Ezfinanz Interview Guide

Technical Interview — 40 Candidates

Each candidate has one Low, one Medium and one High question. Move forward only after the previous level is passed.

LowFundamentals and clarity
MediumPractical problem solving
HighEngineering depth and judgment
RuleLow Pass → Medium → High
Technical Interview

Candidate 1

Low Java

What is the difference between == and .equals()?

Expected solution
== compares primitive values or object references. .equals() compares object content when the class overrides it.
String a = new String("Java");
String b = new String("Java");

a == b        // false
a.equals(b)   // true
Interviewer should look for: Understand reference vs content.
Medium SQL

A query using customer_id is very slow on a large table. What would you check?

Expected solution
Check the execution plan, check whether customer_id has an index, verify whether the index is actually used, avoid unnecessary columns/joins, and check table statistics.
Interviewer should look for: Index + execution plan should be mentioned; increasing server size should not be the first answer.
High Backend

An API normally takes 200 ms but sometimes takes 10 seconds. How would you debug it?

Expected solution
1. Check application logs and request IDs.
2. Check database query time.
3. Check external API calls.
4. Check connection/thread pools.
5. Check CPU, memory and GC.
6. Use tracing/metrics to identify where the delay occurs.
Interviewer should look for: A strong candidate isolates the bottleneck before changing anything.
Technical Interview

Candidate 2

Low Java

What is the difference between ArrayList and LinkedList? When would you use each?

Expected solution
ArrayList gives fast random access and is generally the better default for most normal lists. LinkedList can be useful for insert/remove operations when you already have the relevant position, but random access is slow.
Interviewer should look for: They should not claim that LinkedList is simply faster.
Medium Coding

Find the first duplicate number in an array. Example: [4, 2, 7, 2, 5].

Expected solution
Use a HashSet.
Set<Integer> seen = new HashSet<>();

for (int n : arr) {
    if (!seen.add(n)) {
        return n;
    }
}
Average time O(n), space O(n).
Interviewer should look for: Look for a clean O(n)-average approach and awareness of space usage.
High System Design

Design a URL shortener.

Expected solution
Provide a POST endpoint to create a short URL, store shortCode → originalUrl, generate a unique short code, and use GET /{shortCode} to retrieve and redirect. Add a unique constraint/index on the short code. Consider caching popular URLs.
Interviewer should look for: Basic API + database + uniqueness + scalability thinking.
Technical Interview

Candidate 3

Low Java

What is the difference between an interface and an abstract class?

Expected solution
An interface defines a contract. An abstract class can contain shared state and implementation. A class can implement multiple interfaces but extend only one class.
Interviewer should look for: Look for a clear comparison and practical use case.
Medium SQL

Find the second-highest salary.

Expected solution
One valid approach:
SELECT MAX(salary)
FROM employee
WHERE salary < (SELECT MAX(salary) FROM employee);
A good candidate may also mention DENSE_RANK().
Interviewer should look for: They should recognize duplicate-salary considerations.
High Concurrency

Two threads update the same account balance. What can go wrong?

Expected solution
A race condition can cause a lost update.
Balance = 100

Thread A reads 100
Thread B reads 100
A writes 150
B writes 120
Possible solutions include synchronization, locking, atomic operations, or database transactions depending on the design.
Interviewer should look for: Look for understanding of concurrency rather than just naming synchronized.
Technical Interview

Candidate 4

Low Java

Explain HashMap. How does it generally find a value from a key?

Expected solution
The map calculates a hash from the key, uses it to identify a bucket, and then compares keys for equality to find the associated value.
Interviewer should look for: They should understand hash → bucket → equality at a high level.
Medium Coding

Find the first non-repeating character in the string "swiss".

Expected solution
Count frequencies with a HashMap, then scan the string again. The answer is w.
Interviewer should look for: Look for O(n) time and a clear two-pass or equivalent approach.
High Production

Application CPU becomes 90% after deployment. What do you do?

Expected solution
Confirm when CPU increased and correlate it with the deployment. Identify the high-CPU process/thread, inspect logs and metrics, take thread dumps or profile if required, find the responsible code path, and roll back if production impact is severe. Then fix the root cause.
Interviewer should look for: Strong answers mention thread dumps/profiling and evidence-based debugging.
Technical Interview

Candidate 5

Low SQL

What is the difference between INNER JOIN and LEFT JOIN?

Expected solution
INNER JOIN returns only matching records from both sides. LEFT JOIN returns all rows from the left table plus matching rows from the right table; unmatched right-side columns are NULL.
Interviewer should look for: Make sure they understand which side is preserved.
Medium SQL

Find customers who have more than 3 loans.

Expected solution
SELECT customer_id
FROM loans
GROUP BY customer_id
HAVING COUNT(*) > 3;
Interviewer should look for: Look for correct use of GROUP BY and HAVING.
High Database

A report query causes database CPU to reach 100%. What would you do?

Expected solution
Identify the query, inspect the execution plan, check indexes, reduce unnecessary joins and data, and consider pagination, summary/materialized data, a reporting database or read replica if appropriate.
Interviewer should look for: The candidate should understand that adding hardware is not the first solution.
Technical Interview

Candidate 6

Low Java

What are method overloading and method overriding?

Expected solution
Overloading uses the same method name with different parameters and is resolved at compile time. Overriding occurs when a subclass provides a different implementation of an inherited method and is resolved at runtime.
Interviewer should look for: Look for compile-time vs runtime distinction.
Medium Coding

Check whether brackets are balanced. Example: "{[()]}" → true, "{[(])}" → false.

Expected solution
Use a stack. Push opening brackets; for each closing bracket, verify that the top matches and pop it. The stack must be empty at the end.
Interviewer should look for: Look for stack usage and correct mismatch handling.
High API

A payment request is sent twice because the client retries. How do you prevent duplicate transactions?

Expected solution
Use idempotency. For example:
Idempotency-Key: ABC123
Store the result for that key and return the existing result when the same request arrives again.
Interviewer should look for: A strong candidate understands that checking amount alone is not enough.
Technical Interview

Candidate 7

Low Java

What is the difference between final, finally, and finalize?

Expected solution
final restricts variables/methods/classes; finally is a block normally run after try/catch; finalize() was an old GC-related mechanism and should not be relied upon.
Interviewer should look for: Good candidates know finalize() is deprecated and should not be used for resource management.
Medium Coding

Find the missing number from 1..N. Example: [1,2,3,5] → 4.

Expected solution
Use the arithmetic sum formula or XOR. For the sum approach, expectedSum = N*(N+1)/2 and subtract the actual sum.
Interviewer should look for: Look for O(n) time and O(1) extra space.
High Design

Design a notification system supporting SMS, email and push.

Expected solution
Create a common abstraction such as:
interface NotificationSender {
    void send(...);
}
Implement SmsSender, EmailSender and PushSender, then have the service depend on the abstraction.
Interviewer should look for: Look for extensibility, separation of concerns and easy addition of new channels.
Technical Interview

Candidate 8

Low Database

What is a primary key?

Expected solution
A primary key is a column or combination of columns that uniquely identifies each row. It cannot contain duplicate values and normally cannot be NULL.
Interviewer should look for: Look for uniqueness and row identification.
Medium SQL

Find duplicate emails.

Expected solution
SELECT email, COUNT(*)
FROM users
GROUP BY email
HAVING COUNT(*) > 1;
Interviewer should look for: Look for correct grouping and duplicate detection.
High Database

Two transactions update the same row at the same time. What can happen?

Expected solution
Depending on isolation and locking, you can see lost updates, blocking, dirty reads, non-repeatable reads, or deadlocks. Transactions, locking and appropriate isolation levels are possible controls.
Interviewer should look for: They should understand that concurrency behavior depends on the database and isolation model.
Technical Interview

Candidate 9

Low Java

What is inheritance?

Expected solution
Inheritance allows a class to derive behavior and properties from another class, supporting reuse and polymorphism.
Interviewer should look for: Look for a practical example rather than only a definition.
Medium Coding

Reverse the words in "I love Java".

Expected solution
Split the sentence into words and reverse their order: "Java love I".
Interviewer should look for: Look for awareness that word order changes, not the characters inside each word.
High Design

A loan can move through several states. How would you design it?

Expected solution
Use explicit states and validate allowed transitions:
NEW
 ↓
VERIFIED
 ↓
APPROVED
 ↓
DISBURSED
 ↓
CLOSED
Invalid transitions should be rejected.
Interviewer should look for: Strong candidates separate state-transition rules from controller/UI code.
Technical Interview

Candidate 10

Low Java

What is exception handling? What is the difference between checked and unchecked exceptions?

Expected solution
Checked exceptions are checked by the compiler. Unchecked exceptions extend RuntimeException and are not required to be declared or caught.
Interviewer should look for: Look for a clear reason why each category exists.
Medium Backend

An API returns HTTP 500. What do you check?

Expected solution
Check application logs and stack traces, request IDs, database failures, dependency APIs, configuration and recent deployment changes.
Interviewer should look for: Look for systematic investigation rather than guessing.
High Production

Deployment succeeded, but users report intermittent failures. What would you do?

Expected solution
Compare successful and failing requests, use logs/metrics/traces, determine whether only some servers are affected, inspect dependencies and configuration, compare application versions, and roll back if needed.
Interviewer should look for: Strong candidates think in terms of reproducibility, correlation and environment differences.
Technical Interview

Candidate 11

Low Java

What is garbage collection?

Expected solution
The JVM automatically identifies unreachable objects and reclaims their memory.
Interviewer should look for: Look for a basic understanding of reachability.
Medium Java

What happens if you create millions of unnecessary objects?

Expected solution
More allocations can increase GC activity, CPU usage and latency, and can eventually contribute to OutOfMemoryError if memory pressure is too high.
Interviewer should look for: They should connect allocation rate with GC pressure.
High JVM

A Java application has frequent GC and slow responses. What would you investigate?

Expected solution
Check heap usage, GC metrics/logs, allocation rate, heap dumps if needed, object retention and possible memory leaks, plus JVM configuration.
Interviewer should look for: Look for measurement-driven JVM troubleshooting.
Technical Interview

Candidate 12

Low SQL

What is the difference between WHERE and HAVING?

Expected solution
WHERE filters rows before grouping. HAVING filters groups after GROUP BY.
Interviewer should look for: A good candidate can give a simple aggregate example.
Medium SQL

Find the department with the highest average salary.

Expected solution
SELECT department_id, AVG(salary) AS avg_salary
FROM employee
GROUP BY department_id
ORDER BY avg_salary DESC
LIMIT 1;
Interviewer should look for: Look for GROUP BY plus aggregate ordering.
High SQL Performance

A query works quickly with 10,000 rows but becomes very slow at 20 million. Why?

Expected solution
Larger data changes execution cost. Inspect the execution plan, indexes, joins, filtering selectivity, sorting and grouping, and check for full table scans.
Interviewer should look for: Look for understanding of scale rather than saying 'the DB is slow'.
Technical Interview

Candidate 13

Low OOP

What is encapsulation?

Expected solution
Encapsulation keeps data and behavior together and controls access to internal state. For example, a balance field can be private and modified only through controlled methods.
Interviewer should look for: Look for data protection plus behavior, not just 'private variables'.
Medium Coding

Determine whether "listen" and "silent" are anagrams.

Expected solution
Count character frequencies or sort both strings and compare. A frequency map gives O(n) average time.
Interviewer should look for: Look for correct handling of repeated characters.
High Architecture

Why separate controller, service and repository layers?

Expected solution
Controller handles API/HTTP concerns, service contains business logic, repository handles data access. Separation improves testing, maintenance and clarity.
Interviewer should look for: Strong candidates can explain what should and should not live in each layer.
Technical Interview

Candidate 14

Low Java

What is the difference between String and StringBuilder?

Expected solution
String is immutable, so repeated concatenation can create many objects. StringBuilder is mutable and is useful for repeated string modifications.
Interviewer should look for: A stronger candidate may mention StringBuffer for synchronized/multithreaded use cases.
Medium Coding

Find the longest substring without repeating characters. Example: "abcabcbb" → 3.

Expected solution
Use a sliding window with a set or map to track the current window. Average O(n) time.
Interviewer should look for: Look for the sliding-window idea.
High Performance

1,000 records process in 2 seconds but 25,000 take 50 seconds. How do you determine the problem?

Expected solution
Check algorithmic complexity, number of database queries, network calls, CPU, memory, batching and external APIs. An N+1 query pattern or O(n²) algorithm could explain non-linear growth.
Interviewer should look for: Look for separation of CPU, DB, network and algorithmic bottlenecks.
Technical Interview

Candidate 15

Low HTTP

What are GET, POST, PUT and DELETE used for?

Expected solution
GET retrieves, POST creates or triggers processing, PUT replaces/updates a resource, and DELETE removes a resource.
Interviewer should look for: Expect correct semantics, not necessarily textbook wording.
Medium API

Design an API for creating a loan.

Expected solution
A reasonable example:
POST /loans
Request:
{
  "customerId": "C123",
  "amount": 50000,
  "tenure": 12
}
Validate the fields and return an appropriate success/error response.
Interviewer should look for: Look for validation, status codes and clear resource naming.
High API Versioning

Backend changes but old mobile applications must continue working. What do you do?

Expected solution
Use backward-compatible changes and, when needed, version the API, e.g. /api/v1/loans and /api/v2/loans. Deprecate old versions gradually.
Interviewer should look for: Strong candidates understand compatibility as a contract.
Technical Interview

Candidate 16

Low Java

What is polymorphism?

Expected solution
The same interface or parent type can refer to objects of different concrete implementations, allowing behavior to vary at runtime.
Interviewer should look for: Look for a simple example with overriding.
Medium Algorithms

Find the top K largest elements.

Expected solution
Use a min-heap of size K, keeping only the K largest values. Complexity is O(n log k).
Interviewer should look for: Look for understanding of why sorting everything is unnecessary.
High Algorithms

What if the input contains 100 million numbers?

Expected solution
Still avoid sorting all values if only K are needed. A streaming min-heap of size K gives O(n log k) time and O(k) extra space. If requirements change, consider external-memory or distributed approaches.
Interviewer should look for: Strong candidates connect the solution to memory limits and streaming.
Technical Interview

Candidate 17

Low Database

What is normalization?

Expected solution
Normalization organizes data to reduce unnecessary duplication and improve consistency.
Interviewer should look for: They should know it is about logical schema design, not simply 'more tables'.
Medium Database

Design customer and loan tables where one customer can have many loans.

Expected solution
For example:
customer
---------
customer_id PK
name

loan
---------
loan_id PK
customer_id FK
amount
status
Interviewer should look for: Look for the one-to-many relationship and foreign key.
High Database

When would you denormalize?

Expected solution
When read performance or reporting requirements justify controlled duplication or precomputed data. It is a trade-off involving consistency, storage and write complexity.
Interviewer should look for: Strong candidates explain why, not just 'denormalization is faster'.
Technical Interview

Candidate 18

Low Java

What is the difference between HashSet, HashMap and ArrayList?

Expected solution
ArrayList is a list with order and duplicates allowed. HashSet stores unique values. HashMap stores key/value pairs.
Interviewer should look for: Look for the purpose of each collection.
Medium Coding

Remove duplicate values from a list while preserving the original order.

Expected solution
Use a LinkedHashSet, or track seen values with a Set while building a result list.
Interviewer should look for: Look for preservation of insertion order.
High Java

What happens if a HashMap key is modified after insertion?

Expected solution
If fields participating in hashCode()/equals() change, the map may look in a different bucket and fail to find the key. Mutable keys are therefore dangerous.
Interviewer should look for: This is a strong test of whether they genuinely understand HashMap behavior.
Technical Interview

Candidate 19

Low Git

What is the difference between git merge and git rebase?

Expected solution
Merge combines histories and creates a merge commit when necessary. Rebase moves commits onto a new base to create a more linear history.
Interviewer should look for: Look for understanding of history rewriting.
Medium Git

You have local changes and need the latest remote changes. What can you do safely?

Expected solution
Commit the local work, or stash it, update the branch, and then reapply the changes if needed. Avoid blindly pulling over uncommitted changes that would conflict.
Interviewer should look for: Look for safe handling of uncommitted work.
High Git

A bad commit is already pushed to a shared production branch. What would you use?

Expected solution
Usually git revert, because it creates a new commit that reverses the bad change without rewriting shared history. Reset/rewrite should be avoided on shared history unless there is a controlled reason.
Interviewer should look for: Strong candidate understands collaboration safety.
Technical Interview

Candidate 20

Low Linux

What is the difference between a process and a thread?

Expected solution
A process is an independent execution unit with its own address space. Threads are execution units within a process and share process memory.
Interviewer should look for: Look for the memory-sharing distinction.
Medium Linux

A Java process has high CPU. What commands/tools might you use?

Expected solution
Examples:
top
ps
jps
jstack
You can identify the hot process/thread and then inspect thread stacks or use a profiler.
Interviewer should look for: Look for a logical investigation sequence, not only a list of commands.
High Production

A server has high CPU, high memory and low disk space. What would you investigate first?

Expected solution
Determine which resource is causing the immediate service risk and which process is consuming it. Then address the highest-risk problem while investigating the others.
Interviewer should look for: Strong candidates prioritize based on evidence and impact rather than blindly restarting.
Technical Interview

Candidate 21

Low Spring

What is Dependency Injection?

Expected solution
Dependency Injection means a class receives the objects it depends on instead of creating them itself.
class LoanService {
    private final LoanRepository repository;

    LoanService(LoanRepository repository) {
        this.repository = repository;
    }
}
Interviewer should look for: They should understand that dependencies are provided from outside.
Medium Spring

What problem does @Autowired solve?

Expected solution
Spring finds a suitable bean and injects it into the required class. Constructor injection is generally preferred because dependencies are explicit and easier to test.
Interviewer should look for: Look for understanding of the container/bean concept.
High Spring

You have three implementations of the same interface. How can Spring know which one to inject?

Expected solution
Use mechanisms such as:
@Qualifier("emailSender")
or
@Primary
to resolve ambiguity.
Interviewer should look for: They should understand that multiple beans can create injection ambiguity.
Technical Interview

Candidate 22

Low Spring Boot

What is application.properties or application.yml used for?

Expected solution
It stores application configuration such as server ports, database URLs, feature settings and other environment-dependent values.
Interviewer should look for: Look for configuration vs business logic distinction.
Medium Spring Boot

How would you maintain different configuration for development and production?

Expected solution
Use profiles such as application-dev.properties and application-prod.properties, and activate the appropriate profile.
Interviewer should look for: A strong candidate may mention environment variables overriding sensitive values.
High Security

Where should database passwords and API secrets be stored in production?

Expected solution
Not directly in source code or Git. Use environment variables, a secret manager, or secure deployment configuration. Restrict access and rotate secrets as appropriate.
Interviewer should look for: Look for practical secret-management awareness.
Technical Interview

Candidate 23

Low HTTP

What do 200, 400, 401, 403, 404 and 500 mean?

Expected solution
CodeMeaning
200Success
400Bad request
401Authentication required/invalid
403Authenticated but not allowed
404Resource not found
500Server-side error
Interviewer should look for: They should know the distinction between 401 and 403.
Medium API

What is the difference between 400 and 422?

Expected solution
Both are commonly used for client-side request problems. 400 often means the request is invalid/malformed; 422 is often used when the syntax is valid but the data fails semantic validation. Teams should apply a consistent convention.
Interviewer should look for: Look for nuanced understanding rather than insisting there is only one permitted convention.
High API Integration

An external API sometimes takes 20 seconds or fails. How would you make your application reliable?

Expected solution
Use connection/read timeouts, bounded retries with exponential backoff where safe, circuit breaking where appropriate, good logging and clear failure handling. Never blindly retry operations that may create duplicate transactions.
Interviewer should look for: Look for retry safety, idempotency and timeouts.
Technical Interview

Candidate 24

Low OOP

What is the purpose of SOLID principles?

Expected solution
SOLID principles are design guidelines intended to make software easier to maintain, extend and test.
Interviewer should look for: Ask them to explain one principle in practical terms if needed.
Medium Design

You find a class containing 2,000 lines of code. What would you do?

Expected solution
Understand its responsibilities first, identify separable responsibilities, add/verify tests, then refactor incrementally rather than rewriting blindly.
Interviewer should look for: Look for risk-aware refactoring.
High Architecture

Someone proposes one huge LoanService containing every loan-related operation. Would you agree?

Expected solution
Not automatically. A loan domain can still be divided into meaningful responsibilities such as application, verification, approval and disbursement. The decision should be driven by cohesion, dependencies and maintainability, not arbitrary class size.
Interviewer should look for: Strong candidates reason about boundaries rather than applying a slogan.
Technical Interview

Candidate 25

Low Database

What is a database index?

Expected solution
An index is a data structure that lets the database locate rows more efficiently for many queries without scanning every row.
Interviewer should look for: Look for a performance-focused but accurate explanation.
Medium Database

Why can too many indexes be a problem?

Expected solution
Indexes consume storage and make inserts, updates and deletes more expensive because the relevant indexes must also be maintained.
Interviewer should look for: Look for read/write trade-off awareness.
High Database Architecture

Your system has heavy writes and expensive reporting queries. How could you separate those workloads?

Expected solution
Possible approaches include a read replica, reporting database, ETL/data warehouse, materialized or summary data, and asynchronous report generation.
Interviewer should look for: Strong candidates understand protecting transactional workload from reporting workload.
Technical Interview

Candidate 26

Low Concurrency

What is a race condition?

Expected solution
A race condition occurs when the result depends on the timing/order of concurrent operations and produces an incorrect or unexpected result.
Interviewer should look for: Look for a simple shared-state example.
Medium Java

How can synchronized help prevent a race condition?

Expected solution
It allows only one thread at a time to execute the protected critical section for the same monitor.
synchronized void withdraw(int amount) {
    balance -= amount;
}
Interviewer should look for: Look for understanding of the lock/monitor concept.
High Concurrency

A method is synchronized but the application still has incorrect results. Why?

Expected solution
Possible reasons include synchronizing on different objects, modifying shared state elsewhere, having multiple application instances, or protecting Java memory while the true shared resource is a database.
Interviewer should look for: Strong candidates know the scope of synchronized is limited.
Technical Interview

Candidate 27

Low Networking

What happens when you enter a URL in a browser?

Expected solution
At a high level: DNS lookup → TCP/TLS connection → HTTP request → server processing → HTTP response → browser rendering.
Interviewer should look for: Keep the expected answer at a high level.
Medium Networking

Why is HTTPS preferred over HTTP?

Expected solution
HTTPS uses TLS to provide encryption, server authentication and integrity for the communication channel.
Interviewer should look for: Look for all three concepts if they are comfortable.
High Networking

An API works from Server A but times out from Server B. What would you check?

Expected solution
Compare DNS, routing, firewall/security groups, proxy, port connectivity, TLS/certificates, application/network configuration and server-specific restrictions.
Interviewer should look for: Strong candidates compare environments systematically.
Technical Interview

Candidate 28

Low Data Structures

What is a stack?

Expected solution
A stack is a LIFO structure: last in, first out.
Interviewer should look for: A simple push/pop example is enough.
Medium Coding

How can you implement a queue using two stacks?

Expected solution
Use one stack for incoming elements and another for outgoing elements. When the output stack is empty, transfer elements from the input stack to the output stack.
Interviewer should look for: Look for understanding of amortized behavior.
High Data Structures

You continuously receive millions of records but only need to keep the latest 10,000. What would you use?

Expected solution
A bounded queue/deque or circular buffer. The design should prevent memory from growing without limit.
Interviewer should look for: Look for a constant-size memory approach.
Technical Interview

Candidate 29

Low Algorithms

What does Big-O notation represent?

Expected solution
It describes how time or space usage grows as input size increases.
Interviewer should look for: They should know common examples such as O(1), O(log n), O(n), O(n²).
Medium Algorithms

Compare searching in an unsorted array, sorted array and a hash-based collection.

Expected solution
Unsorted array: O(n). Sorted array with binary search: O(log n). Hash lookup: O(1) average.
Interviewer should look for: Look for assumptions behind the complexity.
High Engineering Judgment

You find an O(n²) algorithm. Should you automatically replace it?

Expected solution
No. First determine actual input size, execution frequency, real performance impact, and the risk/cost of changing it. Optimize when it is justified by evidence.
Interviewer should look for: Strong candidates understand engineering trade-offs.
Technical Interview

Candidate 30

Low Testing

What is unit testing?

Expected solution
Testing a small, isolated unit of code, usually a method or class, independently from external dependencies.
Interviewer should look for: Look for isolation and repeatability.
Medium Testing

What is the difference between unit and integration testing?

Expected solution
Unit tests isolate one unit. Integration tests verify interactions between components, such as an application and database or external service.
Interviewer should look for: Look for a practical example.
High Testing Strategy

A critical financial calculation has almost no automated tests. How would you introduce testing?

Expected solution
Understand current behavior, add tests for expected results, cover edge cases and known bugs, gradually increase coverage, and integrate tests into CI/CD. Meaningful protection matters more than chasing a 100% number.
Interviewer should look for: Look for safe incremental adoption.
Technical Interview

Candidate 31

Low Security

What is SQL injection?

Expected solution
SQL injection happens when attacker-controlled input changes the intended SQL statement so unintended SQL is executed.
Unsafe example:
"SELECT * FROM users WHERE name = '" + input + "'"
Interviewer should look for: Look for understanding of code/data separation.
Medium Security

How do prepared statements help prevent SQL injection?

Expected solution
They separate SQL structure from parameter values, so user input is treated as data rather than SQL syntax.
Interviewer should look for: Look for parameter binding, not just 'escaping'.
High Security

An API exposes sensitive customer information. What security controls would you consider?

Expected solution
Authentication, authorization, HTTPS, input validation, parameterized SQL, rate limiting, secure secrets, audit logging, least privilege, and avoiding sensitive data in logs.
Interviewer should look for: Strong candidates distinguish authentication from authorization and include defense in depth.
Technical Interview

Candidate 32

Low Security

What is authentication versus authorization?

Expected solution
Authentication answers 'Who are you?'. Authorization answers 'What are you allowed to do?'.
Interviewer should look for: This is simple but important.
Medium JWT

How does JWT authentication generally work?

Expected solution
User logs in → server validates credentials → server issues JWT → client sends token with requests → server validates token → request is authorized.
Interviewer should look for: Look for awareness that JWT is a token format, not a replacement for all authorization design.
High Security

Someone steals a user's JWT. What can you do to reduce the impact?

Expected solution
Use short token lifetimes, secure storage, refresh-token strategies, revocation mechanisms where needed, TLS, suspicious-activity detection and least privilege.
Interviewer should look for: Strong candidates understand that a stolen valid token may be usable until expiry/revocation.
Technical Interview

Candidate 33

Low Backend

What is caching?

Expected solution
Caching stores frequently accessed data in a faster location so future requests can often be served more quickly.
Interviewer should look for: Look for the idea of a fast copy and repeated reads.
Medium Backend

Customer details are requested thousands of times but rarely change. How could caching help?

Expected solution
Use a cache-aside style flow: check cache first; on a miss read from the database and store the result in cache.
Interviewer should look for: Look for cache hit/miss understanding.
High Distributed Systems

Database data changes but the cache still contains the old value. How would you handle this?

Expected solution
Use cache invalidation after updates, cache update after successful writes, TTLs, versioning, or other consistency mechanisms depending on the system.
Interviewer should look for: Strong candidates call out the cache invalidation/consistency problem.
Technical Interview

Candidate 34

Low Messaging

What is a message queue?

Expected solution
A mechanism where producers send messages and consumers process them asynchronously.
Interviewer should look for: Basic producer → queue → consumer understanding is enough.
Medium Backend

Why use a message queue instead of processing everything synchronously?

Expected solution
It enables asynchronous work, better response times, buffering during load, decoupling and independent scaling.
Interviewer should look for: Look for practical reasoning, not just 'it is faster'.
High Distributed Systems

A consumer crashes after processing a message but before acknowledging it. What could happen?

Expected solution
The message may be delivered again. Consumers should often be idempotent, with suitable acknowledgment, retry and dead-letter strategies.
Interviewer should look for: Strong candidates understand at-least-once delivery implications.
Technical Interview

Candidate 35

Low Database

What is a transaction?

Expected solution
A transaction is a group of database operations treated as one logical unit, with defined consistency/atomicity behavior.
Interviewer should look for: Look for atomicity or all-or-nothing understanding.
Medium Database

What do COMMIT and ROLLBACK do?

Expected solution
COMMIT permanently saves the successful transaction changes; ROLLBACK undoes uncommitted changes.
Interviewer should look for: Look for a correct transactional example.
High Financial System

A disbursement updates the database and then calls an external payment API. The DB succeeds but the API fails. What would you do?

Expected solution
Treat this as a distributed consistency problem. Store a pending state, call the external service, update final status, use safe retries/idempotency and reconciliation. A normal local DB transaction cannot automatically roll back an already-processed external call.
Interviewer should look for: Excellent candidates mention eventual consistency and reconciliation.
Technical Interview

Candidate 36

Low Java

What is an immutable object?

Expected solution
An immutable object cannot have its state changed after creation. String is a common example.
Interviewer should look for: Look for a clear state-cannot-change definition.
Medium Java

How would you create an immutable class?

Expected solution
Typical rules:
  • Make the class final.
  • Make fields private and final.
  • Initialize through the constructor.
  • Do not provide setters.
  • Use defensive copies for mutable fields.
Interviewer should look for: Look for defensive copying of mutable members.
High Concurrency

Why is immutability useful in multi-threaded applications?

Expected solution
Because immutable state cannot be changed unexpectedly, multiple threads can safely share the object without synchronization for those state changes.
Interviewer should look for: Strong candidates explain safety and reduced coordination.
Technical Interview

Candidate 37

Low Logging

Why are logs important?

Expected solution
Logs help understand application behavior, investigate failures and troubleshoot production problems.
Interviewer should look for: Look for observability thinking.
Medium Debugging

A user says a transaction failed but you cannot reproduce it. What should you look for in logs?

Expected solution
Look for timestamp, request/transaction ID, relevant customer/loan identifier, error/exception, API responses, dependency calls and environment/server information.
Interviewer should look for: Strong candidates emphasize correlation IDs.
High Observability

How would you monitor a production loan system?

Expected solution
Logs: important events and errors.
Metrics: latency, error rate, throughput, CPU, memory, DB connections, queue depth, etc.
Traces: follow a request across services.
Interviewer should look for: Strong candidate clearly distinguishes logs, metrics and traces.
Technical Interview

Candidate 38

Low Docker

What is a Docker container?

Expected solution
A container is an isolated runtime environment used to package and run an application with its dependencies.
Interviewer should look for: Look for the distinction from a full virtual machine.
Medium Docker

What is the difference between a Docker image and a container?

Expected solution
An image is the packaged/template artifact; a container is a running instance created from an image.
Interviewer should look for: Look for the template-vs-running-instance distinction.
High Deployment

Application works locally but fails after production deployment. What would you check?

Expected solution
Check environment variables, configuration, runtime versions, DB connectivity, network/firewall, dependencies, permissions, secrets, logs and production-data differences.
Interviewer should look for: Strong candidates compare environments systematically before rewriting code.
Technical Interview

Candidate 39

Low Engineering

What is technical debt?

Expected solution
Technical debt is the future cost created by taking a quick or imperfect technical approach instead of a better long-term solution.
Interviewer should look for: Look for understanding of future maintenance cost.
Medium Code Quality

You find the same business logic duplicated in five classes. What would you do?

Expected solution
Verify that the logic is genuinely the same, add tests where needed, extract common behavior into an appropriate abstraction, and refactor carefully.
Interviewer should look for: Strong candidate checks whether duplication is accidental or meaningful before extracting.
High Engineering Judgment

A production bug can be fixed in 10 minutes with a quick patch, but the proper solution requires two days. What do you do?

Expected solution
It depends on business impact. A safe immediate mitigation may restore service first, followed by root-cause analysis, the proper fix, and a regression test.
Interviewer should look for: The candidate should balance urgency, risk and long-term correctness.
Technical Interview

Candidate 40

Low Backend

What is the difference between synchronous and asynchronous processing?

Expected solution
Synchronous processing makes the caller wait for completion. Asynchronous processing allows work to continue separately while the caller can move on.
Interviewer should look for: Look for caller-blocking vs background processing.
Medium API Design

A request takes 30 seconds to process. Should the client wait for 30 seconds?

Expected solution
Usually not. A common design is:
POST /applications
→ create request
→ return 202 Accepted + request ID
→ background processing
→ client checks status or receives notification
Interviewer should look for: Look for API responsiveness and background processing.
High Full System Design

Design a loan application system from application creation to disbursement.

Expected solution
A strong answer can cover: API: endpoints, validation, authentication.
Database: customer, application/loan, status/history, transaction records.
Workflow: application → verification → approval → disbursement → repayment.
Async: queue for long-running work.
Reliability: retries, idempotency, failure handling, reconciliation.
Security: authorization, encryption, secret handling.
Monitoring: logs, metrics and alerts.
Interviewer should look for: Very strong candidates may also discuss state machines, audit trails, service boundaries, transactions and observability.