This browser cannot save progress. You can continue here, but your answers may be lost when you leave.
A focused interview review
Interview tomorrow?
Choose your level and available time. A short diagnostic helps prioritize your review, followed by a fresh test.
- 01 · Diagnostic
- 02 · Focused review
- 03 · Final test
How does the review work?
- Answer 5 questions before reading explanations. Results prioritize topics; they are not a complete assessment of your level.
- Review the questions selected for your time budget. Say your answer before opening the model answer. Follow the full lesson for details and diagrams alongside the explanation.
- Start the final test, answer every question and select “Check answers”. Then read the explanations and return to the review where needed.
5 questions to find your priorities
Answer before reading explanations. You can change choices until you submit.
Your review plan
Check what you reviewed
Return to reviewBefore the interview
Prepare an introduction, a project example and a STAR story. For technical answers, explain the idea, walk through an example, then discuss trade-offs.
Review preparation and answering techniquesC# fundamentals & OOP
36.1What are the four pillars of OOP?Junior
Encapsulation hides internal state and exposes controlled behavior. Abstraction exposes what something does, not how. Inheritance lets a class reuse and extend a base class. Polymorphism lets the same call behave differently depending on the runtime type, through virtual methods or interfaces. In practice I prefer composition and interfaces over deep inheritance hierarchies.
Async & multithreading
36.2What is the difference between a Task and a Thread?Junior
A thread is an operating-system thread with its own stack, expensive to create. A Task is a higher-level representation of an asynchronous operation and its eventual result. work in tasks runs on pooled threads, and tasks don't hold a thread while waiting. Tasks also give you return values, exception propagation, cancellation and composition, so modern code uses tasks rather than raw threads.
ASP.NET Core & MVC
36.3What is middleware and how does next work?Junior
forms the processing pipeline. A component can inspect or change the request, call next to run downstream components, and do more work as the response unwinds. It can also short-circuit, for example by rejecting a request without calling next. Ordering therefore determines both what runs and what context is available. I place broad exception handling early enough to wrap the relevant components and authentication before authorization that needs the user identity.
SQL & databases
36.4Explain inner and outer joins using customers and orders.Junior
I use an inner join when I need only matching customers and orders. A left join retains all customers and fills order columns with when none match. A right join preserves all orders, while a full outer join retains unmatched rows from both sides. Multiple matching orders repeat the customer columns, which is expected. I am careful with right-side filters after a left join, because a WHERE predicate can remove the unmatched rows.
Security
36.5What is the difference between authentication and authorization?Junior
I use authentication to establish who is calling and authorization to decide what that identity may do. A valid login does not imply access to every order. In an I normally challenge missing or invalid credentials with 401 and reject insufficient permission with 403, while sometimes using 404 to avoid revealing resource existence. In I establish the principal before applying endpoint policies and perform ownership and tenant checks when the decision depends on a specific resource.
Entity Framework Core
36.6Why is DbContext a unit of work, and how long should it live?Junior
I treat as a short-lived unit of work because it tracks related entity changes and submits them through SaveChanges. In a web application it is commonly scoped to a request, while a background worker can create one per operation through a factory. I dispose it promptly and never share it across concurrent operations. Long-lived contexts accumulate state and stale entities, so I avoid using them as an application cache or singleton.
LINQ & collections
36.7What is the difference between Select and SelectMany?Junior
Select maps each input to one result. If I select an order's Lines property, the result is a sequence of line collections. SelectMany maps each input to a sequence and flattens those sequences, so I get all order lines together. An order with no lines contributes no elements. When I also need the order identifier, I use the result-selector overload to combine the outer order with each inner line.
SOLID & architecture
36.8How do you explain SOLID without just expanding the acronym?Junior
I explain as managing change and contracts. Single responsibility keeps unrelated reasons to change separate. Open/closed supports new variants through stable extension points. Liskov requires implementations to honor the behavior clients expect. Interface segregation gives clients focused capabilities. Dependency inversion keeps business policy independent of infrastructure details through suitable abstractions. I apply them where they reduce real coupling; I would not add interfaces and layers everywhere merely to make the code look compliant.
Testing
36.9How do unit, integration and E2E tests differ?Junior
I distinguish them by the boundary they exercise. A unit test checks a small behavior without infrastructure, an integration test checks components working together, and an test exercises a complete user journey. I use units for calculation rules, integration tests for persistence and wiring, and selected E2E tests for checkout. I choose the cheapest level that can actually detect the failure rather than copying every scenario into all three layers.
Coding problems, solved
36.10Find two numbers in an array that sum to a target. What is the complexity?Junior
I iterate once, keeping a dictionary from value to index. For each number I check whether the target minus that number is already in the dictionary; if so I return both indices, otherwise I store the current one. That's O(n) time and O(n) space, instead of O(n squared) for checking every pair. If the array is sorted, two pointers give O(n) time with constant space.
Behavioral & career
36.11Tell me about a time you disagreed with a teammate.Mid
During a checkout change, a teammate preferred introducing a separate service, while I was concerned about boundaries and delivery time. I was responsible for clarifying the trade-offs, so I asked what independent scaling we actually needed and compared both options in a short design note. We agreed to keep the change local with explicit module boundaries and a review point after measuring load. I documented the decision and supported the implementation, including parts where my teammate's approach improved the design.
C# fundamentals & OOP
36.12Interface vs abstract class: when would you use each?Junior
An interface defines a capability; a class can implement many, and an interface cannot declare instance fields. An abstract class is a partial base type: it can have instance state, constructors and shared implementation, but a class inherits only one. I default to interfaces for flexibility and testability, and use an abstract class when several types share code, like a base report that defines the export flow.
C# fundamentals & OOP
36.13What is the difference between a class and a struct?Junior
A class is a reference type: assignment copies a reference, so two variables can refer to the same object. A struct is a value type: assignment copies its value, including any reference fields, rather than deep-copying their objects. Storage depends on context and runtime optimization, not a universal stack-versus-heap rule. A class can inherit one base class; a struct cannot inherit another struct or class, but can implement interfaces. I consider structs for small, preferably values and measure copying and costs rather than treating a size guideline as a language limit.
Async & multithreading
36.14What is the difference between synchronous and asynchronous programming?Junior
Synchronous code blocks the thread until an operation completes. Asynchronous code starts the operation, releases the thread while waiting, and continues when the result arrives. In a web that lets the same thread pool handle many more concurrent requests during , so it improves and scalability rather than the speed of a single request.
Entity Framework Core
36.15How do eager, lazy and explicit loading differ?Junior
I use eager loading when I know I need related entities, expressing that through Include and ThenInclude. Lazy loading fetches a when accessed, which is convenient but can hide queries. Explicit loading deliberately loads a relationship through the context entry . For read endpoints I often prefer into a because it fetches only the required values. I choose based on the required shape and measured query behavior, not convenience alone.
SQL & databases
36.16What is the difference between WHERE and HAVING?Junior
I use WHERE to filter individual rows before grouping and HAVING to filter groups. For example, WHERE selects paid orders in a date range, and HAVING keeps customers whose total spending exceeds a threshold. I put conditions that do not need aggregates in WHERE when that matches the intended meaning. Logical processing also explains why a SELECT alias is normally unavailable in WHERE but can be used in ORDER BY.
Security
36.17How do you prevent SQL injection in .NET?Junior
I keep values separate from syntax using parameters, usually through or a parameterized command. If I use EF FromSql, I pass the interpolated expression directly so it remains parameterized instead of building a string for FromSqlRaw. Parameters cannot represent identifiers such as column names, so dynamic sorting uses a fixed allowlist. Input validation and a least-privileged database account add protection, but neither replaces correct parameterization.
HTTP & networking
36.18What happens when you type an HTTPS URL into a browser?Junior
I break it into stages. The browser parses the and checks relevant caches, resolves the hostname, establishes a connection if one cannot be reused, and negotiates for . It sends the request, receives headers and content, then parses resources and performs rendering. For -based HTTPS there is a TCP handshake before TLS; HTTP/3 uses instead. Caching and connection reuse can skip substantial parts of this sequence.
C# fundamentals & OOP
36.19How do you handle exceptions properly?Junior
I catch only specific exceptions I can actually handle, use filters when a condition matters, and release resources with using or finally. I never swallow exceptions silently, and I don't use them for expected outcomes like not-found or validation failures; those return results. Rethrows use throw;. In an , a global exception handler logs details and returns a ProblemDetails response without leaking internals.
Entity Framework Core
36.20When should you use AsNoTracking?Junior
I use AsNoTracking when I need entity results for reading but will not modify and save them through that context. It avoids persistent change-tracker bookkeeping. A pure scalar or already has no entities to track, but a projection containing an entity can still track it. If repeated keys in a read-only graph should share one object instance, I consider AsNoTrackingWithIdentityResolution. I measure memory and query behavior rather than assuming every no-tracking query must be faster.
Data structures & algorithms
36.21What does Big-O notation tell you?Junior
I use Big-O to describe how time or space grows with input size, ignoring constant factors and smaller terms. I define what each input size represents and state whether I mean worst-case, expected or amortized cost. A linear scan is O(n), binary search is O(log n), and comparing every pair is O(n squared). It does not predict seconds, so I still consider , cache behavior and and measure performance when practical differences matter.
Coding problems, solved
36.22How do you check whether a string has balanced brackets?Junior
With a stack: I push every opening bracket, and on a closing bracket the stack must be non-empty and its top must be the matching opener, which I pop. At the end the stack must be empty. That's O(n) time and space.
C# fundamentals & OOP
36.23What are nullable value types and nullable reference types?Junior
int? is a nullable value type, short for Nullable of int. Nullable reference types, enabled by default in new projects, make the compiler track nullability: string should never be null and string? may be, and you get warnings when dereferencing something that might be null. I treat those warnings as errors and handle nulls with ?., ?? and ??=, plus C# 14's null-conditional assignment.
SQL & databases
36.24Why normalize a relational model?Junior
I normalize to reduce update, insert and delete anomalies by storing each current fact with the key it depends on. First normal form removes repeating groups. Second normal form removes partial dependencies of non-prime attributes on candidate keys. Third normal form addresses non-key dependency problems, while requires every nontrivial determinant to be a . I balance the design with real constraints and workloads, and distinguish historical snapshots from accidental duplication.
C# fundamentals & OOP
36.25decimal vs double vs float: which one for money and why?Junior
For money I always use decimal. It's a base-10 type with 28 to 29 significant digits, so values like 0.1 are exact. float and double are binary floating point: fast and with a huge range, but 0.1 + 0.2 isn't exactly 0.3, which is unacceptable for currency. decimal is slower and uses 16 bytes, so scientific and graphics code uses double. The literal suffixes are m for decimal and f for float; an unsuffixed literal like 10.5 is a double.
Async & multithreading
36.26Why is async void dangerous?Junior
An async void method returns no Task that its caller can await or use to observe failure. Unhandled exceptions are dispatched through the captured SynchronizationContext or runtime handling; the caller cannot catch them by awaiting the call, and they may terminate the process depending on the environment and its exception handling. Reserve async void for event-handler signatures that require void. Prefer Task or another suitable awaitable return type for other asynchronous methods.
ASP.NET Core & MVC
36.27Explain MVC and the responsibility of a controller.Junior
I describe as separating the model's data and behavior, the view's presentation and the controller's request coordination. Routing selects an action, which binds input, calls application behavior and chooses a response. I keep business rules out of controllers so they can be tested and reused independently of . The model is not limited to an entity; a view model can contain exactly what a page needs without exposing persistence details.
Web APIs, REST & gRPC
36.28How do 401 and 403 differ?Junior
I return 401 when the request needs valid authentication credentials, for example because a bearer is missing or invalid, with the appropriate authentication challenge. I use 403 when authorization refuses the operation, usually after the caller has authenticated. For sensitive resources I may deliberately return 404 to avoid disclosing existence, following a consistent policy. In all cases I check access to the specific order, not just whether the caller has a valid token.
Caching & Redis
36.29What is cache-aside?Junior
I implement by checking the cache, loading the authoritative source on a miss, and storing a copy with a bounded lifetime. The application owns that flow and invalidates related entries after a committed write. It is a good fit for read-heavy data with tolerated staleness. However, concurrent misses can overload the source, and readers can repopulate old values around a write, so I also consider single-flight loading and a deliberate consistency policy.
Logging & observability
36.30What are logs, metrics and traces used for?Junior
I use metrics to understand behavior such as traffic, failure rate and , logs for detailed event context, and to follow a request across components. I connect them with service metadata and trace identity so I can move from a symptom to an affected request and its details. Each has a cost and limitation: metrics lose event detail, logs can become expensive, and sampled traces may not include every request. Together they support investigation rather than automatically proving a root cause.
Docker, CI/CD & Git
36.31What is CI/CD?Junior
I use continuous integration to build and test small changes frequently so integration problems surface early. Continuous delivery keeps passing artifacts ready for deployment, often with a production approval. Continuous deployment automatically deploys changes that pass the release gates. My pipeline produces a versioned artifact, verifies it in staging and promotes the same content to production. I separate environment configuration from the artifact and define rollback and observability before enabling automatic releases.
Behavioral & career
36.32What questions would you ask us?Junior
I would like to understand what success in the first three months would look like and which problem the new engineer should help solve first. I would also ask how the team reviews technical decisions and whether you can describe a recent trade-off. If time allows, I would ask about production ownership and how lessons from incidents become improvements. Those answers would help me understand the work, how I could contribute and whether the team's expectations match the role we have discussed.
How to prepare and pass the interview
36.33Tell me about yourself.Junior
I'm a backend engineer with several years of experience building web with , and Server. In my current role I own the order and payment services, and recently I cut the main page's response time by two thirds by fixing queries and adding caching. Before that I built internal reporting tools used daily by the finance team. I'm looking for a team working on larger systems where I can grow in architecture, which is why this role interested me.
AI in .NET: RAG, embeddings & MCP
36.34What are tokens and a context window?Junior
I treat as the model's text units rather than words. The tokenizer may split one word into several pieces, and languages tokenize differently. The context window limits how much information a call can consider, including instructions, history and retrieved evidence, with output limits depending on the model. I measure actual token usage, reserve space for the response and trim history deliberately. A larger window does not guarantee that every fact will be used correctly.
AI in .NET: RAG, embeddings & MCP
36.35What does MCP standardize?Junior
I describe as a protocol for connecting applications to external capabilities. A host uses clients to communicate with servers that can expose callable tools, readable resources and reusable prompt templates. Local servers often use stdio, while remote deployments can use Streamable . This makes integrations reusable across compatible hosts. MCP does not choose the model or automatically secure the application; I still need authentication, per-tool authorization, least privilege and clear handling of sensitive actions.
LINQ & collections
36.36Why are Dictionary and HashSet useful for repeated lookups?Junior
I use Dictionary for key-to-value lookup and HashSet for membership and uniqueness. Their usual lookup cost is constant time on average, compared with a linear scan through a List. Building one index can replace repeated nested scans and reduce expected total work substantially. That trades extra memory and construction cost for faster reuse. I also choose the equality comparer deliberately and avoid mutable keys, because collisions and inconsistent hashing can undermine performance or correctness.
ASP.NET Core & MVC
36.37What are the three DI lifetimes, and what is a captive dependency?Mid
Transient creates an instance per resolution, scoped shares one within a scope, and singleton shares one within the root service provider. A request normally supplies a scope. A captive dependency occurs when a longer-lived service retains something intended to be shorter-lived, such as a singleton capturing a scoped . That can share unsafe state across requests. I enable scope validation and create explicit scopes for singleton background units of work, keeping scoped objects inside those scopes.
Async & multithreading
36.38How do async and await work under the hood?Mid
The compiler rewrites a Task-returning async method into a state machine. It starts synchronously; an already-completed await continues synchronously. When an awaited Task is incomplete, the method saves its state, registers a continuation and returns control to the caller without reserving that thread for the wait. True asynchronous network need not occupy a waiting thread, although some async offload blocking work. By default, a Task awaiter targets the current SynchronizationContext or a non-default TaskScheduler; otherwise continuation placement follows completion and scheduling rules, not an unconditional new-thread or ThreadPool guarantee. contexts commonly route continuations to the UI thread; supplies no custom SynchronizationContext by default. Unhandled exceptions are stored in the returned Task and observed when it is awaited.
Entity Framework Core
36.39How do you diagnose and fix an N+1 query problem?Mid
I look at database command logs or for one list query followed by repeated queries with different identifiers. That usually comes from lazy loading or explicit loading inside a loop. I replace it with a that computes the required values in , or eager loading if entities are needed. I then verify query count, payload and . Running those queries concurrently on one is invalid and does not address the underlying access pattern.
Security
36.40Is a JWT encrypted, and what must an API validate?Junior
I treat the usual signed as readable data, not encrypted storage. Its header and payload are Base64Url-encoded, and the signature protects integrity under a trusted key. The validates the signature, accepted algorithms, issuer, audience and lifetime with an intentional clock-skew allowance. I obtain keys through trusted provider metadata and support rotation rather than accepting arbitrary -supplied keys. Decoding a token is only inspection; it does not establish that the claims are trustworthy.
Web APIs, REST & gRPC
36.41How would you make a payment endpoint retry-safe?Mid
I require a stable key per logical payment and scope it to the caller and operation. A unique database constraint arbitrates concurrent requests, and I store a payload hash to reject key reuse with different input. Completed attempts replay the recorded response, while in-progress behavior and expiry are documented. Local changes commit atomically. For an external payment provider I also reuse its idempotency mechanism and reconcile uncertain outcomes rather than assuming my database covers the remote charge.
LINQ & collections
36.42What changes when IQueryable becomes IEnumerable before filtering?Mid
The later Where binds to Enumerable and receives a rather than an for translation. With an source, the database query before that boundary still runs on enumeration, but the later filter runs in over returned rows. AsEnumerable itself does not execute or buffer. I keep translatable filters and projections before the boundary, inspect generated , and move to client processing only after deliberately limiting the server result.
SQL & databases
36.43What is the difference between clustered and nonclustered indexes?Mid
In Server rowstore, I can organize a table as a clustered index whose leaf level contains the data rows, or as a heap. A nonclustered index is a separate structure with keys and a row locator, using the clustered key or a heap RID. A primary key need not be clustered. I choose index keys for access patterns and consider included columns for coverage, while remembering that output order still requires ORDER BY.
SOLID & architecture
36.44What is dependency inversion versus dependency injection?Mid
Dependency inversion is about source dependency direction: high-level policy depends on abstractions, and lower-level details implement those abstractions. Dependency injection is a construction technique that supplies collaborators from outside, usually through constructors. I can inject a concrete and still couple policy to infrastructure, so injection alone is not inversion. I define the contract around what the use case needs and let the composition root connect it to an adapter.
Messaging & distributed systems
36.45What problem does the transactional outbox solve?Mid
I use an to avoid the gap between committing business data and publishing its event. The application writes both the business change and an outbox row in the same database . A dispatcher later publishes with confirmation and records success. A crash after publishing but before recording success can cause another publication, so the message ID stays stable and consumers handle duplicates. I also plan safe row claiming, retries, ordering where required, and monitoring of the oldest unsent record.
Testing
36.46How would you integration-test an ASP.NET Core API?Mid
I host the with WebApplicationFactory, start a disposable database through Testcontainers, and configure the application to use it before the host starts. I apply migrations and seed only the scenario's data. Requests then exercise , routing, validation and persistence together. I replace external payment calls with a fake and inspect stored state through a fresh scope. I also run deployment checks separately because the default TestServer does not validate real or proxy configuration.
Behavioral & career
36.47Tell me about a mistake you made.Mid
I once approved a query change after testing only with a small dataset. Under a larger workload it became too slow, and I had missed that risk. I helped revert the change, reproduced the issue with representative data and reviewed the execution plan before making a smaller fix. I then added a performance review step for similar queries and shared what I had overlooked. The lesson was to validate workload assumptions before release rather than treating functional correctness as sufficient evidence.
Async & multithreading
36.48What is a CancellationToken and how do you use it?Mid
It's a cooperative cancellation signal created by a CancellationTokenSource. Code receiving it checks it or passes it to that support it, which throw OperationCanceledException when it fires. In , actions receive a that cancels when the client disconnects, and I flow it through and HttpClient calls. For timeouts I create a linked source with CancelAfter.
Entity Framework Core
36.49How does optimistic concurrency work in EF Core?Mid
I configure a concurrency , such as Server rowversion or an application-managed version. remembers the original value and includes it with the key in update and delete predicates. If another writer changes that version, the expected row is not affected and EF raises DbUpdateConcurrencyException. I then return a conflict or reload and reconcile according to business rules. I do not blindly retry a user edit, because that could overwrite the newer decision.
Data consistency & transactions
36.50How would you prevent overselling the last product?Mid
I validate that the requested quantity is positive and issue a conditional UPDATE that subtracts it only where the product has enough stock. I treat one affected row as a successful reservation and zero as failure. If creating the order must be atomic with reservation, both operations share a . This works across application instances because the database coordinates the write. I also add suitable constraints and a reservation identity if retries must not reserve the same order twice.
ASP.NET Core & MVC
36.51What is CORS preflight, and does CORS secure an API?Mid
A browser sends a preflight OPTIONS request for cross-origin requests that need permission for their method or headers, such as requests with Authorization. answers according to the allowed origins, methods and headers. It is a browser-enforced sharing policy, not server authentication, authorization or protection, and tools such as curl do not enforce it. I allow explicit origins and never combine wildcard origins with credentialed access.
Security
36.52What is CSRF and does CORS prevent it?Mid
I consider when the browser automatically attaches credentials, especially session cookies. An attacker can cause a victim's browser to submit a state-changing request without reading its response. I validate antiforgery , use suitable SameSite settings and avoid state changes through GET. governs cross-origin browser access but is not a complete CSRF defense, since some requests can still be sent. Explicit bearer headers change the threat model, while storing that bearer token in a cookie restores automatic attachment.
Caching & Redis
36.53What is a cache stampede?Mid
I call it a when many requests miss the same popular entry and all recompute it together. I use single-flight loading to share that work, with refresh-ahead or bounded stale-while-revalidate where the business permits it. HybridCache coordinates loads locally, so I still account for multiple instances. jitter helps distribute different keys' expirations but does not alone prevent a burst against one missing key. I also bound origin concurrency to survive cold starts.
Async & multithreading
36.54What is the difference between Task.WhenAll and Task.WhenAny?Mid
Task.WhenAll completes when all tasks complete, so independent operations take about as long as the slowest one; awaiting it rethrows the first exception while the task's Exception holds all of them. Task.WhenAny completes when the first task completes and returns that task without throwing, so you await it to get its result. I use WhenAll to run independent calls concurrently, and WaitAsync or WhenAny for timeouts.
LINQ & collections
36.55What is deferred execution, and is every deferred operator streaming?Mid
means constructing a query does not immediately process its source. Enumeration or a terminal operator triggers the work. It does not necessarily mean streaming: Where and Select can yield progressively, while -to-Objects OrderBy must buffer before producing sorted results. I consider both timing and memory behavior. Re-enumerating can repeat expensive work or see changed data, so I a reasonably sized result when I need a stable, reusable snapshot.
SQL & databases
36.56What are ACID properties, and do they enforce business rules automatically?Mid
I describe atomicity as all-or-nothing changes, consistency as preserving valid states, as controlling interference between , and durability as retaining committed results under the configured guarantees. A transaction does not invent business rules: constraints and correct operations still need to enforce them. For stock, I may use a conditional update or suitable concurrency control. I also keep remote payments outside the assumption that a local database transaction can roll everything back.
Messaging & distributed systems
36.57How do consumer acknowledgments differ from publisher confirms?Mid
I use publisher confirms to know that the accepted responsibility for a published message under its configured durability rules. Consumer acknowledgments report successful handling of a delivery and let the broker remove it from the queue. They protect different stages and neither replaces the other. I acknowledge only after committing the business effect. If the consumer crashes between commit and acknowledgment, the message can return, so I design for duplicates even when every publisher uses confirmations.
C# fundamentals & OOP
36.58What is a record? How is it different from a class?Mid
A record generates value equality, a useful ToString, and a shallow non-destructive copy with with. Positional record classes have init-only properties; positional record structs are mutable unless declared readonly. Records can also contain mutable members, so they aren't automatically . I use records for , messages and value objects, and classes for entities with identity and behavior. See the official record reference.
Async & multithreading
36.59What are the most common async/await mistakes?Mid
Common mistakes include blocking with .Result or .Wait, which can cause a when completion needs an occupied constrained context, or ThreadPool starvation under load. has no custom SynchronizationContext by default, but that does not exclude other deadlocks. Other mistakes are async void outside event-handler signatures, leaving returned Tasks unobserved so failures may go unnoticed, and unowned fire-and-forget work that may outlive the request's scope. Also avoid concurrent operations on one and trying to await inside a lock statement; propagate CancellationToken to operations that support cooperative cancellation.
ASP.NET Core & MVC
36.60Why use IHttpClientFactory, and what is a valid alternative?Mid
IHttpClientFactory centralizes configuration and pools handlers so short-lived clients can reuse connections without rebuilding a connection pool for every call. Typed clients also give a focused application boundary. A long-lived HttpClient using SocketsHttpHandler with a suitable PooledConnectionLifetime is a valid alternative. I avoid claiming that every static client is wrong. I check refresh, cancellation, timeouts and lifetime capture, especially when a singleton holds a typed client intended to be short-lived.
Web APIs, REST & gRPC
36.61When would you use cursor pagination instead of offset?Mid
I use offset for small administrative lists and direct access to numbered pages. For large feeds, cursor pagination avoids traversing a growing number of skipped rows. I use a deterministic sort, such as creation time plus a unique numeric identifier, and a matching index. The cursor captures both values and is tied to the filters. It reduces insert-related paging problems but does not create snapshot consistency when records themselves change, and arbitrary page jumps become harder.
Testing
36.62Why avoid EF Core InMemory for database tests?Mid
I do not use InMemory to prove database correctness because it is not a relational engine. Passing tests cannot establish correct translation, foreign-key behavior or . SQLite is relational but still differs from SQL Server or PostgreSQL in dialect, types and comparison behavior. I test important queries and concurrency rules against the production database engine in disposable infrastructure, and use stubs above data access when a focused unit test needs predefined results.
Logging & observability
36.63What does OpenTelemetry do in a .NET application?Mid
I use OpenTelemetry to collect and export telemetry through standard and configurable pipelines. In , ActivitySource and Activity represent , while Meter produces measurements. I register the relevant sources and meters, configure and resources, and export through to a collector or backend. Logs have their own pipeline. OpenTelemetry is not itself a storage database or dashboard, and changing backends can still require configuration and semantic adjustments even when application instrumentation stays the same.
Docker, CI/CD & Git
36.64What makes a good .NET Dockerfile?Mid
I use an stage to restore and publish, then copy only published output into an ASP.NET runtime stage. I copy dependency inputs before source to preserve restore caching, run as a non-root user and exclude build output and secrets from the context. I consider chiseled images when their missing shell and package tools fit the application. I pin release inputs, scan and update images, and verify globalization, filesystem permissions and shutdown behavior.
AI in .NET: RAG, embeddings & MCP
36.65Walk me through a RAG pipeline.Mid
I separate ingestion from answering. Ingestion extracts and chunks documents, creates and stores source versions and access metadata. At request time I authenticate the user, retrieve authorized candidates with keyword and vector search, optionally rerank them and construct a . The model answers from that evidence with source identifiers and abstains when support is missing. I validate citations and evaluate retrieval recall separately from answer groundedness, while tracking , cost and deletion freshness.
AI in .NET: RAG, embeddings & MCP
36.66What does an embedding represent?Mid
I use as numerical representations for comparing content, often semantic similarity. I generate document and query vectors with the same compatible model and configuration, then compare them using the store's supported distance metric. Cosine compares directions and needs nonzero vectors. A high similarity score is not a probability that an answer is true. I calibrate relevance on labeled examples and rebuild the index when a model change makes the old vector space incompatible.
SOLID & architecture
36.67What distinguishes Clean, Hexagonal and Onion architecture?Mid
I see them as related approaches to protecting the application core. Clean Architecture emphasizes entities, use cases and inward source dependencies. Hexagonal Architecture emphasizes inbound and outbound ports with replaceable adapters. Onion Architecture places the domain at the center of dependency rings. Their vocabulary differs, but all can keep and persistence details outside core policy. I choose the boundaries needed by the application rather than adding every named layer from a diagram.
Messaging & distributed systems
36.68How do retry, timeout, circuit breaker and bulkhead work together?Mid
I give the operation a total time budget, bound each attempt, and retry only transient failures where repeating the effect is safe. Exponential backoff with jitter prevents synchronized retry bursts. A circuit breaker rejects calls temporarily when a dependency is failing, then admits probes during recovery. A bulkhead limits concurrent work so one dependency cannot consume all capacity. In I can configure the standard resilience handler, while avoiding layered retry multiplication and treating consumer retries as a separate policy.
System design
36.69How do you begin a system design interview?Mid
I begin by clarifying the user journeys and explicit non-goals, then ask about peak traffic, data volume, , availability and consistency requirements. I state assumptions when numbers are missing and estimate the scale before choosing components. Next I define the main , data model and , draw a simple baseline and explore the hardest part. I finish by testing failure scenarios and explaining how measurements would justify scaling or changing the design.
System design
36.70What happens if the payment provider times out?Senior
I treat the outcome as unknown because the provider may have charged successfully before the response was lost. I persist the attempt and use the provider's mechanism for safe retries, then resolve the outcome through verified webhooks or reconciliation. The order remains in an explicit intermediate state. I also define what happens if stock reservation expires before payment confirmation, such as re-reservation or refund. A database rollback cannot undo a charge in an external system.
SOLID & architecture
36.71When would you choose a modular monolith over microservices?Senior
I choose a modular monolith when one deployment is acceptable and clear module ownership gives most of the needed separation. It keeps local calls and makes shared transactional work easier to coordinate. Microservices become attractive when independent deployment, scaling or team ownership provides a measurable benefit worth network and operational complexity. I enforce contracts and data ownership from the start, but I do not promise that extracting a module later is trivial; migration and distributed failure handling still require design.
Security
36.72How do you prevent cross-tenant data leakage?Senior
I establish tenant identity from a trusted authenticated context and authorize any tenant selection. Queries and writes remain tenant-scoped, with resource checks where needed. I extend to cache keys, storage paths, exports and message handlers. Database filters help, but raw , administrative bypasses and unfiltered relationships still require review. I add tests where one tenant supplies another tenant's identifiers, including update and bulk paths, because an unpredictable identifier alone is not an access-control boundary.
Entity Framework Core
36.73How do you deploy migrations safely during rolling releases?Senior
I review a generated script or bundle and run it as a controlled deployment step with dedicated privileges. I test locking, duration, data conversion and recovery on realistic volumes. For incompatible changes I expand the , deploy compatible code, retire old writers, backfill safely, switch reads and contract later. Migration locking can reduce simultaneous execution, but does not make a destructive change compatible with old instances. I keep clear migration ownership and a forward-repair plan.
Messaging & distributed systems
36.74How do you implement an idempotent consumer safely?Senior
I enforce a unique consumer-and-message key in an inbox and commit that record with the database effect in one . The unique constraint handles concurrent duplicates; a preliminary existence check alone is insufficient. I acknowledge only after commit, and distinguish the expected duplicate-key case from other database failures. External effects need their own contract or another durable delivery step, because a transaction cannot roll back a payment . I retain deduplication records for the supported replay window.
Logging & observability
36.75How do you investigate a production performance incident?Senior
I establish the affected users, timing and severity, then mitigate safely through rollback or when needed. Metrics narrow the endpoint, version and resource pattern; show the critical path, and correlated logs add details. I choose diagnostics based on a hypothesis: counters for trends, a bounded trace for sampled execution, or a dump for retained objects and stacks. I reproduce the issue, add a regression test, roll out gradually and document contributing factors with owned follow-up actions.
Testing
36.76How would you test two buyers competing for the last item?Senior
I seed one item in the real database engine and run two purchase attempts with independent contexts and . I coordinate their execution so they can reach the contested operation together, then assert one successful reservation, an expected failure for the other and nonnegative persisted stock. I also test retry and behavior. Repeated runs help expose scheduling problems, but the underlying atomic update or concurrency constraint must enforce the in production.
Async & multithreading
36.77What is thread pool starvation and how do you detect it?Senior
It happens when pool threads are blocked, typically by sync-over-async code, so queued work waits while the pool slowly injects new threads. explodes while stays low. dotnet-counters shows a growing thread-pool queue length and thread count. The fix is making the call chain async all the way down, not raising the minimum thread count.
Behavioral & career
36.78Tell me about a time you showed leadership without authority.Senior
During a service issue, several people were investigating overlapping areas while support needed an update. I was not the incident lead, so I suggested a shared timeline and asked who would coordinate decisions. I took ownership of one investigation path, posted evidence and helped separate mitigation from root-cause work. After recovery, I organized the follow-up actions with named owners. The useful contribution was reducing confusion and helping others act effectively, rather than taking over decisions that were not mine.
LINQ & collections
36.79How would you design stable pagination for a large changing order list?Senior
I use a deterministic ordering, for example CreatedAt followed by a unique numeric Id, with a matching index. A keyset cursor carries both values and the next-page predicate compares them lexicographically in the same sort direction. This avoids deep offset scans and many shifts caused by new rows. The trade-off is harder random page access. I also define behavior when sort keys change, because a cursor does not provide snapshot across separate requests.
SQL & databases
36.80How do you optimize a slow query without guessing?Senior
I capture the query, parameters, duration, logical reads and waits, then inspect its actual execution plan. I compare estimated and actual rows, look for spills, expensive lookups, large transfers and blocking, and check statistics. I reduce unnecessary data and round trips, rewrite predicates or adjust indexes according to evidence. I test different parameter sizes and compare before and after, including write impact. A scan is not automatically bad, and a seek is not automatically cheap.
SOLID & architecture
36.81Does CQRS require separate databases, MediatR or event sourcing?Senior
No. I can separate command behavior and query projections while using one database and injecting handlers directly. A separate read store is useful for independent read shaping or scaling, but introduces propagation lag, rebuilds and operational work. is another decision about making events the authoritative history rather than storing only current state. MediatR is one dispatch implementation. I introduce each choice for a concrete requirement instead of adopting a whole bundle because it is labeled .
Data consistency & transactions
36.82Why can snapshot isolation allow write skew?Senior
Snapshot gives a consistent view but does not necessarily protect every predicate used in a decision. Two doctors can each observe that two people are on call, then update different rows to leave. Neither overwrites the other, yet nobody remains. A rowversion on each doctor does not fix that. I use Serializable with whole- retries or serialize the decision through a shared roster row locked before checking the count. The protected boundary must match the business .
Messaging & distributed systems
36.83Can you guarantee exactly-once processing?Senior
I first define the boundary of the guarantee. A platform can provide exactly-once semantics within a specific scope, such as Kafka records and offsets, without covering a separate database or external payment provider. For a cross-system workflow, I usually combine at-least-once delivery with atomic inbox processing, unique business keys and provider keys. I describe the remaining failure windows explicitly and add reconciliation, rather than claiming that a option makes every business effect happen exactly once.
Caching & Redis
36.84How do you know a cache is helping and can survive an outage?Senior
I compare end-to-end and origin load before and after caching, alongside hit ratio, evictions, payload sizes and cache errors. I separate local and distributed hits because their costs differ. Then I exercise cold starts, unavailable Redis and failed invalidation. Fallback must have timeouts and bounded database concurrency; otherwise a cache outage can become a database outage. I define whether each endpoint may serve bounded stale data, degrade its response or fail safely under those conditions.
System design
36.85How do you choose a multi-tenancy model?Senior
I compare requirements, tenant count, workload variation, compliance needs and operational cost. A shared database is economical but needs reliable tenant filtering, scoped constraints and controls against noisy neighbors. Separate databases simplify some restore and movement scenarios at the cost of provisioning and migration management. A hybrid model can dedicate large tenants. I also scope caches, jobs and rate limits, and distinguish data isolation from compute isolation because separate databases can still share a server.
Docker, CI/CD & Git
36.86How do you deploy a breaking database change safely?Senior
I use expand and contract so old and new application versions can coexist. I first add compatible , deploy code that tolerates both representations, backfill in resumable batches and switch reads after verification. I remove the old structure only after old instances and the rollback window are gone. I run migrations through one controlled job and test lock behavior on realistic data. Reverting the application image cannot restore deleted data, so recovery needs separate planning.
Security
36.87How do you verify a payment webhook safely?Senior
I verify the provider's exact signature contract over the raw request bytes before , with bounded body size and constant-time comparison for valid signatures. I validate an authenticated timestamp where the protocol provides one and deduplicate event IDs atomically with processing. Then I compare the order, amount and currency against authoritative data and apply only valid state transitions. remains necessary, and I never treat a client redirect as payment proof. Failed deliveries need monitored retries and reconciliation.
Logging & observability
36.88Explain SLIs, SLOs and error budgets.Senior
I define an as a measurement of service experience and an as its target over a specified window. The error budget is the allowed shortfall, such as the permitted fraction of failed eligible requests. I define eligibility, business success and the data source before calculating it. Burn rate compares observed failures with the sustainable budget rate. The budget then guides reliability priorities and deployment risk under an agreed policy, rather than becoming a number disconnected from user experience.
System design
36.89What are backpressure and graceful degradation?Mid
I use to make producers slow down or reject work when consumers cannot keep up. Bounded queues, concurrency limits and deadlines prevent an overload from turning into unbounded memory use and stale requests. Graceful degradation preserves essential behavior by reducing optional work, such as disabling recommendations while checkout remains available. I define these modes explicitly and monitor their impact. A growing queue without admission control only postpones failure, and a fallback must not silently violate payment or security .
Behavioral & career
36.90How do you work with ambiguous requirements?Mid
I turn ambiguity into explicit questions and examples. For an order-cancellation request, I would clarify allowed states, ownership, stock release and what happens if payment succeeds concurrently. I write a short acceptance example and confirm it with the decision owner. If an answer is delayed, I separate reversible technical work from decisions that could change money or customer behavior. I record provisional assumptions and a review date rather than letting my interpretation become an undocumented business rule.
Data consistency & transactions
36.91How would you guarantee read-your-writes with replicas?Senior
I first define the scope of the guarantee, usually a user session. The straightforward solution is to route that session's relevant reads to the primary. Another option is a commit-position and a replica that waits until it has applied at least that position before serving the read. I would not call a fixed two-second sticky window a guarantee unless lag has a proven bound. I also make sure caches do not reintroduce older results.
Messaging & distributed systems
36.92What is a saga, and how do choreography and orchestration differ?Senior
I use a saga for a long-running workflow across boundaries, with local commits and compensating actions. Choreography lets participants react to events, while orchestration uses a coordinator to persist progress and issue commands. I prefer explicit orchestration when timeouts and recovery make the flow difficult to understand through events alone. Compensations are business actions that can fail and need and monitoring. A saga also does not provide , so reservations and pending states remain important.
Entity Framework Core
36.93How do explicit transactions interact with connection retries?Senior
I run the whole inside the execution strategy so a transient failure can replay a complete unit. I create fresh context state for each attempt and keep external side effects out of the retry , using an where needed. I also consider commit ambiguity: a connection failure during commit does not prove rollback. Operations need or outcome verification. I avoid broad retries for business conflicts and choose according to the actual .
HTTP & networking
36.94How does HttpClient react to DNS changes?Senior
I assume is resolved when a connection is established rather than before every request. Existing pooled connections can continue using the old destination after records change. PooledConnectionLifetime or suitable handler rotation allows new connections to resolve again, with an interval chosen for the environment. I also avoid indefinitely retaining factory clients when relying on rotation. Lowering DNS alone does not move traffic already traveling through an established connection.
System design
36.95How would you build a global rate limiter?Mid
I first define the partition key, sustained rate, allowed burst and whether the quota must be global. A bucket is useful when bounded bursts are acceptable. For several instances, I place enforcement at a gateway or use shared state with atomic refill-and-consume operations; independent local counters multiply the effective limit. I bound key and waiting, return useful rejection information, and define fallback behavior if the shared counter fails according to endpoint risk.
Testing
36.96How do contract tests differ from E2E tests?Senior
I use contract tests to verify an agreement at a service boundary, including the requests a consumer sends and the responses it requires. Provider verification checks the actual provider against that agreement. This gives faster, more focused compatibility feedback than a full environment. It does not prove the entire business workflow, authorization configuration or network routing. I retain selected tests for those interactions and avoid treating a matching as complete semantic compatibility.
AI in .NET: RAG, embeddings & MCP
36.97How do you secure multi-tenant RAG?Senior
I derive tenant context from authenticated server identity and enforce tenant and document permissions during retrieval. Unauthorized content must never enter the prompt. I isolate indexes where required, scope caches by tenant and access context, and reauthorize citation downloads and tool actions. Permission changes and deletions must invalidate stale evidence and cached answers. I test cross-tenant queries and cache reuse explicitly, and treat , logs and conversation history as sensitive data subject to the same retention controls.
AI in .NET: RAG, embeddings & MCP
36.98How would you evaluate a support assistant?Senior
I build a versioned evaluation set covering normal questions, missing evidence, conflicting policies, both supported languages and adversarial requests. I measure retrieval recall, answer correctness, groundedness, citation validity and appropriate abstention separately. I also test permission and tool safety as hard requirements. Human review calibrates automated judges rather than being replaced by them. I compare prompt and model versions on the same set, then monitor approved production samples alongside and cost per successful resolution.
C# fundamentals & OOP
36.99Why is immutability useful?Mid
objects can't change after creation, so they can be shared across threads without locks or , and they're easier to reason about and test because there are no hidden side effects. In C# I use records, init-only and required properties, readonly fields, and immutable or frozen collections.
Async & multithreading
36.100What does ConfigureAwait(false) do, and do you need it in ASP.NET Core?Senior
For a Task await, ConfigureAwait(false) suppresses targeting the current SynchronizationContext or a non-default TaskScheduler for the continuation. It does not force a different thread; an already-completed await can continue synchronously. It can prevent some context-dependent caused by synchronous blocking, but is not a general deadlock cure. General-purpose library code commonly uses it when continuation code does not need the caller's context; -dependent code usually keeps that context. installs no custom SynchronizationContext by default, so application code usually does not need it for that reason, but custom contexts or schedulers can still be introduced.
System design
36.101How do you estimate QPS and concurrent requests?Mid
I divide daily operations by 86,400 for an average rate, then apply an explicit peak assumption and account for multiple requests per business operation. I estimate storage separately, including indexes, retention, replicas and backups. For a stable boundary, Little's law gives average in-flight work as multiplied by average response time, including queue wait. These are sizing hypotheses rather than capacity guarantees, so I validate them with workload-shaped load tests and tail- measurements.
What does 0.1 + 0.2 == 0.3 return with double?
You override Equals on a class used as a Dictionary key. What else must you do?
Covariance (out T) allows...
What is the main benefit of async/await in an ASP.NET Core API?
A C# lock protects a stock counter, but the API runs on 4 instances. Is stock safe?
Best tool for CPU-bound work across cores?
What does AsEnumerable do by itself?
Which expression adds a secondary sort key?
Which collection suits a catalog built once and queried many times?
Which server receives requests in IIS in-process hosting?
What does CORS prevent by itself?
Which statement about durable schedulers is correct?
DELETE returns 204 first and 404 on retry. Is it necessarily non-idempotent?
What does AddOpenApi plus MapOpenApi provide?
A valid token lets customer A read customer B's order. What is missing?
Can two queries run concurrently on one DbContext?
A configured version changed since the entity was loaded. Saving normally raises...
What does DbContext pooling reuse?
LEFT JOIN followed by WHERE right.Total > 100 does what to unmatched rows?
Which date predicate is usually more sargable on CreatedAt?
What should follow deduplication once business identity is defined?
A reader observes a price that another transaction later rolls back. Which anomaly?
Which value should EF compare when saving an edited form?
Does a cache TTL by itself guarantee reads always return the latest committed value?
An invoice class changes for tax policy and email layout. Which principle is most directly involved?
Which DDD concept defines where Product has one consistent meaning?
What should an architecture decision record preserve?
A consumer commits a change and crashes before ack. What should you expect?
A RabbitMQ nack with requeue=false retains the failure when...
Which signal proves that the consumer completed its business effect?
Which layer shares serialized cached values across API instances?
Why is a tenant-aware cache key insufficient by itself?
Redis becomes unavailable. What protects the database?
A valid login can read another user's invoice by changing an ID. Which failure?
Why does an HttpOnly cookie not eliminate XSS risk?
A valid HMAC webhook is replayed tomorrow. What additional control matters?
Which signal follows one request through API, database and payment service?
A 99.9% request-success SLO permits how many failures per million eligible requests?
What makes an on-call page useful?
Which test best validates PostgreSQL query translation?
Why can transaction rollback fail to isolate an HTTP integration test?
A test fails only in parallel runs. Best first investigation?
What does a multi-stage Dockerfile keep out of the final image?
A bad commit is already shared on main. Which Git operation preserves history?
What should a proxy deployment do with forwarded headers?
Which sequence describes the TCP three-way handshake?
What does a 304 response normally omit?
What does lowering DNS TTL fail to do by itself?
Build a dictionary of m customers, then look up n orders. Expected total time?
What does a hash collision prove?
What does a lower-bound search return?
Best approach for 'longest substring without repeating characters'?
Top K frequent elements, efficiently?
Course Schedule (can all courses be finished?) is solved with...
What does a low temperature guarantee?
What is an MCP resource?
Where should a stdio MCP server write diagnostic logs?
What should happen before drawing architecture boxes?
Why can an outbox relay publish twice?
A queue grows indefinitely because arrival rate exceeds processing rate. What is needed?