‹ Back to previous section Course home All page URLs

Full Stack with Node.js Managerial Round Questions & Answers

35 questions for the managerial round stage — 18 medium, 17 hard.

About the managerial round round

The managerial round is usually with a hiring manager or team lead. It mixes real-work scenarios, prioritisation and stakeholder questions with behavioural questions about ownership, conflict and learning.

Tips for the managerial round round

Use the STAR format for every story: Situation, Task, Action, Result.
Show trade-offs: what you chose, what you gave up and why.
Be honest about mistakes and focus on what you changed afterwards.
Ask the manager about team goals and how success is measured in the role.

Solved — managerial roundStart practicing

3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.

3 questions free Unlock the rest in seconds

How would you test code that depends on the current time, like an expiring coupon?

Testing and DebuggingMedium

Show answer

Inject a clock function instead of calling Date.now directly, or use Jest fake timers: jest.useFakeTimers().setSystemTime(new Date('2026-01-01')). Then test before, exactly at and after expiry. Store dates in UTC and convert for display in IST, which avoids bugs near midnight. Reset timers after each test with jest.useRealTimers to avoid leaking into other tests.

How do you add a timeout to a promise?

Asynchronous JavaScriptMedium

Show answer

function withTimeout(promise, ms) { let timer; const timeout = new Promise((_, reject) => { timer = setTimeout(() => reject(new Error('Timeout')), ms); }); return Promise.race([promise, timeout]).finally(() => clearTimeout(timer)); } await withTimeout(fetch(url), 3000); // For fetch, AbortSignal.timeout(3000) also cancels the request.

How would you add OTP-based login for an Indian mobile app?

Authentication and SecurityMedium

Show answer

Generate a random 6-digit OTP with crypto.randomInt, store only its hash in Redis with a 5-minute TTL and an attempt counter, and send it through an SMS provider on a DLT-registered template. Verify with a timing-safe compare, limit to about 3 to 5 attempts and rate limit sends per number and IP. On success, issue access and refresh tokens and delete the OTP.

How would you design an API for a long-running task such as exporting a 1 GB report?

REST API DesignHard

Show answer

Do not keep the HTTP request open. POST /exports creates a job, pushes it to a queue and returns 202 Accepted with a job ID and status URL. Clients poll GET /exports/:id or receive a webhook or WebSocket event. A worker generates the file, uploads it to object storage, and the status endpoint returns a short-lived signed download URL.

Tell me about a time you found a security issue in code and how you handled it.

Authentication and SecurityMedium

Show answer

Situation: during code review I noticed an admin export route that only hid the button in the frontend. Task: make sure no regular user could call it. Action: I reproduced it with a normal user token, reported it privately to my lead, added role middleware and tests, and checked similar routes. Result: we fixed four endpoints before release and added an authorisation checklist to pull requests.

What is the N+1 query problem and how do you fix it?

Databases: MongoDB, SQL and RedisMedium

Show answer

N+1 happens when you run one query to fetch a list and then one extra query per item, for example loading 100 posts and then each author separately, causing 101 queries. Fix it with joins or eager loading in SQL ORMs like include in Prisma or Sequelize, populate or $lookup in MongoDB, batching with an IN query, or DataLoader in GraphQL.

After a Node.js version upgrade, a few integration tests fail with date and crypto differences. How do you handle the upgrade safely?

Testing and DebuggingHard

Show answer

Read the release notes and changelog for breaking changes, such as deprecated APIs, OpenSSL updates or changed default behaviour. Run the full test suite on the new version in a CI matrix alongside the old one, fix failures one by one and check native modules rebuild correctly. Roll out to staging, then to a canary in production while watching error rates before upgrading all services.

How would you handle uncaughtException and unhandledRejection in production?

Node.js Core and Event LoopMedium

Show answer

Log both with full stack traces and context, then exit the process after flushing logs, because state may be corrupted. A process manager like PM2, systemd or Kubernetes restarts it. Never use uncaughtException to keep running as if nothing happened. Since Node 15, unhandled rejections crash the process by default, so every promise chain should have proper error handling.

What is HATEOAS and is it used in real projects?

REST API DesignHard

Show answer

HATEOAS, Hypermedia as the Engine of Application State, means responses include links telling the client what it can do next, for example an order response with links to cancel or pay. It makes APIs more discoverable and decoupled. In practice most JSON APIs only partly use it, such as pagination links, because clients are usually built against documented endpoints.

How would you design authentication for a system of ten microservices?

Authentication and SecurityHard

Show answer

Centralise login in an identity service or provider such as Keycloak, Auth0 or Cognito that issues short-lived JWTs signed with RS256. The API gateway validates tokens, and each service verifies the signature using the public keys from a JWKS endpoint, so no shared secret is needed. Use service-to-service tokens or mTLS for internal calls and keep authorisation checks inside each service.

Tell me about a time you had to balance speed of delivery with technical quality.

Deployment, Scaling and PerformanceMedium

Show answer

Situation: sales needed a partner API in one week for a client launch. Task: deliver fast without creating a mess. Action: I agreed with my manager to ship the core endpoints with validation, auth and tests, and to defer caching and admin tooling, logging them as tickets with dates. Result: the partner went live on time, and we completed the deferred work in the next sprint as planned.

Describe a situation where you found and fixed a production performance problem.

Node.js Core and Event LoopMedium

Show answer

Situation: our search API p95 latency jumped from 200 ms to 2 seconds after a release. Task: as on-call engineer I had to find the cause fast. Action: I checked APM traces, saw a new synchronous JSON transform blocking the event loop, moved it to a cached precomputed field and added an event loop lag alert. Result: latency returned to normal within a day and we added a performance check to code review.

Production shows intermittent 502 errors from the load balancer but your app logs show nothing. How do you investigate?

Testing and DebuggingHard

Show answer

A 502 means the load balancer got a bad or no response from the app. Check whether pods restarted or crashed through OOM kills, health check failures and deployment times. A common Node cause is keep-alive mismatch: set server.keepAliveTimeout higher than the load balancer idle timeout and headersTimeout above that. Also check event loop blocking and connection limits.

How do you design an API that needs to handle 50,000 requests per second for reading product details?

Deployment, Scaling and PerformanceHard

Show answer

Make the read path cache-heavy: CDN caching for public product pages, Redis cache for product details with high hit ratio, and database read replicas behind it. Run many stateless Node instances with autoscaling, keep responses small and compressed, and use keep-alive connections. Avoid cache stampedes with request coalescing or locks, and precompute data that is expensive to build.

Explain OAuth 2.0 and the Authorization Code flow with PKCE.

Authentication and SecurityHard

Show answer

OAuth 2.0 lets an app access resources on a user's behalf without seeing their password, for example social login with an existing account. In Authorization Code with PKCE, the app creates a code verifier and sends its hash to the authorisation server. The user logs in and consents, the app receives a code and exchanges it plus the verifier for tokens. PKCE stops intercepted codes being reused.

Your JWT secret has leaked. What steps do you take?

Authentication and SecurityHard

Show answer

Treat it as an incident. Generate a new secret and deploy it immediately, which invalidates all existing tokens and forces re-login. Revoke refresh tokens in the database, check logs for suspicious tokens or admin actions, and find how it leaked, for example a committed .env or logs. Move to a secrets manager, consider asymmetric RS256 keys with key IDs to rotate safely, and document the incident.

Write a basic GitHub Actions workflow that tests and builds a Node.js app.

Deployment, Scaling and PerformanceMedium

Show answer

name: ci on: [push, pull_request] jobs: test: runs-on: ubuntu-latest services: mongo: image: mongo:7 ports: ['27017:27017'] steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: node-version: 22 cache: npm - run: npm ci - run: npm run lint - run: npm test -- --coverage env: MONGO_URL: mongodb://localhost:27017/test

How do you serve a React build and an API from the same Express server?

Express.js FrameworkMedium

Show answer

const path = require('path'); app.use('/api', apiRouter); app.use(express.static(path.join(__dirname, 'client/dist'), { maxAge: '1y' })); // SPA fallback for client-side routes app.get(/^\/(?!api).*/, (req, res) => { res.sendFile(path.join(__dirname, 'client/dist/index.html')); }); // Register API routes first so they are not caught by the fallback.

How do you implement and secure webhooks that your API sends to customers?

REST API DesignHard

Show answer

Send a POST with a JSON event, a unique event ID and timestamp. Sign the body with HMAC-SHA256 using a per-customer secret and include it in a header, so receivers verify authenticity and reject old timestamps to stop replays. Retry failures with exponential backoff, log delivery attempts and make events idempotent so receivers can safely handle duplicates.

After adding a new middleware, all routes return 404 or hang. How do you debug it?

Express.js FrameworkMedium

Show answer

A hang usually means the middleware never calls next() or sends a response on some path. A 404 often means it was mounted with a wrong path or registered after routes. I check order of app.use calls, add logging at the start and end of the middleware, verify every branch calls next or responds, and check async code passes errors to next.

An API listing orders became slow after the table reached 50 million rows. How do you investigate?

Databases: MongoDB, SQL and RedisHard

Show answer

Run EXPLAIN ANALYZE on the slow query to see whether it does a sequential scan or a costly sort. Add a composite index matching the filter and sort, for example (user_id, created_at DESC). Replace OFFSET pagination with cursor pagination, select only needed columns, and consider partitioning by date and archiving old rows. Monitor slow query logs after the change.

A regex in your validation code makes the server hang on certain inputs. What is the issue?

Testing and DebuggingHard

Show answer

This is likely ReDoS, regular expression denial of service. Patterns with nested quantifiers such as (a+)+ can backtrack exponentially on crafted input, blocking the event loop. Fix by simplifying the regex, limiting input length before matching, using well-tested validators like validator.js, or a linear-time engine such as re2. Add tests with long malicious strings.

What are the common strategies for API versioning?

REST API DesignMedium

Show answer

URL versioning like /api/v1/orders is the most common and easy to route and cache. Header versioning uses a custom header or Accept media type, keeping URLs clean but less visible. Query versioning like ?version=2 is simple but messy. Whatever you choose, version only for breaking changes, support old versions for a deprecation period and announce sunset dates.

How do you prevent a cache stampede when a popular key expires?

Deployment, Scaling and PerformanceHard

Show answer

When a hot key expires, thousands of requests may hit the database at once. Solutions: allow only one request to rebuild the cache using a short Redis lock while others wait or serve stale data, refresh hot keys in the background before expiry, add random jitter to TTLs so keys do not expire together, and use stale-while-revalidate where slightly old data is acceptable.

Memory usage of a Node.js service grows steadily until the pod restarts. How would you find the leak?

Node.js Core and Event LoopHard

Show answer

First confirm with metrics that heap used keeps rising under steady traffic. Take heap snapshots with --inspect and Chrome DevTools or heapdump at intervals and compare them to find objects whose count keeps growing. Common causes are global caches without limits, event listeners added per request, closures holding large objects and unclosed timers. Fix, then load test with autocannon to verify heap stabilises.

Your API's p99 latency is high during peak hours even though CPU is only 40 percent. What could be wrong?

Deployment, Scaling and PerformanceHard

Show answer

Low CPU with high latency suggests waiting, not computing. Check database query times and connection pool wait, slow downstream APIs, Redis latency, DNS lookups without keep-alive agents, garbage collection pauses and event loop lag from occasional heavy requests. Use distributed tracing with OpenTelemetry to see where time goes, then add indexes, caching, timeouts or more pool connections.

Tell me about a time you had to debug a tricky asynchronous bug.

Asynchronous JavaScriptMedium

Show answer

Situation: customers occasionally received two invoices. Task: I had to find why it happened only in production. Action: I added request IDs to logs and found a forEach with async callbacks plus a retry triggering a second save before the first finished. I replaced it with for...of, added a unique index on invoice number and made the job idempotent. Result: duplicates stopped completely.

Describe a time you led a technical decision that affected the whole team.

Deployment, Scaling and PerformanceHard

Show answer

Situation: our five Node services used different logging and error formats, making incidents slow to debug. Task: as tech lead I wanted one standard. Action: I wrote a short RFC comparing options, built a shared package with pino, request IDs and an error handler, collected feedback and migrated one service as a pilot. Result: all services adopted it within a month and mean time to resolve incidents fell noticeably.

Your Express API needs to support multiple client apps with different rate limits. How would you design it?

Express.js FrameworkHard

Show answer

Identify the client through an API key or OAuth client ID in authentication middleware and attach the plan to req. Then use express-rate-limit or a custom limiter with a Redis store, keyed by client ID, with limits read from the plan. Return 429 with Retry-After and RateLimit headers. Redis keeps limits consistent across multiple server instances.

Is Node.js single-threaded? Explain the role of libuv.

Node.js Core and Event LoopMedium

Show answer

Your JavaScript runs on a single main thread, but Node.js itself is not purely single-threaded. libuv, the C library under Node, provides the event loop and a thread pool (default 4 threads, set with UV_THREADPOOL_SIZE) used for file system work, DNS lookups, crypto and zlib. Network I/O uses OS async mechanisms like epoll or IOCP instead of threads.

How do you design Express middleware that checks user roles for a route?

Express.js FrameworkMedium

Show answer

Create a factory: const authorize = (...roles) => (req, res, next) => roles.includes(req.user?.role) ? next() : res.status(403).json({ error: 'Forbidden' }). Use it after authentication, for example router.delete('/:id', authenticate, authorize('admin'), handler). Keep roles and permissions in config or the database, and for complex rules move to permission-based checks or a policy library.

How do you handle a breaking API change request from a product manager close to a release?

REST API DesignMedium

Show answer

I would first understand why it is needed and who consumes the API. Then I explain the impact on existing clients, propose a non-breaking path such as adding a new field or a v2 endpoint, and estimate effort and risk. Result in a past case: we shipped the additive change on time and scheduled removal of the old field for the next quarter.

Tell me about a production incident you handled and what you did after it.

Testing and DebuggingMedium

Show answer

Situation: our payment callback endpoint started failing after a deploy on a Friday evening. Task: I was on call. Action: I checked error logs, saw a missing environment variable, rolled back within ten minutes, then added startup config validation and a post-deploy smoke test. Result: impact was limited to a few failed callbacks we replayed, and I wrote a blameless postmortem the team used to improve deploy checks.

A dashboard endpoint makes five independent database queries one after another and takes 1.5 seconds. How would you speed it up?

Asynchronous JavaScriptMedium

Show answer

Because the queries are independent, run them concurrently with Promise.all so total time is close to the slowest query instead of the sum. Check that the database connection pool is large enough to serve them in parallel. Then add indexes for slow queries, cache rarely changing parts in Redis, and use Promise.allSettled if the page can render with some widgets missing.

Your service calls three microservices and fails completely if one is down. How would you make it more resilient?

Asynchronous JavaScriptHard

Show answer

Use Promise.allSettled so one failure does not reject everything, and return partial data with clear flags. Add timeouts to every call, retries with backoff for transient errors and a circuit breaker such as opossum to stop hammering a failing service. Provide fallbacks like cached values and log failures with correlation IDs so the issue can be traced.

Frequently asked questions

What happens in the Full Stack with Node.js managerial round round?

How do I clear the managerial round round?

Use the STAR format for every story: Situation, Task, Action, Result. Show trade-offs: what you chose, what you gave up and why. Be honest about mistakes and focus on what you changed afterwards.

Which round comes next?

A typical order is online assessment, telephonic screening, one or two technical rounds, a managerial round and HR. Use the other round pages to practise each stage.

Practise every interview round

Online Assessment questions Telephonic Interview questions Technical Round questions Rapid-Fire questions HR & behavioural questions Full mock interview

More ways to practise

Company-wise Full Stack with Node.js questions Experience-wise Full Stack with Node.js questions Role-wise Full Stack with Node.js questions City-wise Full Stack with Node.js questions Most asked Full Stack with Node.js questions Scenario-based questions Practical / hands-on questions HR & behavioural questions Full Stack with Node.js mock interview Online assessment questions Technical round questions Managerial round questions Full Stack with Node.js topic sheets