Full Stack Interview: Common Questions

Version: 1 (initial draft). Date: 2026-11-09.

Use this file to prepare for a standard full stack interview. Each question has a short model answer. Complex words have a simple explanation.

Format for complex words:

Word: simple explanation. Example: short example.

0. How to use this file

Read the question.
Say your answer out loud. Do not read the model answer first.
Compare your answer with the model answer.
Add one example from your own work. Real examples make a strong answer.

1. How to answer competency questions (STAR)

Interviewers use competency questions to see how you work. Use the STAR method.

STAR: a 4-part structure for a story about your work.

Situation: where and when.

Task: what you had to do.

Action: what you did (say "I", not "we").

Result: what happened. Use a number if possible.

Example: "Our checkout page was slow (S). I had to make it faster (T). I added caching to the product API (A). Page load time went from 4s to 1s (R)."

Tips:

Keep each story to about 2 minutes.
Prepare 5 to 6 stories. One story can answer many questions.
Spend most of the time on Action.

2. Competency / behavioural questions

#	Question	What they want to see
1	Tell me about yourself.	A 60-second summary: current role, key skills, why this job.
2	Tell me about a project you are proud of.	Ownership, technical depth, result.
3	Tell me about a time you disagreed with a teammate.	Respect, listening, a solution based on data.
4	Tell me about a time you made a mistake.	Honesty, what you learned, what you changed.
5	Tell me about a tight deadline.	Priorities, communication, trade-offs.
6	How do you learn a new technology?	A clear process: docs, small test project, apply at work.
7	Tell me about a time you helped a teammate.	Teamwork, mentoring.
8	How do you deal with unclear requirements?	Ask questions, write down assumptions, confirm early.
9	Tell me about a difficult bug.	Debug process: reproduce, isolate, fix, prevent.
10	Why do you want this job?	Research about the company. Link your skills to their needs.
11	Where do you see yourself in 3 to 5 years?	Growth that fits the company.
12	Do you have any questions for us?	Always say yes. See section 11.

Model answer: "Tell me about a difficult bug"

S: A production API returned errors for some users only.
T: I had to find and fix the cause quickly.
A: I checked the logs. I found that the errors happened only for users with a special character in their name. I reproduced the bug locally. I fixed the input encoding. I added a unit test for this case.
R: The errors stopped. The new test prevents the same bug in the future.

3. Frontend (HTML, CSS, JavaScript, React)

Q: What is the difference between `let`, `const`, and `var`?

var: function scope. You can declare it again. Old style. Do not use.
let: block scope. You can change the value.
const: block scope. You cannot assign a new value.

Scope: the part of the code where a variable is visible. Example: a let inside an if { } block is not visible outside that block.

Q: What is the difference between `==` and `===`?

== changes the types before it compares (type coercion). "5" == 5 is true.
=== compares value and type. "5" === 5 is false.
Always use ===.

Q: What is a closure?

Closure: a function that remembers the variables from the place where you created it. Example:
function makeCounter() {
  let count = 0;
  return () => ++count; // remembers "count"
}
const next = makeCounter();
next(); // 1
next(); // 2

Q: What is the event loop?

JavaScript runs one task at a time (single thread). The event loop lets it do slow work (network, timers) without a stop.

Call stack runs code
      ↓
Slow work (fetch, setTimeout) goes to the browser / Node
      ↓
When ready, the callback goes into a queue
      ↓
Event loop moves the callback to the call stack when the stack is empty

Callback: a function that you give to another function to run later.

Q: What is a Promise? What is `async/await`?

Promise: an object for a value that you will get in the future. It has 3 states: pending, fulfilled (success), rejected (error).

async/await is a cleaner way to write Promise code.

async function getUser() {
  try {
    const res = await fetch("/api/user");
    return await res.json();
  } catch (err) {
    console.error(err);
  }
}

Q: What is the Virtual DOM?

DOM: the tree of HTML elements in the browser. Virtual DOM: a copy of the DOM in memory. React changes the copy first. Then React compares it with the old copy (diffing) and updates only the changed parts of the real DOM. Example: one item in a list of 100 changes. React updates 1 item, not 100.

Q: Props vs state in React?

Props: data that a parent gives to a child. The child cannot change props.
State: data that a component owns and can change. A state change causes a re-render.

Q: Explain common React hooks.

Hook	Use
`useState`	Keep a value that can change.
`useEffect`	Run side effects (fetch data, timers) after render.
`useMemo`	Remember the result of a slow calculation.
`useCallback`	Remember a function so it does not change on each render.
`useRef`	Keep a value that does not cause a re-render, or point to a DOM element.
`useContext`	Read shared data without passing props down many levels.

Side effect: work that goes outside the component. Example: an API call.

Q: Why does React need a `key` in a list?

The key gives each item a stable ID. React uses it to know which item changed, moved, or was removed. Do not use the array index if the list order can change.

Q: What is the CSS box model?

Each element is a box with 4 layers, from inside to outside:

content → padding → border → margin

box-sizing: border-box makes width include padding and border. This is easier to work with.

Q: Flexbox vs Grid?

Flexbox: layout in one direction (a row or a column). Example: a nav bar.
Grid: layout in two directions (rows and columns). Example: a page layout.

Q: How do you make a website faster?

Make files smaller (minify, compress).
Load code only when needed (lazy loading, code splitting).
Make images smaller (WebP/AVIF, correct size).
Use a CDN and browser caching.
Do fewer re-renders in React.

CDN (Content Delivery Network): servers in many countries that keep copies of your files. Users get files from the nearest server.

Make the site usable for all people, including people with disabilities.

Use correct HTML elements (<button>, not a clickable <div>).
Add alt text to images.
Make sure the keyboard can reach all controls.
Use enough colour contrast.

4. Backend (Node.js, APIs)

Q: What is REST?

REST: a style for web APIs. Each thing (resource) has a URL. You use HTTP methods to act on it. Example: GET /users/42 returns user 42.

Method	Action	Example
GET	Read	`GET /users`
POST	Create	`POST /users`
PUT	Replace	`PUT /users/42`
PATCH	Change part	`PATCH /users/42`
DELETE	Remove	`DELETE /users/42`

Q: What are the common HTTP status codes?

Code	Meaning
200	OK
201	Created
204	No content
400	Bad request (client sent bad data)
401	Unauthorized (not logged in)
403	Forbidden (logged in, but no permission)
404	Not found
409	Conflict
429	Too many requests
500	Server error
503	Service unavailable

Simple rule: 2xx = success, 4xx = client error, 5xx = server error.

Q: What is idempotent?

Idempotent: you can send the same request many times and the result is the same as one time. Example: DELETE /users/42 two times → user 42 is still deleted. POST /orders two times → two orders. So POST is not idempotent.

Q: REST vs GraphQL?

REST: many URLs. The server decides the data shape. Simple. Easy to cache.
GraphQL: one URL. The client asks for exactly the fields it needs. Good when many clients need different data.

Over-fetching: you get more data than you need. GraphQL helps to prevent this.

Q: What is middleware?

Middleware: a function that runs between the request and the final handler. Example: in Express, a middleware checks the login token before the route runs.

Request → logger → auth check → route handler → Response

Q: Is Node.js single-threaded?

Your JavaScript code runs on one thread. Node uses the event loop and a background thread pool for slow work (files, some crypto). So Node is good for many I/O tasks. It is not good for heavy CPU work on the main thread.

I/O (Input/Output): reading or writing data. Example: a database query, a network call.

Q: Monolith vs microservices?

Monolith: one application. Easy to start, test, and deploy.
Microservices: many small services. Each service does one job. Teams can deploy alone. But it is more complex (network, monitoring).

Good answer: "Start with a monolith. Split into services only when there is a clear need."

5. Databases

Q: SQL vs NoSQL?

	SQL (e.g. PostgreSQL)	NoSQL (e.g. MongoDB)
Structure	Tables with a fixed schema	Flexible documents
Relations	Strong (joins)	Weak
Best for	Data with clear relations (orders, users)	Changing or very large data

Schema: the rules for the data shape. Example: a users table must have id, email.

Q: What is an index?

Index: a data structure that makes search faster, like the index at the back of a book. Example: an index on email makes WHERE email = 'a@b.com' fast. Cost: writes are slower and it uses more storage.

Q: What are the SQL joins?

INNER JOIN: rows that match in both tables.
LEFT JOIN: all rows from the left table, plus matches from the right (or NULL).
RIGHT JOIN: the opposite of LEFT JOIN.
FULL JOIN: all rows from both tables.

Q: What is ACID?

ACID: 4 rules that make database transactions safe.

Atomicity: all steps happen, or none happen.

Consistency: data always follows the rules.

Isolation: transactions at the same time do not affect each other.

Durability: after a save, the data stays, also after a crash.

Example: a bank transfer. Money leaves account A and goes into account B. If one step fails, both steps are cancelled.

Transaction: a group of database steps that act as one unit.

Q: What is normalization?

Normalization: put data in separate tables so you do not repeat it. Example: keep the customer address in a customers table, not in each order row.

Q: What is the N+1 query problem?

You run 1 query to get a list. Then you run 1 more query for each item. 100 items = 101 queries. Fix: use a join, or load all related data in one query.

Q: What is SQL injection? How do you prevent it?

An attacker puts SQL code into user input. Fix: use parameterized queries. Never join user input into a SQL string.

// Bad
db.query(`SELECT * FROM users WHERE id = ${id}`);
// Good
db.query("SELECT * FROM users WHERE id = $1", [id]);

6. Authentication and security

Q: Authentication vs authorization?

Authentication: who are you? (log in)
Authorization: what can you do? (permissions)

Q: Sessions vs JWT?

Session: the server keeps the login data. The browser keeps only a session ID in a cookie.
JWT: a signed token that holds the user data. The server does not need to keep it.

JWT (JSON Web Token): a signed text string with user data. The server can check the signature to know that nobody changed it. Risk: you cannot easily cancel a JWT before it expires. Keep expiry times short.

Q: What is OAuth?

OAuth: a way to let one app use your account on another app without sharing your password. Example: "Log in with Google".

Q: What is XSS? What is CSRF?

XSS (Cross-Site Scripting): an attacker puts a script into your page. The script runs in other users' browsers. Fix: escape user output, use a Content Security Policy. React escapes text by default.

CSRF (Cross-Site Request Forgery): a bad site makes the user's browser send a request to your site with the user's cookies. Fix: CSRF tokens, SameSite cookies.

Q: What is CORS?

CORS (Cross-Origin Resource Sharing): a browser rule. It stops a page on site A from reading responses from site B, unless site B allows it. Example: frontend app.com calls api.com. api.com must send the header Access-Control-Allow-Origin: https://app.com.

Q: How do you store passwords?

Never store plain text. Use a slow hash function with salt, such as bcrypt or Argon2.

Hash: a one-way function. You cannot get the password back from the hash. Salt: random data added to each password before the hash. Two users with the same password get different hashes.

7. System design (basic level)

Q: How do you design a URL shortener? (common example)

Talk through these steps:

1. Requirements  → what must it do? how many users?
2. API           → POST /shorten, GET /:code
3. Data model    → table: code, long_url, created_at
4. Architecture  → client → load balancer → API servers → database
5. Scale         → add cache for popular links, more servers
6. Trade-offs    → explain what you chose and why

Q: Key terms

Load balancer: sends traffic to many servers so that no server gets too much work.

Cache: a fast store for data that you read often. Example: Redis keeps popular results in memory.

Horizontal scaling: add more servers. Vertical scaling: make one server bigger.

Message queue: a list of jobs for workers to do later. Example: send emails in the background with RabbitMQ or SQS.

Rate limiting: limit how many requests a user can send. Example: 100 requests per minute.

CAP theorem: in a distributed system, when the network fails, you must choose: Consistency (all users see the same data) or Availability (the system always answers).

8. Testing

Q: What types of tests are there?

Unit tests        → test one function. Many, fast.
Integration tests → test parts together (API + database).
End-to-end (E2E)  → test the full app like a user. Few, slow.

This shape is the testing pyramid: many unit tests at the bottom, few E2E tests at the top.

Q: What is TDD?

TDD (Test-Driven Development): write a failing test first. Then write code to pass it. Then clean the code. Cycle: Red → Green → Refactor.

Q: What is mocking?

Mock: a fake version of a dependency in a test. Example: replace a real payment API with a fake that always returns "success".

9. DevOps, Git, and tools

Q: What is CI/CD?

CI (Continuous Integration): each code push runs build and tests automatically. CD (Continuous Delivery/Deployment): code that passes tests is released automatically (or with one click).

Push code → build → test → deploy to staging → deploy to production

Q: What is Docker?

Docker: a tool that packs an app and everything it needs into a container. The container runs the same on every computer. Example: "It works on my machine" problems stop.

Q: Git merge vs rebase?

Merge: joins two branches. It keeps full history and adds a merge commit.
Rebase: moves your commits on top of another branch. History is a straight line.
Rule: do not rebase shared branches.

Q: How do you deal with a merge conflict?

Pull the latest code.
Open the files with conflicts.
Choose the correct code. Talk to the other developer if not sure.
Run tests.
Commit.

10. Coding / problem-solving round

Common topics:

Arrays and strings (reverse, find duplicates, two-sum).
Hash maps (count items, fast lookup).
Basic recursion.
Big O notation.

Big O: how the run time grows when the input grows.

O(1): same time for any size. Example: read arr[0].

O(n): time grows with size. Example: loop once over an array.

O(n²): loop inside a loop. Slow for big inputs.

O(log n): cut the problem in half each step. Example: binary search.

How to act in a live coding round:

1. Repeat the problem in your own words.
2. Ask questions about edge cases (empty input? negative numbers?).
3. Explain a simple solution first.
4. Write the code. Talk while you write.
5. Test with an example.
6. Talk about how to make it faster.

11. Questions to ask the interviewer

What does a normal day look like for this team?
What is the tech stack? Are there plans to change it?
How does the team do code reviews and testing?
What does success look like in the first 3 months?
What is the biggest challenge for the team now?

12. Next steps (to fill in later)

Add your own STAR stories (5 to 6).
Add company-specific notes for each interview.
Add stack-specific questions (for example: TypeScript, Next.js, Python, AWS).