Nagarro Full Stack with Node.js Interview Questions & Answers
Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About Nagarro hiring for Full Stack with Node.js roles
Nagarro is a digital engineering and technology consulting company with a large workforce in India. It works on custom software, digital product engineering, testing, cloud and data projects for clients in Europe, North America and other regions. In India it hires for software engineers, test engineers and data professionals.
For Full Stack with Node.js roles, this Nagarro practice set focuses most on Authentication and Security (7), Asynchronous JavaScript (4), Databases: MongoDB, SQL and Redis (4), Deployment, Scaling and Performance (4). It has 11 easy, 19 medium questions, so you can start easy and work up to the harder ones.
Company type
IT services
Headquarters
Munich, Germany
Main India offices
Gurugram, Jaipur
Nagarro Full Stack with Node.js interview process
Online assessment (aptitude + reasoning)
Coding test
Technical interview
Managerial or HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for NagarroStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
Design endpoints for a simple e-commerce cart and checkout.
GET /api/v1/cart returns the current user's cart. POST /api/v1/cart/items adds an item with productId and quantity. PATCH /api/v1/cart/items/:itemId changes quantity, and DELETE removes it. POST /api/v1/orders creates an order from the cart with an Idempotency-Key header. GET /api/v1/orders/:id shows status, and POST /api/v1/orders/:id/cancel handles cancellation as an action.
A Promise is an object representing the eventual result of an asynchronous operation. It has three states: pending, fulfilled with a value, or rejected with a reason. Once settled it never changes. You consume it with then, catch and finally, or with await. Promises chain, so returning a value or promise from then passes it to the next step.
03
Where should a web app store tokens: localStorage or cookies?
localStorage is readable by any JavaScript on the page, so an XSS bug can steal tokens. HttpOnly, Secure, SameSite cookies cannot be read by JavaScript, which is safer for refresh tokens and session IDs. Cookies require CSRF protection, which SameSite=Lax or Strict plus CSRF tokens provide. A common pattern keeps the access token in memory and the refresh token in an HttpOnly cookie.
04
What is a closure and how is it used in Node.js code?
A closure is a function that remembers variables from the scope where it was created, even after that outer function has returned. In Node it is used for middleware factories like rateLimit({ max: 100 }), private counters, memoisation and module-level state. A risk is memory leaks when closures hold large objects longer than needed, for example inside long-lived event listeners.
05
Write a simple custom EventEmitter usage for an order service.
Choose Fastify when raw performance and built-in schema validation matter; it is faster than Express thanks to optimised routing and serialisation. Choose NestJS for large teams that want structure: modules, dependency injection, decorators and first-class TypeScript, similar to Spring or Angular. Express still suits small to medium services and teams that prefer flexibility and a huge middleware ecosystem.
07
What is the difference between OAuth 2.0 and OpenID Connect?
OAuth 2.0 is an authorisation framework that issues access tokens for calling APIs; it does not define who the user is. OpenID Connect is an identity layer on top of OAuth 2.0 that adds an ID token, a JWT with user identity claims, and a userinfo endpoint. For social or enterprise single sign-on you use OIDC; for API access delegation you use OAuth scopes.
08
Tell me about an API you designed that you are proud of.
Situation: our support team used spreadsheets to track refunds. Task: I designed a refund API used by the admin panel and payment service. Action: I wrote the OpenAPI spec first, reviewed it with frontend and finance, added idempotency keys, clear error codes and pagination, and wrote contract tests. Result: integration took two days instead of a week, and refund errors dropped sharply.
09
How do you run integration tests against a real database in CI?
Start a disposable database for the test run, using Docker Compose services in CI, Testcontainers from the test code, or mongodb-memory-server for MongoDB. Run migrations before tests, seed minimal data per test, and clean tables between tests or wrap each test in a rolled-back transaction. Use a separate DATABASE_URL so tests can never touch production data.
Browsers block cross-origin requests unless the server sends CORS headers. Use the cors package: app.use(cors({ origin: ['https://app.example.com'], credentials: true })). Avoid origin '*' with credentials, and restrict methods and headers you allow. CORS is a browser protection, not a security layer for your API, so you still need authentication and authorisation.
12
What is Redis and how is it used with Node.js backends?
Redis is an in-memory key-value store with data types like strings, hashes, lists, sets, sorted sets and streams. Node apps use it for caching database results, session storage, rate limiting counters, distributed locks, leaderboards, pub/sub between instances and job queues through BullMQ. Data lives in memory, so use TTLs and eviction policies and do not treat it as the only copy of important data.
13
How do you handle async errors in Express 4 routes?
const asyncHandler = (fn) => (req, res, next) =>
Promise.resolve(fn(req, res, next)).catch(next);
router.get('/:id', asyncHandler(async (req, res) => {
const user = await User.findById(req.params.id);
if (!user) throw new AppError('Not found', 404);
res.json(user);
}));
// Without this, a rejected promise is never sent to the error handler.
// Express 5 does this automatically.
14
How do you handle a situation where you cannot find the root cause of a bug before a deadline?
I inform my lead early with what I know, what I have ruled out and the risk. I propose a safe mitigation, such as a feature flag to disable the path or a rollback, and add extra logging to capture more data. In one case this let us release on time with the feature off, and the new logs revealed the cause two days later.
15
How do you implement graceful shutdown in a Node.js server?
Node.js is a JavaScript runtime built on the V8 engine that runs JavaScript outside the browser. It uses a single-threaded event loop with non-blocking I/O, so one process can handle thousands of concurrent connections cheaply. It is popular for APIs, real-time apps and microservices because teams can use one language across frontend and backend and reuse a huge npm ecosystem.
Options include virtual machines like EC2 with PM2 and Nginx, containers on Kubernetes such as EKS, AKS or GKE, managed container services like AWS ECS Fargate, Cloud Run or Azure Container Apps, platforms like Render or Railway, and serverless functions on AWS Lambda. Choice depends on traffic patterns, team skills, cost and need for control.
20
A Mongoose query returns large documents and the API is slow. What optimisations can you apply?
Use .select() to fetch only needed fields, and .lean() to return plain objects instead of full Mongoose documents, which cuts memory and CPU. Make sure the filter and sort use an index, checked with explain. Paginate results, avoid populating deep references, and cache frequently read data. For large exports, use a cursor with for await instead of loading everything.
21
What is NoSQL injection in MongoDB and how do you prevent it?
If you pass req.body directly into a query, an attacker can send { "password": { "$ne": null } } and bypass checks. Prevent it by validating and casting input types with zod or Joi, rejecting objects where strings are expected, enabling Mongoose strictQuery and sanitizeFilter, and never building queries from raw user objects. Avoid $where and server-side JavaScript evaluation.
The access token is short-lived, around 5 to 15 minutes, and sent with each API request. The refresh token is long-lived, stored securely in an HttpOnly cookie, and used only at a refresh endpoint to get a new access token. Rotate refresh tokens on every use and store their hashes server-side, so a stolen or reused token can be detected and the session revoked.
Macrotasks are scheduled work like setTimeout, setInterval, setImmediate and I/O callbacks, handled phase by phase by the event loop. Microtasks are promise reactions and queueMicrotask callbacks; they run right after the current synchronous code finishes and before the next macrotask. In Node, process.nextTick callbacks run even before promise microtasks. A long microtask chain can delay timers and I/O.
Use plural nouns for resources and let methods express the action: GET /users, POST /users, GET /users/42, PATCH /users/42. Nest only for clear ownership, like GET /users/42/orders, and avoid deep nesting. Use lowercase kebab-case, query parameters for filtering, sorting and pagination, and version the API, for example /api/v1. Avoid verbs like /getUsers.
PM2 is a process manager for Node.js on virtual machines. It keeps apps running and restarts them on crashes, runs cluster mode across CPU cores, supports zero-downtime reloads, log management and startup scripts. In Docker or Kubernetes you usually do not need PM2, because the orchestrator restarts containers and you scale with replicas, so you run node directly.
27
What is the output order of this code: console.log('A'); setTimeout(() => console.log('B'), 0); Promise.resolve().then(() => console.log('C')); console.log('D');
The output is A, D, C, B. Synchronous code runs first, printing A and D. Then the microtask queue is drained before the event loop moves to timers, so the promise callback prints C. Finally the timers phase runs the setTimeout callback and prints B. Microtasks always run before the next macrotask such as timers or I/O callbacks.
28
Tell me about a time you found a security issue in code and how you handled it.
Situation: during code review I noticed an admin export route that only hid the button in the frontend. Task: make sure no regular user could call it. Action: I reproduced it with a normal user token, reported it privately to my lead, added role middleware and tests, and checked similar routes. Result: we fixed four endpoints before release and added an authorisation checklist to pull requests.
29
Explain ACID properties of a database transaction.
Atomicity means all operations in a transaction succeed or none do. Consistency means the database moves from one valid state to another, respecting constraints. Isolation means concurrent transactions do not see each other's partial work, controlled by isolation levels. Durability means committed data survives crashes. Money transfers rely on ACID so a debit never happens without the matching credit.
30
What is an API gateway and what does it do in a Node.js microservice setup?
An API gateway is a single entry point in front of services. It routes requests, terminates TLS, validates tokens, applies rate limits, handles CORS, aggregates responses and collects logs and metrics. Examples are Kong, AWS API Gateway, Nginx and Envoy-based gateways. It keeps cross-cutting concerns out of each service, but must be highly available so it does not become a single point of failure.
Tips to crack the Nagarro Full Stack with Node.js interview
Practise coding questions along with logical reasoning, as Nagarro assessments usually combine both.
Learn about Nagarro's flat, entrepreneurial culture and its CARING values for behavioural answers.
Be ready to explain testing approaches and agile practices, since many projects follow agile delivery with distributed teams.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; Nagarro interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the Nagarro Full Stack with Node.js interview?
Candidates usually go through 4 stages: Online assessment (aptitude + reasoning); Coding test; Technical interview; Managerial or HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the Nagarro Full Stack with Node.js interview?
This practice set leans on Authentication and Security (7), Asynchronous JavaScript (4), Databases: MongoDB, SQL and Redis (4), Deployment, Scaling and Performance (4). Revise those first, then practise explaining one or two of your own projects end to end, because most Nagarro interviewers ask you to walk through real work.
Are these the exact questions asked at Nagarro?
No. These are curated practice questions that match the skills and difficulty usually tested in it services interviews like Nagarro's. They are not a leaked or verified list of past questions.
Where does Nagarro hire Full Stack with Node.js professionals in India?
Nagarro has large teams in Gurugram, Jaipur. Openings and locations change often, so check the Nagarro careers page and filter by city and experience.
Full Stack with Node.js questions for similar companies