Skip to content
Full Stack with Node.js
All coursesPlacement Report
‹ Back to previous sectionCourse homeAll page URLs

Medium Full Stack with Node.js Interview Questions

97 medium questions with answers. Applied questions that check whether you can use the concepts on real work.

Topics in the medium set

Authentication and Security: 15 Asynchronous JavaScript: 14 Deployment, Scaling and Performance: 14 Databases: MongoDB, SQL and Redis: 13 Express.js Framework: 12 REST API Design: 12 Node.js Core and Event Loop: 9 Testing and Debugging: 8
Solved — mediumStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

Explain the Node.js event loop and its main phases.

Node.js Core and Event LoopMedium
Save to ▾
Show answer
The event loop lets Node.js run asynchronous callbacks on a single thread. Each iteration passes through phases: timers (setTimeout, setInterval), pending callbacks, poll (waits for and runs I/O callbacks), check (setImmediate), and close callbacks. Between phases Node drains the process.nextTick queue and the promise microtask queue. Understanding phases explains why setImmediate runs before a 0 ms timer inside an I/O callback.
02

Is Node.js single-threaded? Explain the role of libuv.

Node.js Core and Event LoopMedium
Save to ▾
Show answer
Your JavaScript runs on a single main thread, but Node.js itself is not purely single-threaded. libuv, the C library under Node, provides the event loop and a thread pool (default 4 threads, set with UV_THREADPOOL_SIZE) used for file system work, DNS lookups, crypto and zlib. Network I/O uses OS async mechanisms like epoll or IOCP instead of threads.
03

What is the difference between process.nextTick and setImmediate?

Node.js Core and Event LoopMedium
Save to ▾
Show answer
process.nextTick queues a callback to run immediately after the current operation, before the event loop continues to any phase, even before promise microtasks. setImmediate queues a callback for the check phase of the next loop iteration. Overusing nextTick recursively can starve I/O because the loop never moves on, so setImmediate is safer for deferring heavy work.
04

How do you read a large file efficiently in Node.js?

Node.js Core and Event LoopMedium
Save to ▾
Show answer
const fs = require('fs'); const readline = require('readline'); async function countErrors(path) { const rl = readline.createInterface({ input: fs.createReadStream(path), crlfDelay: Infinity }); let count = 0; for await (const line of rl) { if (line.includes('ERROR')) count++; } return count; } // Streams line by line, so a 5 GB log uses little memory.
05

Your Node.js API becomes unresponsive when one endpoint generates a large PDF report. What is happening and how do you fix it?

Node.js Core and Event LoopMedium
Save to ▾
Show answer
The PDF generation is CPU-bound and blocks the single event loop, so every other request waits. Fixes: move the work to a worker_threads pool such as Piscina, or push it to a background job queue like BullMQ with Redis and return a job ID that the client polls. Also break large loops into chunks and measure event loop lag to confirm the fix.
06

How would you handle uncaughtException and unhandledRejection in production?

Node.js Core and Event LoopMedium
Save to ▾
Show answer
Log both with full stack traces and context, then exit the process after flushing logs, because state may be corrupted. A process manager like PM2, systemd or Kubernetes restarts it. Never use uncaughtException to keep running as if nothing happened. Since Node 15, unhandled rejections crash the process by default, so every promise chain should have proper error handling.
07

How do you implement graceful shutdown in a Node.js server?

Node.js Core and Event LoopMedium
Save to ▾
Show answer
const server = app.listen(3000); async function shutdown(signal) { console.log(signal, 'received, closing'); server.close(async () => { await db.close(); await redis.quit(); process.exit(0); }); setTimeout(() => process.exit(1), 10000).unref(); } process.on('SIGTERM', shutdown); process.on('SIGINT', shutdown); // Stops new connections, finishes in-flight requests, closes pools.
08

What is the purpose of the util.promisify function?

Node.js Core and Event LoopMedium
Save to ▾
Show answer
util.promisify converts a function that follows the Node callback convention, where the last argument is (err, result) => {}, into one that returns a promise. This lets you use async and await with older APIs. For example, const sleep = util.promisify(setTimeout) or promisify(fs.readFile). Many core modules now offer promise versions directly, such as fs/promises and dns/promises.
09

Describe a situation where you found and fixed a production performance problem.

Node.js Core and Event LoopMedium
Save to ▾
Show answer
Situation: our search API p95 latency jumped from 200 ms to 2 seconds after a release. Task: as on-call engineer I had to find the cause fast. Action: I checked APM traces, saw a new synchronous JSON transform blocking the event loop, moved it to a cached precomputed field and added an event loop lag alert. Result: latency returned to normal within a day and we added a performance check to code review.
10

Explain the difference between Promise.all, Promise.allSettled, Promise.race and Promise.any.

Asynchronous JavaScriptMedium
Save to ▾
Show answer
Promise.all resolves with all results when every promise fulfils, and rejects as soon as one rejects. Promise.allSettled waits for all and returns each status and value or reason, useful when partial failure is fine. Promise.race settles with the first promise to settle, often used for timeouts. Promise.any resolves with the first fulfilled promise and rejects only if all reject.
11

How does async/await work under the hood?

Asynchronous JavaScriptMedium
Save to ▾
Show answer
An async function always returns a promise. await pauses that function until the awaited promise settles, then resumes it with the value or throws the rejection, while the event loop keeps running other work. Internally it is built on promises and generator-like suspension. The code reads like synchronous code but is still non-blocking, and errors are handled with ordinary try/catch.
12

What is the output order of this code: console.log('A'); setTimeout(() => console.log('B'), 0); Promise.resolve().then(() => console.log('C')); console.log('D');

Asynchronous JavaScriptMedium
Save to ▾
Show answer
The output is A, D, C, B. Synchronous code runs first, printing A and D. Then the microtask queue is drained before the event loop moves to timers, so the promise callback prints C. Finally the timers phase runs the setTimeout callback and prints B. Microtasks always run before the next macrotask such as timers or I/O callbacks.
13

What are microtasks and macrotasks?

Asynchronous JavaScriptMedium
Save to ▾
Show answer
Macrotasks are scheduled work like setTimeout, setInterval, setImmediate and I/O callbacks, handled phase by phase by the event loop. Microtasks are promise reactions and queueMicrotask callbacks; they run right after the current synchronous code finishes and before the next macrotask. In Node, process.nextTick callbacks run even before promise microtasks. A long microtask chain can delay timers and I/O.
14

How do you add a timeout to a promise?

Asynchronous JavaScriptMedium
Save to ▾
Show answer
function withTimeout(promise, ms) { let timer; const timeout = new Promise((_, reject) => { timer = setTimeout(() => reject(new Error('Timeout')), ms); }); return Promise.race([promise, timeout]).finally(() => clearTimeout(timer)); } await withTimeout(fetch(url), 3000); // For fetch, AbortSignal.timeout(3000) also cancels the request.
15

What happens if you forget to await a promise inside a try/catch?

Asynchronous JavaScriptMedium
Save to ▾
Show answer
If you call an async function without await, the try/catch only covers the synchronous part, so a later rejection escapes it and becomes an unhandled rejection that can crash the process. The function also continues before the work finishes, causing race conditions like responding before data is saved. ESLint rules such as no-floating-promises in TypeScript help catch this.
16

How does the this keyword behave in arrow functions compared to regular functions?

Asynchronous JavaScriptMedium
Save to ▾
Show answer
A regular function's this depends on how it is called: the object before the dot, undefined in strict mode for plain calls, or whatever bind, call or apply set. Arrow functions do not have their own this; they capture it lexically from the surrounding scope. That makes arrows ideal for callbacks inside class methods, but unsuitable as object methods that need this.
17

Write a retry function with exponential backoff for a flaky API call.

Asynchronous JavaScriptMedium
Save to ▾
Show answer
async function retry(fn, retries = 3, baseMs = 200) { for (let attempt = 0; ; attempt++) { try { return await fn(); } catch (err) { if (attempt >= retries) throw err; const delay = baseMs * 2 ** attempt + Math.random() * 100; await new Promise((r) => setTimeout(r, delay)); } } } await retry(() => paymentClient.getStatus(id));
18

A dashboard endpoint makes five independent database queries one after another and takes 1.5 seconds. How would you speed it up?

Asynchronous JavaScriptMedium
Save to ▾
Show answer
Because the queries are independent, run them concurrently with Promise.all so total time is close to the slowest query instead of the sum. Check that the database connection pool is large enough to serve them in parallel. Then add indexes for slow queries, cache rarely changing parts in Redis, and use Promise.allSettled if the page can render with some widgets missing.
19

How can you cancel an in-flight HTTP request in Node.js?

Asynchronous JavaScriptMedium
Save to ▾
Show answer
Use AbortController. Create a controller, pass controller.signal to fetch or to libraries that support it such as axios, and call controller.abort() when the request is no longer needed, for example when the client disconnects. AbortSignal.timeout(ms) gives a ready-made timeout signal. Aborting rejects the promise with an AbortError, which you should handle separately from real failures.
20

What is the difference between throwing an error and rejecting a promise inside an async function?

Asynchronous JavaScriptMedium
Save to ▾
Show answer
Inside an async function they behave the same: throw new Error() causes the returned promise to reject with that error. Outside async functions, a throw inside a plain callback such as setTimeout is not caught by promise handlers and becomes an uncaught exception. Always reject with Error objects, not strings, so you keep a stack trace.
21

A scheduled job processes orders with setInterval every minute, but sometimes runs overlap and duplicate emails are sent. How do you fix it?

Asynchronous JavaScriptMedium
Save to ▾
Show answer
setInterval fires regardless of whether the previous async run finished. Use a recursive setTimeout that schedules the next run only after the current one completes, or keep an isRunning flag. If several instances run, use a distributed lock in Redis or a job queue like BullMQ with unique job IDs. Also make email sending idempotent by recording sent message IDs.
22

Explain debounce and throttle and where they matter on the backend.

Asynchronous JavaScriptMedium
Save to ▾
Show answer
Debounce runs a function only after calls stop for a set time, merging bursts into one call. Throttle runs it at most once per interval. On the backend they help when batching cache invalidation, limiting webhook processing, writing metrics, or reacting to file watcher events. For API traffic you normally use a rate limiter instead, which is a server-side form of throttling.
23

Tell me about a time you had to debug a tricky asynchronous bug.

Asynchronous JavaScriptMedium
Save to ▾
Show answer
Situation: customers occasionally received two invoices. Task: I had to find why it happened only in production. Action: I added request IDs to logs and found a forEach with async callbacks plus a retry triggering a second save before the first finished. I replaced it with for...of, added a unique index on invoice number and made the job idempotent. Result: duplicates stopped completely.
24

How does error-handling middleware work in Express?

Express.js FrameworkMedium
Save to ▾
Show answer
Error-handling middleware has four parameters (err, req, res, next) and must be registered after all routes. When any middleware calls next(err) or throws in a synchronous handler, Express skips normal middleware and jumps to the error handler. In Express 4, async errors must be passed to next manually or with a wrapper; Express 5 forwards rejected promises automatically.
25

Write a centralised error handler with a custom AppError class.

Express.js FrameworkMedium
Save to ▾
Show answer
class AppError extends Error { constructor(message, status = 500) { super(message); this.status = status; } } app.use((err, req, res, next) => { const status = err.status || 500; logger.error({ err, path: req.path }); res.status(status).json({ error: status === 500 ? 'Internal server error' : err.message }); }); // In a route: throw new AppError('User not found', 404);
26

How do you handle async errors in Express 4 routes?

Express.js FrameworkMedium
Save to ▾
Show answer
const asyncHandler = (fn) => (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next); router.get('/:id', asyncHandler(async (req, res) => { const user = await User.findById(req.params.id); if (!user) throw new AppError('Not found', 404); res.json(user); })); // Without this, a rejected promise is never sent to the error handler. // Express 5 does this automatically.
27

Write a simple request logging middleware that records response time.

Express.js FrameworkMedium
Save to ▾
Show answer
function requestLogger(req, res, next) { const start = process.hrtime.bigint(); res.on('finish', () => { const ms = Number(process.hrtime.bigint() - start) / 1e6; console.log(`${req.method} ${req.originalUrl} ${res.statusCode} ${ms.toFixed(1)}ms`); }); next(); } app.use(requestLogger); // In production use pino-http or morgan with structured logs.
28

How do you handle file uploads in Express?

Express.js FrameworkMedium
Save to ▾
Show answer
Use multer for multipart/form-data. Configure limits for file size and count, filter allowed MIME types and extensions, and store files with generated names, not user-supplied names. For production, stream uploads directly to object storage such as S3 using presigned URLs so files do not pass through or fill the server disk. Scan files and never execute uploaded content.
29

How would you structure a large Express project?

Express.js FrameworkMedium
Save to ▾
Show answer
I use a layered structure: routes define endpoints, controllers handle HTTP details, services hold business logic, and repositories or models talk to the database. Add middlewares, validators, config and utils folders, and group by feature, for example modules/orders, once the app grows. This keeps controllers thin, makes services unit-testable and avoids business rules leaking into routes.
30

How do you validate request bodies in Express?

Express.js FrameworkMedium
Save to ▾
Show answer
const { z } = require('zod'); const createUser = z.object({ name: z.string().min(2), email: z.string().email(), age: z.number().int().min(18).optional() }); const validate = (schema) => (req, res, next) => { const r = schema.safeParse(req.body); if (!r.success) return res.status(400).json({ errors: r.error.issues }); req.body = r.data; next(); }; router.post('/users', validate(createUser), createUserHandler);
31

After adding a new middleware, all routes return 404 or hang. How do you debug it?

Express.js FrameworkMedium
Save to ▾
Show answer
A hang usually means the middleware never calls next() or sends a response on some path. A 404 often means it was mounted with a wrong path or registered after routes. I check order of app.use calls, add logging at the start and end of the middleware, verify every branch calls next or responds, and check async code passes errors to next.
32

When would you choose NestJS or Fastify over Express?

Express.js FrameworkMedium
Save to ▾
Show answer
Choose Fastify when raw performance and built-in schema validation matter; it is faster than Express thanks to optimised routing and serialisation. Choose NestJS for large teams that want structure: modules, dependency injection, decorators and first-class TypeScript, similar to Spring or Angular. Express still suits small to medium services and teams that prefer flexibility and a huge middleware ecosystem.
33

How do you serve a React build and an API from the same Express server?

Express.js FrameworkMedium
Save to ▾
Show answer
const path = require('path'); app.use('/api', apiRouter); app.use(express.static(path.join(__dirname, 'client/dist'), { maxAge: '1y' })); // SPA fallback for client-side routes app.get(/^\/(?!api).*/, (req, res) => { res.sendFile(path.join(__dirname, 'client/dist/index.html')); }); // Register API routes first so they are not caught by the fallback.
34

How do you design Express middleware that checks user roles for a route?

Express.js FrameworkMedium
Save to ▾
Show answer
Create a factory: const authorize = (...roles) => (req, res, next) => roles.includes(req.user?.role) ? next() : res.status(403).json({ error: 'Forbidden' }). Use it after authentication, for example router.delete('/:id', authenticate, authorize('admin'), handler). Keep roles and permissions in config or the database, and for complex rules move to permission-based checks or a policy library.
35

Tell me about a time you improved code quality in a backend codebase you inherited.

Express.js FrameworkMedium
Save to ▾
Show answer
Situation: I joined a project where Express routes contained SQL, business logic and responses in 300-line handlers. Task: reduce bugs without stopping feature work. Action: I proposed a controller-service-repository structure, added an error handler, validation with zod and tests for each refactored route, and moved one module per sprint. Result: bug reports dropped and new developers onboarded faster.
36

Compare offset pagination and cursor pagination.

REST API DesignMedium
Save to ▾
Show answer
Offset pagination uses page and limit, translated to LIMIT and OFFSET. It is simple and allows jumping to a page, but gets slow on large tables and can skip or repeat rows when data changes. Cursor pagination uses the last seen value, such as id or created_at, to fetch the next set with a WHERE clause. It is fast and stable, ideal for feeds and infinite scroll.
37

Implement cursor-based pagination for a products endpoint.

REST API DesignMedium
Save to ▾
Show answer
router.get('/products', async (req, res) => { const limit = Math.min(Number(req.query.limit) || 20, 100); const cursor = req.query.cursor; const filter = cursor ? { _id: { $lt: cursor } } : {}; const items = await Product.find(filter) .sort({ _id: -1 }) .limit(limit + 1); const hasMore = items.length > limit; if (hasMore) items.pop(); res.json({ data: items, nextCursor: hasMore ? items[items.length - 1]._id : null }); });
38

What are the common strategies for API versioning?

REST API DesignMedium
Save to ▾
Show answer
URL versioning like /api/v1/orders is the most common and easy to route and cache. Header versioning uses a custom header or Accept media type, keeping URLs clean but less visible. Query versioning like ?version=2 is simple but messy. Whatever you choose, version only for breaking changes, support old versions for a deprecation period and announce sunset dates.
39

How do you design a consistent error response format for an API?

REST API DesignMedium
Save to ▾
Show answer
Use one structure everywhere, for example { "error": { "code": "VALIDATION_FAILED", "message": "Email is invalid", "details": [{ "field": "email" }], "requestId": "abc123" } }. Many teams follow RFC 9457 Problem Details with type, title, status and detail. Use machine-readable codes for clients, human messages for display, and never leak stack traces or SQL errors.
40

What is the difference between REST and GraphQL?

REST API DesignMedium
Save to ▾
Show answer
REST exposes multiple endpoints with fixed response shapes, uses HTTP caching easily and is simple to reason about. GraphQL exposes one endpoint where clients query exactly the fields they need, reducing over-fetching and multiple round trips, which helps mobile apps. GraphQL adds complexity: N+1 query risks needing DataLoader, harder caching, query cost limits and schema governance.
41

How do you implement filtering and sorting safely from query parameters?

REST API DesignMedium
Save to ▾
Show answer
const ALLOWED_SORT = ['price', 'createdAt', 'name']; router.get('/products', async (req, res) => { const filter = {}; if (req.query.category) filter.category = String(req.query.category); if (req.query.maxPrice) filter.price = { $lte: Number(req.query.maxPrice) }; const field = ALLOWED_SORT.includes(req.query.sort) ? req.query.sort : 'createdAt'; const dir = req.query.order === 'asc' ? 1 : -1; res.json(await Product.find(filter).sort({ [field]: dir }).limit(50)); }); // Whitelist fields and cast types to block injection.
42

Design endpoints for a simple e-commerce cart and checkout.

REST API DesignMedium
Save to ▾
Show answer
GET /api/v1/cart returns the current user's cart. POST /api/v1/cart/items adds an item with productId and quantity. PATCH /api/v1/cart/items/:itemId changes quantity, and DELETE removes it. POST /api/v1/orders creates an order from the cart with an Idempotency-Key header. GET /api/v1/orders/:id shows status, and POST /api/v1/orders/:id/cancel handles cancellation as an action.
43

A mobile app team complains your API returns too much data and is slow on 4G. What would you change?

REST API DesignMedium
Save to ▾
Show answer
Add field selection like ?fields=id,name,price, smaller list representations with details on a separate endpoint, pagination with sensible limits and gzip or Brotli compression. Support ETag and Cache-Control so unchanged data returns 304. If many screens need combined data, consider a Backend-for-Frontend layer or GraphQL tailored to the mobile app.
44

You must change a response field name used by many clients. How do you do it without breaking them?

REST API DesignMedium
Save to ▾
Show answer
Treat it as a breaking change. Option one: add the new field alongside the old one, mark the old field deprecated in docs and response headers, track usage through logs and remove it after clients migrate. Option two: release it in /v2 and keep /v1 for a deprecation window. Communicate timelines clearly and add contract tests for both.
45

How does HTTP caching with ETag and Cache-Control work for APIs?

REST API DesignMedium
Save to ▾
Show answer
Cache-Control tells clients and CDNs how long a response is fresh, for example public, max-age=300, or private, no-store for user data. An ETag is a hash of the response; the client sends it back in If-None-Match, and if nothing changed the server returns 304 Not Modified with no body. Express generates weak ETags automatically for res.send responses.
46

How do you handle a breaking API change request from a product manager close to a release?

REST API DesignMedium
Save to ▾
Show answer
I would first understand why it is needed and who consumes the API. Then I explain the impact on existing clients, propose a non-breaking path such as adding a new field or a v2 endpoint, and estimate effort and risk. Result in a past case: we shipped the additive change on time and scheduled removal of the old field for the next quarter.
47

Tell me about an API you designed that you are proud of.

REST API DesignMedium
Save to ▾
Show answer
Situation: our support team used spreadsheets to track refunds. Task: I designed a refund API used by the admin panel and payment service. Action: I wrote the OpenAPI spec first, reviewed it with frontend and finance, added idempotency keys, clear error codes and pagination, and wrote contract tests. Result: integration took two days instead of a week, and refund errors dropped sharply.
48

Compare session-based authentication with JWT-based authentication.

Authentication and SecurityMedium
Save to ▾
Show answer
Sessions store state on the server, often in Redis, and the client holds only a session ID cookie; logout and revocation are easy. JWTs are stateless, so any service can verify them without a lookup, which suits microservices and mobile apps, but revoking a token before expiry needs a denylist or short lifetimes. Many systems combine short-lived JWT access tokens with server-stored refresh tokens.
49

How do access tokens and refresh tokens work together?

Authentication and SecurityMedium
Save to ▾
Show answer
The access token is short-lived, around 5 to 15 minutes, and sent with each API request. The refresh token is long-lived, stored securely in an HttpOnly cookie, and used only at a refresh endpoint to get a new access token. Rotate refresh tokens on every use and store their hashes server-side, so a stolen or reused token can be detected and the session revoked.
50

Write JWT authentication middleware for Express.

Authentication and SecurityMedium
Save to ▾
Show answer
const jwt = require('jsonwebtoken'); function authenticate(req, res, next) { const header = req.get('Authorization') || ''; const token = header.startsWith('Bearer ') ? header.slice(7) : null; if (!token) return res.status(401).json({ error: 'Missing token' }); try { req.user = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] }); next(); } catch { res.status(401).json({ error: 'Invalid or expired token' }); } }
51

Write signup and login handlers using bcrypt.

Authentication and SecurityMedium
Save to ▾
Show answer
const bcrypt = require('bcrypt'); async function signup(req, res) { const hash = await bcrypt.hash(req.body.password, 12); const user = await User.create({ email: req.body.email, password: hash }); res.status(201).json({ id: user.id }); } async function login(req, res) { const user = await User.findOne({ email: req.body.email }).select('+password'); const ok = user && await bcrypt.compare(req.body.password, user.password); if (!ok) return res.status(401).json({ error: 'Invalid credentials' }); res.json({ token: signAccessToken(user) }); }
52

Where should a web app store tokens: localStorage or cookies?

Authentication and SecurityMedium
Save to ▾
Show answer
localStorage is readable by any JavaScript on the page, so an XSS bug can steal tokens. HttpOnly, Secure, SameSite cookies cannot be read by JavaScript, which is safer for refresh tokens and session IDs. Cookies require CSRF protection, which SameSite=Lax or Strict plus CSRF tokens provide. A common pattern keeps the access token in memory and the refresh token in an HttpOnly cookie.
53

What is the difference between OAuth 2.0 and OpenID Connect?

Authentication and SecurityMedium
Save to ▾
Show answer
OAuth 2.0 is an authorisation framework that issues access tokens for calling APIs; it does not define who the user is. OpenID Connect is an identity layer on top of OAuth 2.0 that adds an ID token, a JWT with user identity claims, and a userinfo endpoint. For social or enterprise single sign-on you use OIDC; for API access delegation you use OAuth scopes.
54

What is NoSQL injection in MongoDB and how do you prevent it?

Authentication and SecurityMedium
Save to ▾
Show answer
If you pass req.body directly into a query, an attacker can send { "password": { "$ne": null } } and bypass checks. Prevent it by validating and casting input types with zod or Joi, rejecting objects where strings are expected, enabling Mongoose strictQuery and sanitizeFilter, and never building queries from raw user objects. Avoid $where and server-side JavaScript evaluation.
55

What are XSS and CSRF and how do you protect a Node.js app from them?

Authentication and SecurityMedium
Save to ▾
Show answer
XSS injects malicious script into pages other users view; prevent it by escaping output, using templating or React auto-escaping, sanitising rich HTML with DOMPurify and setting a strong Content-Security-Policy. CSRF tricks a logged-in browser into sending unwanted requests; prevent it with SameSite cookies, CSRF tokens for cookie-based auth and checking Origin headers on state-changing requests.
56

How do you implement rate limiting on a login endpoint?

Authentication and SecurityMedium
Save to ▾
Show answer
const rateLimit = require('express-rate-limit'); const { RedisStore } = require('rate-limit-redis'); const loginLimiter = rateLimit({ windowMs: 15 * 60 * 1000, limit: 5, standardHeaders: 'draft-7', legacyHeaders: false, keyGenerator: (req) => `${req.ip}:${req.body.email}`, store: new RedisStore({ sendCommand: (...a) => redis.sendCommand(a) }) }); app.post('/auth/login', loginLimiter, login); // Add account lockout or CAPTCHA after repeated failures.
57

How do you implement role-based access control (RBAC) in an API?

Authentication and SecurityMedium
Save to ▾
Show answer
Define roles such as admin, manager and customer, and map them to permissions like order:read or order:refund. Put the role or permissions in the token or load them per request, and check them in middleware before handlers. For ownership rules, also check resource data, for example a customer can view only orders where order.userId equals req.user.id. Test both allowed and denied paths.
58

What is the OWASP Top 10 and which items matter most for Node.js APIs?

Authentication and SecurityMedium
Save to ▾
Show answer
The OWASP Top 10 lists the most critical web application security risks. For Node APIs the most relevant are broken access control, injection, cryptographic failures, security misconfiguration, vulnerable and outdated components, authentication failures and server-side request forgery. OWASP also publishes an API Security Top 10, which highlights broken object level authorisation, where users access others' data by changing an ID.
59

A security audit finds that users can see other users' orders by changing the order ID in the URL. How do you fix it?

Authentication and SecurityMedium
Save to ▾
Show answer
This is broken object level authorisation. Every query must be scoped to the authenticated user: Order.findOne({ _id: id, userId: req.user.id }), returning 404 if not found. Put this check in a shared service or middleware so no route can skip it, add tests that try other users' IDs, and consider non-guessable IDs like UUIDs as defence in depth, not as the fix.
60

How would you add OTP-based login for an Indian mobile app?

Authentication and SecurityMedium
Save to ▾
Show answer
Generate a random 6-digit OTP with crypto.randomInt, store only its hash in Redis with a 5-minute TTL and an attempt counter, and send it through an SMS provider on a DLT-registered template. Verify with a timing-safe compare, limit to about 3 to 5 attempts and rate limit sends per number and IP. On success, issue access and refresh tokens and delete the OTP.
61

npm audit reports a critical vulnerability in a dependency of a dependency. What do you do?

Authentication and SecurityMedium
Save to ▾
Show answer
First check whether the vulnerable code path is actually reachable in our usage and read the advisory. Try npm audit fix or updating the parent package to a version that pulls a patched sub-dependency. If none exists, use the overrides field in package.json to force a safe version and run tests. Track it in a ticket and enable Dependabot or Renovate for ongoing updates.
62

Tell me about a time you found a security issue in code and how you handled it.

Authentication and SecurityMedium
Save to ▾
Show answer
Situation: during code review I noticed an admin export route that only hid the button in the frontend. Task: make sure no regular user could call it. Action: I reproduced it with a normal user token, reported it privately to my lead, added role middleware and tests, and checked similar routes. Result: we fixed four endpoints before release and added an authorisation checklist to pull requests.
63

What is a compound index and why does field order matter?

Databases: MongoDB, SQL and RedisMedium
Save to ▾
Show answer
A compound index covers multiple fields, such as { userId: 1, createdAt: -1 }. It supports queries that use a prefix of the fields, so it helps queries on userId alone or userId plus createdAt, but not createdAt alone. A good rule in MongoDB is ESR: put equality fields first, then sort fields, then range fields, to avoid in-memory sorts.
64

What is the N+1 query problem and how do you fix it?

Databases: MongoDB, SQL and RedisMedium
Save to ▾
Show answer
N+1 happens when you run one query to fetch a list and then one extra query per item, for example loading 100 posts and then each author separately, causing 101 queries. Fix it with joins or eager loading in SQL ORMs like include in Prisma or Sequelize, populate or $lookup in MongoDB, batching with an IN query, or DataLoader in GraphQL.
65

What is the MongoDB aggregation pipeline? Give an example.

Databases: MongoDB, SQL and RedisMedium
Save to ▾
Show answer
// Top 5 cities by revenue in the last 30 days const since = new Date(Date.now() - 30 * 864e5); const result = await Order.aggregate([ { $match: { status: 'paid', createdAt: { $gte: since } } }, { $group: { _id: '$city', revenue: { $sum: '$amount' }, orders: { $sum: 1 } } }, { $sort: { revenue: -1 } }, { $limit: 5 } ]); // Each stage transforms documents; put $match early to use indexes.
66

When should you embed documents versus reference them in MongoDB?

Databases: MongoDB, SQL and RedisMedium
Save to ▾
Show answer
Embed when data is read together, owned by the parent and bounded in size, such as addresses inside a user or line items inside an order. Reference when the related data is large, grows without limit, is shared across many documents or changes independently, such as products referenced by orders or comments on a viral post. Remember the 16 MB document size limit.
67

What is connection pooling and why is it important in Node.js?

Databases: MongoDB, SQL and RedisMedium
Save to ▾
Show answer
Opening a database connection is slow, so a pool keeps a set of open connections that requests borrow and return. pg Pool, mysql2 and the MongoDB driver all pool by default. Size the pool based on database limits and instance count; too small causes waiting, too large overloads the database. In serverless functions, reuse the client across invocations or use a proxy like RDS Proxy.
68

Compare Prisma, Sequelize and TypeORM for SQL databases in Node.js.

Databases: MongoDB, SQL and RedisMedium
Save to ▾
Show answer
Prisma uses a schema file to generate a fully typed client and has excellent TypeScript support and migrations, though complex raw SQL needs escape hatches. Sequelize is mature, promise-based and widely used in older JavaScript projects. TypeORM uses decorators and entity classes, familiar to Java and NestJS developers. Drizzle is a newer lightweight, SQL-like typed option. Pick based on TypeScript use and team familiarity.
69

Implement the cache-aside pattern with Redis for a product lookup.

Databases: MongoDB, SQL and RedisMedium
Save to ▾
Show answer
async function getProduct(id) { const key = `product:${id}`; const cached = await redis.get(key); if (cached) return JSON.parse(cached); const product = await Product.findById(id).lean(); if (product) { await redis.set(key, JSON.stringify(product), { EX: 300 }); } return product; } async function updateProduct(id, data) { await Product.updateOne({ _id: id }, data); await redis.del(`product:${id}`); // invalidate }
70

What is database normalisation and when would you denormalise?

Databases: MongoDB, SQL and RedisMedium
Save to ▾
Show answer
Normalisation organises tables to remove duplicate data and update anomalies, typically up to third normal form, for example keeping customers and orders in separate tables linked by foreign keys. You denormalise for read performance, such as storing a product name on an order line or a precomputed order count on a user, when joins become expensive. Denormalised data must be kept in sync.
71

How do you manage database schema migrations in a Node.js project?

Databases: MongoDB, SQL and RedisMedium
Save to ▾
Show answer
Use a migration tool such as Prisma Migrate, Knex, Sequelize CLI or TypeORM migrations, and commit migration files to Git. Each migration has up and ideally down steps and runs in CI and before deployment. For zero downtime, use expand and contract: add new columns first, deploy code that writes both, backfill, switch reads, then drop old columns in a later release.
72

Users report seeing stale prices after an update because of caching. How do you solve it?

Databases: MongoDB, SQL and RedisMedium
Save to ▾
Show answer
Invalidate or update the cache key in the same code path that updates the price, preferably after the database commit. Use reasonable TTLs as a safety net, and version keys if needed. If several services update prices, publish a price-changed event and have consumers delete the cache. For CDN-cached responses, purge the relevant URLs or use short max-age with stale-while-revalidate.
73

A Mongoose query returns large documents and the API is slow. What optimisations can you apply?

Databases: MongoDB, SQL and RedisMedium
Save to ▾
Show answer
Use .select() to fetch only needed fields, and .lean() to return plain objects instead of full Mongoose documents, which cuts memory and CPU. Make sure the filter and sort use an index, checked with explain. Paginate results, avoid populating deep references, and cache frequently read data. For large exports, use a cursor with for await instead of loading everything.
74

What is soft delete and what are its trade-offs?

Databases: MongoDB, SQL and RedisMedium
Save to ▾
Show answer
Soft delete marks a record as deleted with a flag or deletedAt timestamp instead of removing it, so data can be restored and audited. Trade-offs: every query must filter out deleted rows, unique constraints need care, tables grow over time and privacy laws such as India's DPDP Act may require real deletion of personal data on request. Use partial indexes and periodic purging.
75

Tell me about a time a database change caused an issue and what you learned.

Databases: MongoDB, SQL and RedisMedium
Save to ▾
Show answer
Situation: I added a NOT NULL column with a default to a large MySQL table during business hours. Task: the migration locked the table and checkout slowed down. Action: I rolled back, rewrote it as add nullable column, backfill in batches, then add the constraint, and ran it at low traffic after testing on a production-size copy. Result: no downtime, and we added a migration review checklist.
76

How do you test Express routes with Supertest?

Testing and DebuggingMedium
Save to ▾
Show answer
const request = require('supertest'); const app = require('../app'); // export app without calling listen describe('GET /api/v1/users/:id', () => { it('returns 404 for an unknown user', async () => { const res = await request(app) .get('/api/v1/users/000000000000000000000000') .set('Authorization', `Bearer ${testToken}`); expect(res.status).toBe(404); expect(res.body.error).toBeDefined(); }); });
77

How do you mock a database or external service in Jest?

Testing and DebuggingMedium
Save to ▾
Show answer
// order.service.test.js jest.mock('../repositories/orderRepo'); const repo = require('../repositories/orderRepo'); const { cancelOrder } = require('../services/order.service'); test('cannot cancel a shipped order', async () => { repo.findById.mockResolvedValue({ id: 1, status: 'shipped' }); await expect(cancelOrder(1)).rejects.toThrow('Cannot cancel'); expect(repo.update).not.toHaveBeenCalled(); }); // For HTTP calls, nock or msw can intercept requests.
78

What is the built-in node:test runner and when would you use it over Jest?

Testing and DebuggingMedium
Save to ▾
Show answer
Node.js ships a stable test runner in the node:test module with describe, it, mocks, coverage and watch mode, run with node --test. It needs no extra dependency and works natively with ES modules, which Jest still handles with extra configuration. Jest or Vitest offer richer snapshot testing, mocking and ecosystem. For small libraries or ESM-first services, node:test is a lightweight choice.
79

How do you run integration tests against a real database in CI?

Testing and DebuggingMedium
Save to ▾
Show answer
Start a disposable database for the test run, using Docker Compose services in CI, Testcontainers from the test code, or mongodb-memory-server for MongoDB. Run migrations before tests, seed minimal data per test, and clean tables between tests or wrap each test in a rolled-back transaction. Use a separate DATABASE_URL so tests can never touch production data.
80

A test passes locally but fails randomly in CI. How do you approach this flaky test?

Testing and DebuggingMedium
Save to ▾
Show answer
Run it repeatedly to reproduce, then look for shared state between tests, missing awaits, reliance on test order, real timers, current date or time zones, random data and network calls. Fix by isolating data per test, using fake timers, freezing dates, mocking external calls and awaiting all promises. Quarantine the test only temporarily with a ticket, never delete it silently.
81

How would you test code that depends on the current time, like an expiring coupon?

Testing and DebuggingMedium
Save to ▾
Show answer
Inject a clock function instead of calling Date.now directly, or use Jest fake timers: jest.useFakeTimers().setSystemTime(new Date('2026-01-01')). Then test before, exactly at and after expiry. Store dates in UTC and convert for display in IST, which avoids bugs near midnight. Reset timers after each test with jest.useRealTimers to avoid leaking into other tests.
82

Tell me about a production incident you handled and what you did after it.

Testing and DebuggingMedium
Save to ▾
Show answer
Situation: our payment callback endpoint started failing after a deploy on a Friday evening. Task: I was on call. Action: I checked error logs, saw a missing environment variable, rolled back within ten minutes, then added startup config validation and a post-deploy smoke test. Result: impact was limited to a few failed callbacks we replayed, and I wrote a blameless postmortem the team used to improve deploy checks.
83

Describe how you would mentor a junior developer who writes no tests.

Testing and DebuggingMedium
Save to ▾
Show answer
I would start by understanding why: lack of time, knowledge or examples. Then I pair with them on one feature, writing a test first for a real bug so they see the value. I share a small template for service and route tests, review their tests kindly in pull requests and celebrate when a test catches a regression. Over a few sprints, testing becomes a habit.
84

Write a Dockerfile for a production Node.js API.

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
FROM node:22-alpine AS deps WORKDIR /app COPY package*.json ./ RUN npm ci --omit=dev FROM node:22-alpine ENV NODE_ENV=production WORKDIR /app COPY --from=deps /app/node_modules ./node_modules COPY . . USER node EXPOSE 3000 HEALTHCHECK CMD wget -qO- http://localhost:3000/health || exit 1 CMD ["node", "src/server.js"]
85

How do you scale a Node.js application horizontally?

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
Run multiple stateless instances behind a load balancer and add more as load grows, using autoscaling on CPU, memory or request rate. Keep state out of the process: sessions in Redis, files in object storage, jobs in a queue. Use Redis adapters for WebSocket broadcasting across instances, and make sure the database can handle the total connection count.
86

Write a basic GitHub Actions workflow that tests and builds a Node.js app.

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
name: ci on: [push, pull_request] jobs: test: runs-on: ubuntu-latest services: mongo: image: mongo:7 ports: ['27017:27017'] steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: node-version: 22 cache: npm - run: npm ci - run: npm run lint - run: npm test -- --coverage env: MONGO_URL: mongodb://localhost:27017/test
87

What are health check endpoints and what is the difference between liveness and readiness?

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
Health endpoints let orchestrators check the app. Liveness answers whether the process is alive; if it fails, the container is restarted, so keep it simple. Readiness answers whether the instance can serve traffic, checking database and cache connections; if it fails, the load balancer stops sending requests but does not restart it. During shutdown, fail readiness first.
88

How do you use a message queue to process background jobs in Node.js?

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
const { Queue, Worker } = require('bullmq'); const connection = { host: 'redis', port: 6379 }; const emailQueue = new Queue('email', { connection }); await emailQueue.add('welcome', { userId }, { attempts: 5, backoff: { type: 'exponential', delay: 1000 }, jobId: `welcome:${userId}` }); new Worker('email', async (job) => { await sendWelcomeEmail(job.data.userId); }, { connection, concurrency: 10 });
89

How do you implement real-time features like live order tracking in Node.js?

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
Use WebSockets through Socket.IO or ws, or Server-Sent Events for one-way updates. Clients join a room per order, and when the rider location or status changes, the server emits to that room. With multiple instances, use the Socket.IO Redis adapter so events reach clients on any server, authenticate the socket on connect, and throttle location updates to save bandwidth.
90

What metrics would you monitor for a Node.js API in production?

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
Use the RED method for requests: rate, errors and duration with p50, p95 and p99. Add Node-specific metrics: event loop lag, heap used, garbage collection time and active handles, plus CPU, memory and restarts. Monitor dependencies such as database query time, pool usage and cache hit ratio. Export with prom-client or OpenTelemetry and alert on symptoms users feel.
91

Should you use serverless functions like AWS Lambda for a Node.js API?

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
Serverless suits spiky or low-traffic workloads, event processing and quick prototypes, since you pay per invocation and need no server management. Downsides are cold starts, execution time limits, connection handling with relational databases and harder local debugging. For steady high traffic or long-lived WebSocket connections, containers are usually cheaper and simpler. Many teams mix both.
92

How do you enable compression and why should you be careful with it?

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
Use the compression middleware or, better, let Nginx or the CDN compress responses with gzip or Brotli, which reduces JSON payload size by 70 percent or more. Be careful: compressing in Node uses CPU on the event loop, small responses gain little, and already compressed files like images should be skipped. Never compress responses mixing secrets with user input over HTTPS because of BREACH-style attacks.
93

How do you use the Node.js cluster module to use all CPU cores?

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
const cluster = require('cluster'); const os = require('os'); if (cluster.isPrimary) { for (let i = 0; i < os.availableParallelism(); i++) cluster.fork(); cluster.on('exit', (worker) => { console.log(`Worker ${worker.process.pid} died, restarting`); cluster.fork(); }); } else { require('./server'); // each worker listens on the same port } // In Kubernetes, prefer one process per container and more replicas.
94

What is an API gateway and what does it do in a Node.js microservice setup?

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
An API gateway is a single entry point in front of services. It routes requests, terminates TLS, validates tokens, applies rate limits, handles CORS, aggregates responses and collects logs and metrics. Examples are Kong, AWS API Gateway, Nginx and Envoy-based gateways. It keeps cross-cutting concerns out of each service, but must be highly available so it does not become a single point of failure.
95

Tell me about a time you had to balance speed of delivery with technical quality.

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
Situation: sales needed a partner API in one week for a client launch. Task: deliver fast without creating a mess. Action: I agreed with my manager to ship the core endpoints with validation, auth and tests, and to defer caching and admin tooling, logging them as tickets with dates. Result: the partner went live on time, and we completed the deferred work in the next sprint as planned.
96

How do you prioritise when multiple teams ask you for backend changes at the same time?

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
I list the requests with their business impact, deadlines and effort, then discuss priority with my manager or product owner rather than deciding alone. I communicate clear timelines to each team, look for shared solutions such as one generic endpoint serving two needs, and protect time for urgent production issues. This keeps expectations realistic and avoids half-finished work.
97

How do you prepare a Node.js app for production readiness review?

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
I check that config is validated, secrets are in a secret store, and logs are structured with request IDs. Health and readiness endpoints exist, graceful shutdown works, timeouts and retries are set on outbound calls, and rate limiting and helmet are enabled. Dashboards, alerts and runbooks are ready, load tests pass targets, backups are verified and a rollback plan is documented.

Frequently asked questions

Who should practise medium Full Stack with Node.js questions?

Anyone with some hands-on practice: most real interview time is spent on medium questions like these.

How should I practise these?

Answer each question aloud before opening the answer, mark it as solved only when your answer matches the key idea, and save misses to Last-Minute Revision.

Other difficulty levels

Easy questionsHard questions

More ways to practise

Company-wise Full Stack with Node.js questionsExperience-wise Full Stack with Node.js questionsRole-wise Full Stack with Node.js questionsCity-wise Full Stack with Node.js questionsMost asked Full Stack with Node.js questionsScenario-based questionsPractical / hands-on questionsHR & behavioural questionsFull Stack with Node.js mock interviewOnline assessment questionsTechnical round questionsManagerial round questionsFull Stack with Node.js topic sheets