Thoughtworks Full Stack with Node.js Interview Questions & Answers
Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About Thoughtworks hiring for Full Stack with Node.js roles
Thoughtworks is a global technology consultancy known for agile software delivery, continuous delivery and its Technology Radar publication. It works on custom software, data platforms and digital transformation for enterprise clients. In India it hires for developers, quality analysts, data engineers and data scientists. Teams usually work closely with client engineers.
For Full Stack with Node.js roles, this Thoughtworks practice set focuses most on Asynchronous JavaScript (7), Deployment, Scaling and Performance (6), Authentication and Security (4), Node.js Core and Event Loop (3). It has 4 easy, 23 medium, 3 hard questions, so you can start easy and work up to the harder ones.
Company type
Consulting
Headquarters
Chicago, Illinois, USA
Main India offices
Pune, Bengaluru, Chennai, Gurugram, Hyderabad
Thoughtworks Full Stack with Node.js interview process
Online coding assessment
Code pairing round
Technical interview
Cultural fit or social change round
Leadership round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for ThoughtworksStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
What is the difference between process.nextTick and setImmediate?
process.nextTick queues a callback to run immediately after the current operation, before the event loop continues to any phase, even before promise microtasks. setImmediate queues a callback for the check phase of the next loop iteration. Overusing nextTick recursively can starve I/O because the loop never moves on, so setImmediate is safer for deferring heavy work.
02
How would you test code that depends on the current time, like an expiring coupon?
Inject a clock function instead of calling Date.now directly, or use Jest fake timers: jest.useFakeTimers().setSystemTime(new Date('2026-01-01')). Then test before, exactly at and after expiry. Store dates in UTC and convert for display in IST, which avoids bugs near midnight. Reset timers after each test with jest.useRealTimers to avoid leaking into other tests.
03
How do you scale a Node.js application horizontally?
Run multiple stateless instances behind a load balancer and add more as load grows, using autoscaling on CPU, memory or request rate. Keep state out of the process: sessions in Redis, files in object storage, jobs in a queue. Use Redis adapters for WebSocket broadcasting across instances, and make sure the database can handle the total connection count.
04
How do you design a consistent error response format for an API?
Use one structure everywhere, for example { "error": { "code": "VALIDATION_FAILED", "message": "Email is invalid", "details": [{ "field": "email" }], "requestId": "abc123" } }. Many teams follow RFC 9457 Problem Details with type, title, status and detail. Use machine-readable codes for clients, human messages for display, and never leak stack traces or SQL errors.
05
Tell me about a time you found a security issue in code and how you handled it.
Situation: during code review I noticed an admin export route that only hid the button in the frontend. Task: make sure no regular user could call it. Action: I reproduced it with a normal user token, reported it privately to my lead, added role middleware and tests, and checked similar routes. Result: we fixed four endpoints before release and added an authorisation checklist to pull requests.
06
Implement the cache-aside pattern with Redis for a product lookup.
Log both with full stack traces and context, then exit the process after flushing logs, because state may be corrupted. A process manager like PM2, systemd or Kubernetes restarts it. Never use uncaughtException to keep running as if nothing happened. Since Node 15, unhandled rejections crash the process by default, so every promise chain should have proper error handling.
08
Should you use serverless functions like AWS Lambda for a Node.js API?
Serverless suits spiky or low-traffic workloads, event processing and quick prototypes, since you pay per invocation and need no server management. Downsides are cold starts, execution time limits, connection handling with relational databases and harder local debugging. For steady high traffic or long-lived WebSocket connections, containers are usually cheaper and simpler. Many teams mix both.
Create a factory: const authorize = (...roles) => (req, res, next) => roles.includes(req.user?.role) ? next() : res.status(403).json({ error: 'Forbidden' }). Use it after authentication, for example router.delete('/:id', authenticate, authorize('admin'), handler). Keep roles and permissions in config or the database, and for complex rules move to permission-based checks or a policy library.
Define targets from expected traffic, such as 5,000 requests per second with p95 under 300 ms. Write realistic scenarios in k6 or Artillery covering browse, cart and checkout, run them against a production-like environment, and ramp up gradually. Watch latency, error rates, CPU, memory, event loop lag and database metrics, then fix bottlenecks and rerun until targets are met with headroom.
14
Two simultaneous requests both read a wallet balance, deduct money and save it, causing a wrong balance. How do you fix this race condition?
Async code interleaves between awaits, so read-modify-write is unsafe. Make the update atomic in the database: use an UPDATE with balance = balance - amount WHERE balance >= amount, or MongoDB $inc with a filter. Alternatives are row-level locks with SELECT FOR UPDATE inside a transaction, optimistic locking with a version column, or a Redis distributed lock for cross-service work.
EventEmitter from the events module implements the publish-subscribe pattern. Objects register listeners with on or once and trigger them with emit. Streams, HTTP servers and sockets all extend it. Always handle the 'error' event, because an emitted error without a listener crashes the process. Watch for memory leaks when listeners are added repeatedly; Node warns after 10 listeners by default.
16
What is the difference between throwing an error and rejecting a promise inside an async function?
Inside an async function they behave the same: throw new Error() causes the returned promise to reject with that error. Outside async functions, a throw inside a plain callback such as setTimeout is not caught by promise handlers and becomes an uncaught exception. Always reject with Error objects, not strings, so you keep a stack trace.
17
What is the built-in node:test runner and when would you use it over Jest?
Node.js ships a stable test runner in the node:test module with describe, it, mocks, coverage and watch mode, run with node --test. It needs no extra dependency and works natively with ES modules, which Jest still handles with extra configuration. Jest or Vitest offer richer snapshot testing, mocking and ecosystem. For small libraries or ESM-first services, node:test is a lightweight choice.
18
How do you use the Node.js cluster module to use all CPU cores?
const cluster = require('cluster');
const os = require('os');
if (cluster.isPrimary) {
for (let i = 0; i < os.availableParallelism(); i++) cluster.fork();
cluster.on('exit', (worker) => {
console.log(`Worker ${worker.process.pid} died, restarting`);
cluster.fork();
});
} else {
require('./server'); // each worker listens on the same port
}
// In Kubernetes, prefer one process per container and more replicas.
19
Write a basic GitHub Actions workflow that tests and builds a Node.js app.
// routes/users.js
const router = require('express').Router();
router.get('/', listUsers);
router.get('/:id', getUser);
router.post('/', auth, createUser);
module.exports = router;
// app.js
app.use(express.json());
app.use('/api/v1/users', require('./routes/users'));
// Keeps each resource in its own module with its own middleware.
21
What causes the error 'Cannot set headers after they are sent to the client'?
It happens when code tries to send a second response for the same request, for example calling res.json in a callback and then again later, or forgetting return after sending an error response, or calling next() after responding. Fix it by returning immediately after each res.send or res.json, and making sure each code path sends exactly one response.
22
What is NoSQL injection in MongoDB and how do you prevent it?
If you pass req.body directly into a query, an attacker can send { "password": { "$ne": null } } and bypass checks. Prevent it by validating and casting input types with zod or Joi, rejecting objects where strings are expected, enabling Mongoose strictQuery and sanitizeFilter, and never building queries from raw user objects. Avoid $where and server-side JavaScript evaluation.
23
What is an API gateway and what does it do in a Node.js microservice setup?
An API gateway is a single entry point in front of services. It routes requests, terminates TLS, validates tokens, applies rate limits, handles CORS, aggregates responses and collects logs and metrics. Examples are Kong, AWS API Gateway, Nginx and Envoy-based gateways. It keeps cross-cutting concerns out of each service, but must be highly available so it does not become a single point of failure.
24
What is the OWASP Top 10 and which items matter most for Node.js APIs?
The OWASP Top 10 lists the most critical web application security risks. For Node APIs the most relevant are broken access control, injection, cryptographic failures, security misconfiguration, vulnerable and outdated components, authentication failures and server-side request forgery. OWASP also publishes an API Security Top 10, which highlights broken object level authorisation, where users access others' data by changing an ID.
25
How do you prepare a Node.js app for production readiness review?
I check that config is validated, secrets are in a secret store, and logs are structured with request IDs. Health and readiness endpoints exist, graceful shutdown works, timeouts and retries are set on outbound calls, and rate limiting and helmet are enabled. Dashboards, alerts and runbooks are ready, load tests pass targets, backups are verified and a rollback plan is documented.
26
Explain debounce and throttle and where they matter on the backend.
Debounce runs a function only after calls stop for a set time, merging bursts into one call. Throttle runs it at most once per interval. On the backend they help when batching cache invalidation, limiting webhook processing, writing metrics, or reacting to file watcher events. For API traffic you normally use a rate limiter instead, which is a server-side form of throttling.
27
How can you cancel an in-flight HTTP request in Node.js?
Use AbortController. Create a controller, pass controller.signal to fetch or to libraries that support it such as axios, and call controller.abort() when the request is no longer needed, for example when the client disconnects. AbortSignal.timeout(ms) gives a ready-made timeout signal. Aborting rejects the promise with an AbortError, which you should handle separately from real failures.
28
Tell me about a time you had to debug a tricky asynchronous bug.
Situation: customers occasionally received two invoices. Task: I had to find why it happened only in production. Action: I added request IDs to logs and found a forEach with async callbacks plus a retry triggering a second save before the first finished. I replaced it with for...of, added a unique index on invoice number and made the job idempotent. Result: duplicates stopped completely.
Normalisation organises tables to remove duplicate data and update anomalies, typically up to third normal form, for example keeping customers and orders in separate tables linked by foreign keys. You denormalise for read performance, such as storing a product name on an order line or a precomputed order count on a user, when joins become expensive. Denormalised data must be kept in sync.
Tips to crack the Thoughtworks Full Stack with Node.js interview
Practise pair programming with test-driven development, since Thoughtworks interviews often include coding together with an interviewer.
Read the latest Thoughtworks Technology Radar and form opinions on a few tools or techniques it lists.
Prepare to discuss social and economic justice values, which Thoughtworks openly includes in its culture discussions.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; Thoughtworks interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the Thoughtworks Full Stack with Node.js interview?
Candidates usually go through 5 stages: Online coding assessment; Code pairing round; Technical interview; Cultural fit or social change round; Leadership round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the Thoughtworks Full Stack with Node.js interview?
This practice set leans on Asynchronous JavaScript (7), Deployment, Scaling and Performance (6), Authentication and Security (4), Node.js Core and Event Loop (3). Revise those first, then practise explaining one or two of your own projects end to end, because most Thoughtworks interviewers ask you to walk through real work.
Are these the exact questions asked at Thoughtworks?
No. These are curated practice questions that match the skills and difficulty usually tested in consulting interviews like Thoughtworks's. They are not a leaked or verified list of past questions.
Where does Thoughtworks hire Full Stack with Node.js professionals in India?
Thoughtworks has large teams in Pune, Bengaluru, Chennai, Gurugram, Hyderabad. Openings and locations change often, so check the Thoughtworks careers page and filter by city and experience.
Full Stack with Node.js questions for similar companies