---
title: "Backend Developer Interview Questions: 40+ Questions with Answers (2026)"
description: "Comprehensive list of backend developer interview questions covering APIs, databases, system design, security, and scalability. Prepare for interviews at top tech companies."
canonical: "https://mortit.com/blog/backend-developer-interview-questions"
---
Interview Prep

# Backend Developer Interview Questions

40+ questions asked at top tech companies-with detailed answers and practical tips for each.

20 min read Updated February 2026

TL;DR

Backend interviews test six areas: **APIs/REST** (design, authentication, versioning), **Databases** (SQL, NoSQL, indexing, optimization), **System Design** (scalability, caching, queues), **Security** (auth flows, vulnerabilities), **Scalability** (microservices, load balancing), and **Behavioral**. The strongest candidates explain tradeoffs clearly-there is no single right answer in backend design.

## What Backend Interviews Test

Backend developer interviews focus on how well you design systems that are reliable, scalable, and secure. Unlike frontend interviews where the output is visual, backend interviews are about reasoning through tradeoffs and understanding how components fit together.

| Category | What It Tests | Example Question |
| --- | --- | --- |
| **APIs/REST** | Design principles, HTTP, authentication | "Design a RESTful API for a bookstore" |
| **Databases** | Schema design, queries, optimization | "When would you choose NoSQL over SQL?" |
| **System Design** | Architecture, scalability, reliability | "Design a URL shortener at scale" |
| **Security** | Auth, vulnerabilities, best practices | "How does OAuth 2.0 work?" |
| **Scalability** | Performance, caching, load handling | "How would you handle 10x traffic overnight?" |
| **Behavioral** | Collaboration, incident response, ownership | "Tell me about a production outage you handled" |

## API & REST Questions

API design is fundamental to backend work. Interviewers test whether you understand RESTful principles deeply or just know how to set up routes.

1.  **What are the key principles of RESTful API design?**
2.  **Explain the difference between PUT and PATCH. When do you use each?**
3.  **How do you version an API? What are the tradeoffs between URL versioning, header versioning, and query parameter versioning?**
4.  **What is the difference between authentication and authorization? How would you implement both?**
5.  **Explain idempotency. Which HTTP methods are idempotent and why does it matter?**
6.  **How would you design pagination for an API that returns large datasets?**
7.  **What is rate limiting? How would you implement it?**
8.  **Explain the difference between REST and GraphQL. When would you choose each?**

**Sample Answer: PUT vs PATCH:**

**PUT** replaces the entire resource. If you PUT a user object, you must include all fields-any omitted fields get set to their defaults or null. It is idempotent: sending the same PUT request multiple times produces the same result.

**PATCH** partially updates a resource. You only send the fields you want to change. It is more bandwidth-efficient for updating a single field on a large object.

In practice, I use PATCH for most update operations because clients rarely want to replace an entire resource. I use PUT when the client is expected to send the complete representation, such as updating a configuration file.

#### API Design Tip

When asked to design an API in an interview, start with the resources (nouns) and operations (HTTP verbs). Define clear URL patterns, consistent error responses, and think about edge cases like partial failures in batch operations. Interviewers care more about your thought process than memorizing status codes.

## Database Questions

Database questions test whether you can design schemas that perform well at scale and write queries that do not bring production to its knees.

9.  **When would you choose a relational database versus a NoSQL database? Give specific examples.**
10.  **Explain database normalization. What are the tradeoffs of normalizing vs denormalizing?**
11.  **What is an index? How does a B-tree index work? When would an index hurt performance?**
12.  **Explain ACID properties. How do they apply to real-world transactions?**
13.  **What is the N+1 query problem? How do you solve it?**
14.  **Explain database sharding. What are the different sharding strategies?**
15.  **What is database replication? Explain the difference between synchronous and asynchronous replication.**
16.  **How would you migrate a database schema in production without downtime?**

**Sample Answer: N+1 Query Problem:**

The N+1 problem occurs when code fetches a list of N records and then makes a separate query for each record to fetch related data. For example, fetching 100 blog posts and then querying the author for each post individually-that is 101 queries instead of 2.

**Solutions:**

1\. **Eager loading / JOIN:** Fetch posts and authors in a single query using a JOIN

2\. **Batch loading:** Collect all author IDs, then fetch them in one WHERE IN query

3\. **ORM-specific:** Use tools like DataLoader (GraphQL), includes (Rails), or select\_related (Django)

I always check for N+1 queries during code review by examining ORM query logs in development.

## System Design Questions

System design rounds are standard for mid-level and senior backend roles. The interviewer wants to see that you can think about architecture holistically and communicate tradeoffs clearly.

17.  **Design a URL shortener like bit.ly. How would you handle billions of URLs?**
18.  **Design a notification service that supports email, SMS, and push notifications.**
19.  **How would you design a chat application that supports group chats and message history?**
20.  **Design a rate limiter. Compare token bucket, sliding window, and fixed window approaches.**
21.  **How would you design a job queue system for processing background tasks?**
22.  **Explain the CAP theorem. Give a practical example of how you would choose between consistency and availability.**

#### Framework: System Design Answers

**1\. Clarify requirements:** Ask about scale, latency, consistency needs

**2\. High-level design:** Draw the major components (API, database, cache, queue)

**3\. Deep dive:** Focus on the most critical component for this problem

**4\. Address bottlenecks:** Where will this break at 10x scale? How do you fix it?

**5\. Tradeoffs:** Explicitly state what you are optimizing for and what you are sacrificing

## Security Questions

Security is non-negotiable for backend roles. Interviewers want to know you build secure systems by default, not as an afterthought.

23.  **How does OAuth 2.0 work? Explain the authorization code flow.**
24.  **What is JWT? What are its security considerations?**
25.  **Explain SQL injection. How do you prevent it?**
26.  **What is CORS? Why does it exist and how do you configure it properly?**
27.  **How do you store passwords securely? What is bcrypt and why is it preferred over SHA-256?**
28.  **What is CSRF? How do you prevent it in a stateless API?**
29.  **Explain the principle of least privilege. How do you apply it in API design?**

**Sample Answer: Password Storage:**

Never store passwords in plaintext or with a reversible encryption. Use a slow hashing algorithm specifically designed for passwords.

**bcrypt** is preferred because: 1) It is deliberately slow, making brute-force attacks expensive, 2) It includes a built-in salt, preventing rainbow table attacks, 3) It has a configurable work factor that can be increased as hardware gets faster.

**SHA-256** is a fast hash designed for data integrity, not password storage. Its speed makes it vulnerable to brute-force attacks-a modern GPU can compute billions of SHA-256 hashes per second versus a few thousand bcrypt hashes.

In 2026, argon2id is another excellent choice as it is memory-hard, making it resistant to GPU-based attacks as well.

#### Security Red Flag

If you mention storing JWTs in localStorage during an interview, be ready to discuss XSS risks. Many interviewers consider httpOnly cookies the safer default for browser-based authentication. Know the tradeoffs of both approaches.

## Scalability Questions

These questions test your ability to reason about systems that handle millions of requests. You do not need to have built Netflix, but you need to understand the patterns.

30.  **What is the difference between horizontal and vertical scaling? When do you use each?**
31.  **How does caching work? Compare Redis, Memcached, and CDN caching.**
32.  **What are message queues? When would you use Kafka vs RabbitMQ?**
33.  **Explain microservices vs monolith. What are the real-world tradeoffs?**
34.  **How does a load balancer work? Explain different load balancing algorithms.**
35.  **What is eventual consistency? Give an example of when it is acceptable.**

#### Scalability Cheat Sheet

**Read-heavy:** Add read replicas, caching layers (Redis/CDN)

**Write-heavy:** Consider message queues, event sourcing, database sharding

**Compute-heavy:** Background job queues, horizontal scaling with auto-scaling groups

**Global scale:** Multi-region deployment, CDNs, geo-distributed databases

## Behavioral Questions

Backend developers often deal with production incidents, cross-team dependencies, and complex technical decisions. Behavioral questions test your judgment under pressure.

36.  **Tell me about a production incident you were involved in. How did you respond?**
37.  **Describe a time you had to choose between shipping fast and shipping correctly.**
38.  **How do you approach code reviews? What do you look for?**
39.  **Tell me about a time you had to migrate or deprecate a critical system.**
40.  **How do you handle technical debt? Give an example of how you prioritized it.**
41.  **Describe a situation where you had to push back on a product requirement for technical reasons.**

**Sample Answer: Production Incident:**

**Situation:** Our payment processing service started returning 500 errors during a Black Friday sale, affecting about 15% of checkout attempts.

**Task:** As the on-call engineer, I needed to restore service while minimizing revenue loss.

**Action:** I immediately checked metrics dashboards and identified that our database connection pool was exhausted. I scaled up the connection pool as a temporary fix within 10 minutes. Then I investigated the root cause: a new feature had introduced a query that held connections open for 30+ seconds. I disabled the feature flag, wrote a fix for the query, and deployed it that evening.

**Result:** Total downtime was 12 minutes. I wrote a post-mortem documenting the incident, added connection pool monitoring alerts, and introduced a CI check that flags queries without timeouts.

## How to Practice

Backend interviews reward depth over breadth. Here is a focused preparation strategy.

-   **Build something real:** Create a small API with auth, database, caching, and background jobs
-   **Study system design:** Read about how companies like Uber, Stripe, and Discord architect their systems
-   **Practice SQL:** Write complex queries involving joins, window functions, and optimization
-   **Understand security:** Read the OWASP Top 10 and know how each vulnerability works
-   **Mock interviews:** Practice explaining architectural decisions out loud

Backend interviews are as much about communication as they are about technical knowledge. You need to explain why you chose a specific database, caching strategy, or architecture pattern. [MORT's Interview Practice](https://mortit.com/features/interview-practice) helps you rehearse system design explanations and get feedback on your communication clarity.

## Practice backend interviews with AI

MORT's Interview Practice includes backend-specific questions covering APIs, databases, system design, and security. Get instant feedback on your technical explanations.

[Learn About Interview Practice](https://mortit.com/features/interview-practice) [Try a Free Mock Interview](https://app.mortit.com/signup)

## More Interview Resources

### [Software Engineer Interview Questions](https://mortit.com/blog/software-engineer-interview-questions)

General SWE questions covering algorithms and system design

### [AI Job Matching](https://mortit.com/features/ai-job-matching)

Find roles matched to your skills with AI

### [Complete Interview Prep Guide](https://mortit.com/blog/interview-preparation-guide)

Everything you need from research to follow-up