
Save to ▾
Show answer
Browsers block cross-origin requests unless the server sends CORS headers. Use the cors package: app.use(cors({ origin: ['https://app.example.com'], credentials: true })). Avoid origin '*' with credentials, and restrict methods and headers you allow. CORS is a browser protection, not a security layer for your API, so you still need authentication and authorisation.
13

What is idempotency and how do you implement idempotency keys for a payment API?

REST API DesignHard
Save to ▾
Show answer
An idempotent operation gives the same result when repeated. For POST /payments, the client sends a unique Idempotency-Key header. The server stores the key with the request hash and response, for example in Redis or a table with a unique index. If the same key arrives again, it returns the saved response instead of charging twice. Keys expire after about 24 hours.
14

What are streams in Node.js and what types exist?

Node.js Core and Event LoopEasy
Save to ▾
Show answer
Streams process data in chunks instead of loading everything into memory. There are four types: Readable (fs.createReadStream, HTTP request), Writable (fs.createWriteStream, HTTP response), Duplex (TCP socket, both read and write) and Transform (zlib gzip, modifies data as it passes). Streams keep memory flat when serving large files, uploading media or processing big CSV logs.
15

How do you handle a situation where you cannot find the root cause of a bug before a deadline?

Testing and DebuggingEasy
Save to ▾
Show answer
I inform my lead early with what I know, what I have ruled out and the risk. I propose a safe mitigation, such as a feature flag to disable the path or a rollback, and add extra logging to capture more data. In one case this let us release on time with the feature off, and the new logs revealed the cause two days later.
16

Describe a time you disagreed with a senior developer on a technical approach.

Express.js FrameworkEasy
Save to ▾
Show answer
Situation: a senior wanted to store sessions in server memory for a new API. Task: I believed it would break when we scaled to multiple pods. Action: I prepared a short comparison, showed a demo where users were logged out after a restart, and suggested Redis sessions or JWT. Result: we agreed on Redis, and the senior asked me to document the decision for the team.
17

What are health check endpoints and what is the difference between liveness and readiness?

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
Health endpoints let orchestrators check the app. Liveness answers whether the process is alive; if it fails, the container is restarted, so keep it simple. Readiness answers whether the instance can serve traffic, checking database and cache connections; if it fails, the load balancer stops sending requests but does not restart it. During shutdown, fail readiness first.
18

How do you implement real-time features like live order tracking in Node.js?

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
Use WebSockets through Socket.IO or ws, or Server-Sent Events for one-way updates. Clients join a room per order, and when the rider location or status changes, the server emits to that room. With multiple instances, use the Socket.IO Redis adapter so events reach clients on any server, authenticate the socket on connect, and throttle location updates to save bandwidth.
19

What are microtasks and macrotasks?

Asynchronous JavaScriptMedium
Save to ▾
Show answer
Macrotasks are scheduled work like setTimeout, setInterval, setImmediate and I/O callbacks, handled phase by phase by the event loop. Microtasks are promise reactions and queueMicrotask callbacks; they run right after the current synchronous code finishes and before the next macrotask. In Node, process.nextTick callbacks run even before promise microtasks. A long microtask chain can delay timers and I/O.
20

How do you implement filtering and sorting safely from query parameters?

REST API DesignMedium
Save to ▾
Show answer
const ALLOWED_SORT = ['price', 'createdAt', 'name']; router.get('/products', async (req, res) => { const filter = {}; if (req.query.category) filter.category = String(req.query.category); if (req.query.maxPrice) filter.price = { $lte: Number(req.query.maxPrice) }; const field = ALLOWED_SORT.includes(req.query.sort) ? req.query.sort : 'createdAt'; const dir = req.query.order === 'asc' ? 1 : -1; res.json(await Product.find(filter).sort({ [field]: dir }).limit(50)); }); // Whitelist fields and cast types to block injection.
21

What is the difference between throwing an error and rejecting a promise inside an async function?

Asynchronous JavaScriptMedium
Save to ▾
Show answer
Inside an async function they behave the same: throw new Error() causes the returned promise to reject with that error. Outside async functions, a throw inside a plain callback such as setTimeout is not caught by promise handlers and becomes an uncaught exception. Always reject with Error objects, not strings, so you keep a stack trace.
22

Where should a web app store tokens: localStorage or cookies?

Authentication and SecurityMedium
Save to ▾
Show answer
localStorage is readable by any JavaScript on the page, so an XSS bug can steal tokens. HttpOnly, Secure, SameSite cookies cannot be read by JavaScript, which is safer for refresh tokens and session IDs. Cookies require CSRF protection, which SameSite=Lax or Strict plus CSRF tokens provide. A common pattern keeps the access token in memory and the refresh token in an HttpOnly cookie.
23

How do you handle a breaking API change request from a product manager close to a release?

REST API DesignMedium
Save to ▾
Show answer
I would first understand why it is needed and who consumes the API. Then I explain the impact on existing clients, propose a non-breaking path such as adding a new field or a v2 endpoint, and estimate effort and risk. Result in a past case: we shipped the additive change on time and scheduled removal of the old field for the next quarter.
24

Users report seeing stale prices after an update because of caching. How do you solve it?

Databases: MongoDB, SQL and RedisMedium
Save to ▾
Show answer
Invalidate or update the cache key in the same code path that updates the price, preferably after the database commit. Use reasonable TTLs as a safety net, and version keys if needed. If several services update prices, publish a price-changed event and have consumers delete the cache. For CDN-cached responses, purge the relevant URLs or use short max-age with stale-while-revalidate.
25

Compare session-based authentication with JWT-based authentication.

Authentication and SecurityMedium
Save to ▾
Show answer
Sessions store state on the server, often in Redis, and the client holds only a session ID cookie; logout and revocation are easy. JWTs are stateless, so any service can verify them without a lookup, which suits microservices and mobile apps, but revoking a token before expiry needs a denylist or short lifetimes. Many systems combine short-lived JWT access tokens with server-stored refresh tokens.
26

Write code to verify an HMAC signature on an incoming webhook in Express.

REST API DesignHard
Save to ▾
Show answer
const crypto = require('crypto'); app.post('/webhooks/payment', express.raw({ type: 'application/json' }), (req, res) => { const sig = req.get('X-Signature') || ''; const expected = crypto .createHmac('sha256', process.env.WEBHOOK_SECRET) .update(req.body) .digest('hex'); const ok = sig.length === expected.length && crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected)); if (!ok) return res.status(401).end(); handleEvent(JSON.parse(req.body)); res.status(200).end(); });
27

How does the this keyword behave in arrow functions compared to regular functions?

Asynchronous JavaScriptMedium
Save to ▾
Show answer
A regular function's this depends on how it is called: the object before the dot, undefined in strict mode for plain calls, or whatever bind, call or apply set. Arrow functions do not have their own this; they capture it lexically from the surrounding scope. That makes arrows ideal for callbacks inside class methods, but unsuitable as object methods that need this.
28

Is Node.js single-threaded? Explain the role of libuv.

Node.js Core and Event LoopMedium
Save to ▾
Show answer
Your JavaScript runs on a single main thread, but Node.js itself is not purely single-threaded. libuv, the C library under Node, provides the event loop and a thread pool (default 4 threads, set with UV_THREADPOOL_SIZE) used for file system work, DNS lookups, crypto and zlib. Network I/O uses OS async mechanisms like epoll or IOCP instead of threads.
29

When would you choose NestJS or Fastify over Express?

Express.js FrameworkMedium
Save to ▾
Show answer
Choose Fastify when raw performance and built-in schema validation matter; it is faster than Express thanks to optimised routing and serialisation. Choose NestJS for large teams that want structure: modules, dependency injection, decorators and first-class TypeScript, similar to Spring or Angular. Express still suits small to medium services and teams that prefer flexibility and a huge middleware ecosystem.
30

Write a Dockerfile for a production Node.js API.

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
FROM node:22-alpine AS deps WORKDIR /app COPY package*.json ./ RUN npm ci --omit=dev FROM node:22-alpine ENV NODE_ENV=production WORKDIR /app COPY --from=deps /app/node_modules ./node_modules COPY . . USER node EXPOSE 3000 HEALTHCHECK CMD wget -qO- http://localhost:3000/health || exit 1 CMD ["node", "src/server.js"]
31

A mobile app team complains your API returns too much data and is slow on 4G. What would you change?

REST API DesignMedium
Save to ▾
Show answer
Add field selection like ?fields=id,name,price, smaller list representations with details on a separate endpoint, pagination with sensible limits and gzip or Brotli compression. Support ETag and Cache-Control so unchanged data returns 304. If many screens need combined data, consider a Backend-for-Frontend layer or GraphQL tailored to the mobile app.
32

What is connection pooling and why is it important in Node.js?

Databases: MongoDB, SQL and RedisMedium
Save to ▾
Show answer
Opening a database connection is slow, so a pool keeps a set of open connections that requests borrow and return. pg Pool, mysql2 and the MongoDB driver all pool by default. Size the pool based on database limits and instance count; too small causes waiting, too large overloads the database. In serverless functions, reuse the client across invocations or use a proxy like RDS Proxy.
33

How do you manage database schema migrations in a Node.js project?

Databases: MongoDB, SQL and RedisMedium
Save to ▾
Show answer
Use a migration tool such as Prisma Migrate, Knex, Sequelize CLI or TypeORM migrations, and commit migration files to Git. Each migration has up and ideally down steps and runs in CI and before deployment. For zero downtime, use expand and contract: add new columns first, deploy code that writes both, backfill, switch reads, then drop old columns in a later release.
34

What is the difference between REST and GraphQL?

REST API DesignMedium
Save to ▾
Show answer
REST exposes multiple endpoints with fixed response shapes, uses HTTP caching easily and is simple to reason about. GraphQL exposes one endpoint where clients query exactly the fields they need, reducing over-fetching and multiple round trips, which helps mobile apps. GraphQL adds complexity: N+1 query risks needing DataLoader, harder caching, query cost limits and schema governance.
35

A security audit finds that users can see other users' orders by changing the order ID in the URL. How do you fix it?

Authentication and SecurityMedium
Save to ▾
Show answer
This is broken object level authorisation. Every query must be scoped to the authenticated user: Order.findOne({ _id: id, userId: req.user.id }), returning 404 if not found. Put this check in a shared service or middleware so no route can skip it, add tests that try other users' IDs, and consider non-guessable IDs like UUIDs as defence in depth, not as the fix.
36

How do you implement rate limiting on a login endpoint?

Authentication and SecurityMedium
Save to ▾
Show answer
const rateLimit = require('express-rate-limit'); const { RedisStore } = require('rate-limit-redis'); const loginLimiter = rateLimit({ windowMs: 15 * 60 * 1000, limit: 5, standardHeaders: 'draft-7', legacyHeaders: false, keyGenerator: (req) => `${req.ip}:${req.body.email}`, store: new RedisStore({ sendCommand: (...a) => redis.sendCommand(a) }) }); app.post('/auth/login', loginLimiter, login); // Add account lockout or CAPTCHA after repeated failures.

Companies with offices in Gurgaon (5)

E-commerce & consumer tech

Zomato

Full Stack with Node.js interview questions

  • 30 questions
  • 4 rounds

Gurugram

View questions
E-commerce & consumer tech

MakeMyTrip

Full Stack with Node.js interview questions

  • 30 questions
  • 5 rounds

Gurugram, Bengaluru

View questions
Consulting

Publicis Sapient

Full Stack with Node.js interview questions

  • 30 questions
  • 5 rounds

Gurugram, Noida, Bengaluru

View questions
IT services

Nagarro

Full Stack with Node.js interview questions

  • 30 questions
  • 4 rounds

Gurugram, Jaipur

View questions
Consulting

Thoughtworks

Full Stack with Node.js interview questions

  • 30 questions
  • 5 rounds

Pune, Bengaluru, Chennai +2

View questions

Frequently asked questions

Which companies hire Full Stack with Node.js professionals in Gurgaon?

Companies with large offices in Gurgaon include Zomato, MakeMyTrip, Publicis Sapient, Nagarro, Thoughtworks. Use their company pages below to practise employer-specific sets.

Are Full Stack with Node.js interviews in Gurgaon different from other cities?

The questions depend more on the company than the city. Gurgaon's mix of employers decides the style: Interviews often expect strong business understanding along with technical skills, especially for analytics and product-facing roles

How do I find Full Stack with Node.js jobs in Gurgaon?

Shortlist companies with Gurgaon offices, keep your CV focused on Full Stack with Node.js projects, apply on company career pages and job portals with the Gurgaon filter, and practise the questions on this page before each interview.

Other cities

DelhiNoidaBangaloreHyderabadPuneChennaiMumbaiKolkataAhmedabadJaipurLucknowChandigarhIndoreKochiCoimbatoreBhubaneswarNagpurVisakhapatnamThiruvananthapuram

More ways to practise

Company-wise Full Stack with Node.js questionsExperience-wise Full Stack with Node.js questionsRole-wise Full Stack with Node.js questionsCity-wise Full Stack with Node.js questionsMost asked Full Stack with Node.js questionsScenario-based questionsPractical / hands-on questionsHR & behavioural questionsFull Stack with Node.js mock interviewOnline assessment questionsTechnical round questionsManagerial round questionsFull Stack with Node.js topic sheets