Back End DeveloperInterview Answers

I follow REST principles: resources are nouns (not verbs), URIs are hierarchical and represent resource relationships, HTTP methods are used semantically (GET read, POST create, PUT/PATCH update, DELETE remove). I version APIs from the start (/v1/) to enable non-breaking evolution. I design consistent response formats, error codes, and pagination patterns. I document with OpenAPI/Swagger. I think about client needs during design — an API that's technically correct but hard to use is a bad API. I also consider rate limiting, authentication, and input validation as first-class API concerns.

I design schemas based on the access patterns — normalising by default, denormalising when query performance demands it. I use indexes strategically: every slow query gets an explain plan, and indexes are added based on selectivity and query frequency. I avoid N+1 queries by designing eager loading into the data layer. I write migrations carefully — backwards-compatible changes where possible, and blue-green deployment strategies for breaking schema changes. I also design for data integrity: foreign key constraints, not-null constraints, and check constraints enforce consistency at the database level.

I design stateless services from the start — state lives in the database or cache, not application memory. I use async processing (message queues: RabbitMQ, Kafka, SQS) for operations that don't need to be synchronous. I cache aggressively at the right layer: database query results (Redis), computed aggregations, and static resources. I design APIs to be horizontally scalable and prefer managed services (RDS, ElasticCache) that scale independently. I also design with rate limiting and backpressure handling — services need to degrade gracefully under load.

Authentication: OAuth 2.0 / OIDC for user auth, API keys or JWT for service-to-service. I validate and sanitise all input — no direct SQL construction from user input. I implement rate limiting and throttling to prevent abuse. I use HTTPS/TLS everywhere and enforce certificate validation. I apply least-privilege: each service and user has the minimum permissions required. I audit privilege usage. I scan dependencies for vulnerabilities (OWASP Dependency-Check, Snyk) in CI. And I log security events — failed authentications, privilege escalations — centrally for monitoring.

I follow the principle that errors should be logged, classified, and returned meaningfully. I use structured logging (JSON) at an appropriate log level so logs can be queried. I implement distributed tracing (OpenTelemetry) so requests can be followed across services. I define error codes consistently across the API and document them. I set up alerting on error rate anomalies, not just technical metrics like CPU. In microservice architectures, I implement circuit breakers (Resilience4j, Hystrix) to prevent cascade failures when a dependency is degraded.

I've built and maintained both. Monoliths are underrated: they're simpler to develop, test, and deploy, and most teams don't need microservices until they hit specific scaling or team coordination constraints. When I have moved to microservices, I've applied the Strangler Fig pattern — extracting services incrementally from a working monolith rather than big-bang decomposition. Microservices introduce significant operational complexity (service discovery, distributed tracing, network failure modes, data consistency across services) — I only accept that complexity when the benefits clearly outweigh it.

I write unit tests for business logic in isolation (mocking database and external dependencies). I write integration tests that verify the service against a real (test) database — these test the full request-response cycle and catch SQL errors, query performance issues, and data mapping problems that unit tests miss. I use contract testing (Pact) where services have published APIs consumed by other teams. I also write load tests (k6, Locust) for performance-critical endpoints. Test coverage is meaningful only if the tests would catch real failures.

I've designed event-driven systems using RabbitMQ and Apache Kafka. I understand the trade-offs: at-least-once vs exactly-once delivery, consumer group patterns, dead letter queues, and message ordering guarantees. I design message schemas carefully — backwards-compatible schema evolution is essential in production. I implement idempotent consumers so duplicate messages don't cause data corruption. I monitor queue depth and consumer lag as key operational metrics. Event-driven architectures enable great scalability and decoupling, but require disciplined schema management and failure handling.