Skip to content
Full Stack with Node.js
All coursesPlacement Report
‹ Back to previous sectionCourse homeAll page URLs

Full Stack with Node.js Interview Questions in Hyderabad

36 practice questions with answers for Full Stack with Node.js interviews in Hyderabad.

Full Stack with Node.js jobs in Hyderabad

Hyderabad has large engineering and capability centres of global technology, banking and pharma companies around HITEC City and the Financial District. Many roles are with global capability centres that work with teams in the US and Europe.

Below are 36 questions that match the mix of service, product and domain employers hiring node.js developers in Hyderabad.

Solved for HyderabadStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

How do you implement graceful shutdown in a Node.js server?

Node.js Core and Event LoopMedium
Save to ▾
Show answer
const server = app.listen(3000); async function shutdown(signal) { console.log(signal, 'received, closing'); server.close(async () => { await db.close(); await redis.quit(); process.exit(0); }); setTimeout(() => process.exit(1), 10000).unref(); } process.on('SIGTERM', shutdown); process.on('SIGINT', shutdown); // Stops new connections, finishes in-flight requests, closes pools.
02

What is the difference between OAuth 2.0 and OpenID Connect?

Authentication and SecurityMedium
Save to ▾
Show answer
OAuth 2.0 is an authorisation framework that issues access tokens for calling APIs; it does not define who the user is. OpenID Connect is an identity layer on top of OAuth 2.0 that adds an ID token, a JWT with user identity claims, and a userinfo endpoint. For social or enterprise single sign-on you use OIDC; for API access delegation you use OAuth scopes.
03

What is a closure and how is it used in Node.js code?

Asynchronous JavaScriptEasy
Save to ▾
Show answer
A closure is a function that remembers variables from the scope where it was created, even after that outer function has returned. In Node it is used for middleware factories like rateLimit({ max: 100 }), private counters, memoisation and module-level state. A risk is memory leaks when closures hold large objects longer than needed, for example inside long-lived event listeners.
04

What are the common strategies for API versioning?

REST API DesignMedium
Save to ▾
Show answer
URL versioning like /api/v1/orders is the most common and easy to route and cache. Header versioning uses a custom header or Accept media type, keeping URLs clean but less visible. Query versioning like ?version=2 is simple but messy. Whatever you choose, version only for breaking changes, support old versions for a deprecation period and announce sunset dates.
05

Users report seeing stale prices after an update because of caching. How do you solve it?

Databases: MongoDB, SQL and RedisMedium
Save to ▾
Show answer
Invalidate or update the cache key in the same code path that updates the price, preferably after the database commit. Use reasonable TTLs as a safety net, and version keys if needed. If several services update prices, publish a price-changed event and have consumers delete the cache. For CDN-cached responses, purge the relevant URLs or use short max-age with stale-while-revalidate.
06

How do you prevent a cache stampede when a popular key expires?

Deployment, Scaling and PerformanceHard
Save to ▾
Show answer
When a hot key expires, thousands of requests may hit the database at once. Solutions: allow only one request to rebuild the cache using a short Redis lock while others wait or serve stale data, refresh hot keys in the background before expiry, add random jitter to TTLs so keys do not expire together, and use stale-while-revalidate where slightly old data is acceptable.
07

Explain OAuth 2.0 and the Authorization Code flow with PKCE.

Authentication and SecurityHard
Save to ▾
Show answer
OAuth 2.0 lets an app access resources on a user's behalf without seeing their password, for example social login with an existing account. In Authorization Code with PKCE, the app creates a code verifier and sends its hash to the authorisation server. The user logs in and consents, the app receives a code and exchanges it plus the verifier for tokens. PKCE stops intercepted codes being reused.
08

What are XSS and CSRF and how do you protect a Node.js app from them?

Authentication and SecurityMedium
Save to ▾
Show answer
XSS injects malicious script into pages other users view; prevent it by escaping output, using templating or React auto-escaping, sanitising rich HTML with DOMPurify and setting a strong Content-Security-Policy. CSRF tricks a logged-in browser into sending unwanted requests; prevent it with SameSite cookies, CSRF tokens for cookie-based auth and checking Origin headers on state-changing requests.
09

What happens if you forget to await a promise inside a try/catch?

Asynchronous JavaScriptMedium
Save to ▾
Show answer
If you call an async function without await, the try/catch only covers the synchronous part, so a later rejection escapes it and becomes an unhandled rejection that can crash the process. The function also continues before the work finishes, causing race conditions like responding before data is saved. ESLint rules such as no-floating-promises in TypeScript help catch this.
10

Tell me about an API you designed that you are proud of.

REST API DesignMedium
Save to ▾
Show answer
Situation: our support team used spreadsheets to track refunds. Task: I designed a refund API used by the admin panel and payment service. Action: I wrote the OpenAPI spec first, reviewed it with frontend and finance, added idempotency keys, clear error codes and pagination, and wrote contract tests. Result: integration took two days instead of a week, and refund errors dropped sharply.
11

A scheduled job processes orders with setInterval every minute, but sometimes runs overlap and duplicate emails are sent. How do you fix it?

Asynchronous JavaScriptMedium
Save to ▾
Show answer
setInterval fires regardless of whether the previous async run finished. Use a recursive setTimeout that schedules the next run only after the current one completes, or keep an isRunning flag. If several instances run, use a distributed lock in Redis or a job queue like BullMQ with unique job IDs. Also make email sending idempotent by recording sent message IDs.
12

Compare session-based authentication with JWT-based authentication.

Authentication and SecurityMedium
Save to ▾
Show answer
Sessions store state on the server, often in Redis, and the client holds only a session ID cookie; logout and revocation are easy. JWTs are stateless, so any service can verify them without a lookup, which suits microservices and mobile apps, but revoking a token before expiry needs a denylist or short lifetimes. Many systems combine short-lived JWT access tokens with server-stored refresh tokens.
13

What is the difference between req.params, req.query and req.body?

Express.js FrameworkEasy
Save to ▾
Show answer
req.params holds route parameters from the path, such as id in /users/:id. req.query holds query string values like ?page=2&sort=name, used for filtering and pagination. req.body holds the parsed request payload of POST, PUT or PATCH and needs a parser such as express.json(). All are user input and must be validated before use.
14

How would you add OTP-based login for an Indian mobile app?

Authentication and SecurityMedium
Save to ▾
Show answer
Generate a random 6-digit OTP with crypto.randomInt, store only its hash in Redis with a 5-minute TTL and an attempt counter, and send it through an SMS provider on a DLT-registered template. Verify with a timing-safe compare, limit to about 3 to 5 attempts and rate limit sends per number and IP. On success, issue access and refresh tokens and delete the OTP.
15

Explain debounce and throttle and where they matter on the backend.

Asynchronous JavaScriptMedium
Save to ▾
Show answer
Debounce runs a function only after calls stop for a set time, merging bursts into one call. Throttle runs it at most once per interval. On the backend they help when batching cache invalidation, limiting webhook processing, writing metrics, or reacting to file watcher events. For API traffic you normally use a rate limiter instead, which is a server-side form of throttling.
16

Why do you want to work as a Node.js backend developer?

Deployment, Scaling and PerformanceEasy
Save to ▾
Show answer
I enjoy building the systems behind products: APIs, data models and integrations. Node.js lets me use JavaScript across the stack and ship features quickly, and I like solving problems around performance and reliability. In my projects I built a REST API with authentication, MongoDB and Docker deployment, and I want to grow by working on real traffic and learning system design from experienced engineers.
17

How do you use the Node.js cluster module to use all CPU cores?

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
const cluster = require('cluster'); const os = require('os'); if (cluster.isPrimary) { for (let i = 0; i < os.availableParallelism(); i++) cluster.fork(); cluster.on('exit', (worker) => { console.log(`Worker ${worker.process.pid} died, restarting`); cluster.fork(); }); } else { require('./server'); // each worker listens on the same port } // In Kubernetes, prefer one process per container and more replicas.
18

npm audit reports a critical vulnerability in a dependency of a dependency. What do you do?

Authentication and SecurityMedium
Save to ▾
Show answer
First check whether the vulnerable code path is actually reachable in our usage and read the advisory. Try npm audit fix or updating the parent package to a version that pulls a patched sub-dependency. If none exists, use the overrides field in package.json to force a safe version and run tests. Track it in a ticket and enable Dependabot or Renovate for ongoing updates.
19

How do you prevent server-side request forgery when your API fetches a user-supplied URL?

Authentication and SecurityHard
Save to ▾
Show answer
An attacker could make your server call internal addresses such as 169.254.169.254 for cloud metadata or localhost admin ports. Allow only http and https, resolve the hostname and block private, loopback and link-local IP ranges, use an allowlist of domains where possible, disable redirects or revalidate them, set short timeouts and size limits, and run fetchers in an isolated network.
20

What are health check endpoints and what is the difference between liveness and readiness?

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
Health endpoints let orchestrators check the app. Liveness answers whether the process is alive; if it fails, the container is restarted, so keep it simple. Readiness answers whether the instance can serve traffic, checking database and cache connections; if it fails, the load balancer stops sending requests but does not restart it. During shutdown, fail readiness first.
21

What is the difference between CommonJS and ES Modules in Node.js?

Node.js Core and Event LoopEasy
Save to ▾
Show answer
CommonJS uses require and module.exports, loads modules synchronously and was Node's original system. ES Modules use import and export, are statically analysable, support top-level await and are the JavaScript standard. In Node you enable ESM with the .mjs extension or "type": "module" in package.json. ESM can import CommonJS, but CommonJS needs dynamic import() to load ESM in older versions.
22

You must change a response field name used by many clients. How do you do it without breaking them?

REST API DesignMedium
Save to ▾
Show answer
Treat it as a breaking change. Option one: add the new field alongside the old one, mark the old field deprecated in docs and response headers, track usage through logs and remove it after clients migrate. Option two: release it in /v2 and keep /v1 for a deprecation window. Communicate timelines clearly and add contract tests for both.
23

What is middleware in Express?

Express.js FrameworkEasy
Save to ▾
Show answer
Middleware is a function with the signature (req, res, next) that runs during the request-response cycle. It can read or modify req and res, end the response, or call next() to pass control to the next middleware. Typical uses are parsing JSON, logging, authentication, CORS and rate limiting. Order matters, because middleware runs in the sequence it is registered.
24

Tell me about a production incident you handled and what you did after it.

Testing and DebuggingMedium
Save to ▾
Show answer
Situation: our payment callback endpoint started failing after a deploy on a Friday evening. Task: I was on call. Action: I checked error logs, saw a missing environment variable, rolled back within ten minutes, then added startup config validation and a post-deploy smoke test. Result: impact was limited to a few failed callbacks we replayed, and I wrote a blameless postmortem the team used to improve deploy checks.
25

What is the output order of this code: console.log('A'); setTimeout(() => console.log('B'), 0); Promise.resolve().then(() => console.log('C')); console.log('D');

Asynchronous JavaScriptMedium
Save to ▾
Show answer
The output is A, D, C, B. Synchronous code runs first, printing A and D. Then the microtask queue is drained before the event loop moves to timers, so the promise callback prints C. Finally the timers phase runs the setTimeout callback and prints B. Microtasks always run before the next macrotask such as timers or I/O callbacks.
26

Write a centralised error handler with a custom AppError class.

Express.js FrameworkMedium
Save to ▾
Show answer
class AppError extends Error { constructor(message, status = 500) { super(message); this.status = status; } } app.use((err, req, res, next) => { const status = err.status || 500; logger.error({ err, path: req.path }); res.status(status).json({ error: status === 500 ? 'Internal server error' : err.message }); }); // In a route: throw new AppError('User not found', 404);
27

How do you achieve zero-downtime deployments for a Node.js service?

Deployment, Scaling and PerformanceHard
Save to ▾
Show answer
Use rolling or blue-green deployments so new instances start and pass readiness checks before old ones are removed. Implement graceful shutdown on SIGTERM so in-flight requests finish. Keep database migrations backward compatible using expand and contract. Use feature flags for risky changes and have automated rollback on error rate spikes. Canary releases send a small share of traffic first.
28

How do you scale a Node.js application horizontally?

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
Run multiple stateless instances behind a load balancer and add more as load grows, using autoscaling on CPU, memory or request rate. Keep state out of the process: sessions in Redis, files in object storage, jobs in a queue. Use Redis adapters for WebSocket broadcasting across instances, and make sure the database can handle the total connection count.
29

Tell me about a time you improved code quality in a backend codebase you inherited.

Express.js FrameworkMedium
Save to ▾
Show answer
Situation: I joined a project where Express routes contained SQL, business logic and responses in 300-line handlers. Task: reduce bugs without stopping feature work. Action: I proposed a controller-service-repository structure, added an error handler, validation with zod and tests for each refactored route, and moved one module per sprint. Result: bug reports dropped and new developers onboarded faster.
30

What are microtasks and macrotasks?

Asynchronous JavaScriptMedium
Save to ▾
Show answer
Macrotasks are scheduled work like setTimeout, setInterval, setImmediate and I/O callbacks, handled phase by phase by the event loop. Microtasks are promise reactions and queueMicrotask callbacks; they run right after the current synchronous code finishes and before the next macrotask. In Node, process.nextTick callbacks run even before promise microtasks. A long microtask chain can delay timers and I/O.
31

What is a compound index and why does field order matter?

Databases: MongoDB, SQL and RedisMedium
Save to ▾
Show answer
A compound index covers multiple fields, such as { userId: 1, createdAt: -1 }. It supports queries that use a prefix of the fields, so it helps queries on userId alone or userId plus createdAt, but not createdAt alone. A good rule in MongoDB is ESR: put equality fields first, then sort fields, then range fields, to avoid in-memory sorts.
32

Why is structured logging important and which libraries are used?

Testing and DebuggingEasy
Save to ▾
Show answer
Structured logs are JSON lines with fields like level, timestamp, requestId, userId and message, so tools like ELK, Loki, Datadog or CloudWatch can search and aggregate them. pino is fast and popular, winston is flexible with many transports. Log at correct levels, include a correlation ID per request, and never log passwords, tokens, full card numbers or Aadhaar numbers.
33

A security audit finds that users can see other users' orders by changing the order ID in the URL. How do you fix it?

Authentication and SecurityMedium
Save to ▾
Show answer
This is broken object level authorisation. Every query must be scoped to the authenticated user: Order.findOne({ _id: id, userId: req.user.id }), returning 404 if not found. Put this check in a shared service or middleware so no route can skip it, add tests that try other users' IDs, and consider non-guessable IDs like UUIDs as defence in depth, not as the fix.
34

How do you enable compression and why should you be careful with it?

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
Use the compression middleware or, better, let Nginx or the CDN compress responses with gzip or Brotli, which reduces JSON payload size by 70 percent or more. Be careful: compressing in Node uses CPU on the event loop, small responses gain little, and already compressed files like images should be skipped. Never compress responses mixing secrets with user input over HTTPS because of BREACH-style attacks.
35

How do you serve a React build and an API from the same Express server?

Express.js FrameworkMedium
Save to ▾
Show answer
const path = require('path'); app.use('/api', apiRouter); app.use(express.static(path.join(__dirname, 'client/dist'), { maxAge: '1y' })); // SPA fallback for client-side routes app.get(/^\/(?!api).*/, (req, res) => { res.sendFile(path.join(__dirname, 'client/dist/index.html')); }); // Register API routes first so they are not caught by the fallback.
36

How do you run integration tests against a real database in CI?

Testing and DebuggingMedium
Save to ▾
Show answer
Start a disposable database for the test run, using Docker Compose services in CI, Testcontainers from the test code, or mongodb-memory-server for MongoDB. Run migrations before tests, seed minimal data per test, and clean tables between tests or wrap each test in a rolled-back transaction. Use a separate DATABASE_URL so tests can never touch production data.

Companies with offices in Hyderabad (5)

E-commerce & consumer tech

Swiggy

Full Stack with Node.js interview questions

  • 30 questions
  • 4 rounds

Bengaluru, Hyderabad

View questions
E-commerce & consumer tech

Flipkart

Full Stack with Node.js interview questions

  • 30 questions
  • 5 rounds

Bengaluru, Hyderabad

View questions
Product

Freshworks

Full Stack with Node.js interview questions

  • 30 questions
  • 5 rounds

Chennai, Bengaluru, Hyderabad

View questions
Consulting

Thoughtworks

Full Stack with Node.js interview questions

  • 30 questions
  • 5 rounds

Pune, Bengaluru, Chennai +2

View questions
IT services

Infosys

Full Stack with Node.js interview questions

  • 30 questions
  • 4 rounds

Bengaluru, Mysuru, Pune +2

View questions

Frequently asked questions

Which companies hire Full Stack with Node.js professionals in Hyderabad?

Companies with large offices in Hyderabad include Swiggy, Flipkart, Freshworks, Thoughtworks, Infosys. Use their company pages below to practise employer-specific sets.

Are Full Stack with Node.js interviews in Hyderabad different from other cities?

The questions depend more on the company than the city. Hyderabad's mix of employers decides the style: Many roles are with global capability centres that work with teams in the US and Europe

How do I find Full Stack with Node.js jobs in Hyderabad?

Shortlist companies with Hyderabad offices, keep your CV focused on Full Stack with Node.js projects, apply on company career pages and job portals with the Hyderabad filter, and practise the questions on this page before each interview.

Other cities

DelhiNoidaGurgaonBangalorePuneChennaiMumbaiKolkataAhmedabadJaipurLucknowChandigarhIndoreKochiCoimbatoreBhubaneswarNagpurVisakhapatnamThiruvananthapuram

More ways to practise

Company-wise Full Stack with Node.js questionsExperience-wise Full Stack with Node.js questionsRole-wise Full Stack with Node.js questionsCity-wise Full Stack with Node.js questionsMost asked Full Stack with Node.js questionsScenario-based questionsPractical / hands-on questionsHR & behavioural questionsFull Stack with Node.js mock interviewOnline assessment questionsTechnical round questionsManagerial round questionsFull Stack with Node.js topic sheets