API Design 1. What makes an API "RESTful"? Which REST constraints do teams most often violate in practice?2. Which HTTP methods are idempotent, and why does idempotency matter for retry-safe clients?3. How would you implement idempotency keys for a POST endpoint that creates a payment or order?4. When would you return 200 vs 201 vs 204? What about 400 vs 401 vs 403 vs 404 vs 409 vs 422?5. Compare offset pagination and cursor-based pagination. Why does offset degrade on large, frequently-written tables?6. Design a consistent error response format. Have you seen RFC 7807 (Problem Details), and would you adopt it?7. Compare API versioning strategies (URL path, header, query param). When is versioning actually necessary vs. avoidable with additive changes?8. How do rate-limiting algorithms differ (fixed window, sliding window, token bucket)? What should the 429 response include?9. REST vs GraphQL vs tRPC/RPC: give a concrete scenario where each is the right choice.10. How do you avoid N+1 queries when an endpoint returns nested resources? Embed vs. link related resources — tradeoffs?11. Compare API keys, OAuth 2.0 client credentials, and JWT bearer tokens for server-to-server APIs.12. Design a webhook delivery system: signing, retries with backoff, ordering guarantees, and idempotent receivers.13. How do you expose a long-running operation over HTTP (e.g., a report generation)? Compare 202 + status polling vs. webhooks vs. WebSockets.14. PUT vs PATCH: what's the semantic difference, and how do JSON Patch and JSON Merge Patch differ?15. How do ETag, Last-Modified, and Cache-Control enable conditional requests and bandwidth savings?16. How would you design file upload/download in an API — multipart uploads vs. presigned S3 URLs? What changes at 5MB vs 5GB?17. In a multi-tenant API, where should tenant identity come from (subdomain, header, JWT claim), and how do you guarantee cross-tenant requests are rejected?18. Design-first (OpenAPI spec) vs code-first: tradeoffs, and how does contract testing fit in?19. How do you evolve an API without breaking existing mobile clients that may never update?20. Design exercise: a paginated, filterable audit-log API for a multi-tenant healthcare SaaS where auditors must only see their own tenant's data. Backend Engineering 1. Walk through the Node.js event loop phases. Where do setTimeout, setImmediate, process.nextTick, and resolved promises run?2. When is Node.js the wrong choice? How do you handle CPU-bound work in a Node service?3. What does "stateless service" mean, and why does it matter for horizontal scaling behind a load balancer?4. When should a request be handled asynchronously via a queue instead of synchronously in the request cycle?5. Explain at-least-once vs at-most-once delivery. How do you build an idempotent consumer given at-least-once semantics?6. Design a retry strategy for a failing worker: exponential backoff, jitter, max attempts, and dead-letter queues.7. Compare cache-aside, read-through, write-through, and write-behind caching. What is cache stampede and how do you prevent it?8. How do you keep state consistent across two services without distributed transactions? Explain the saga and outbox patterns.9. What is eventual consistency, and how do you give users read-your-writes behavior on top of it?10. Optimistic vs pessimistic locking in application code — give a concrete case for each.11. How do you size a database connection pool? Why do serverless/ECS-scale-out architectures break naive pooling, and how does PgBouncer help?12. What happens during a graceful shutdown? How do you drain in-flight requests and queue consumers on SIGTERM?13. Explain the three pillars of observability. How do correlation IDs work across services and queue hops?14. Liveness vs readiness probes: what should each check, and what goes wrong if readiness checks your database?15. You run a nightly cron job across 4 ECS tasks — how do you ensure it runs exactly once?16. How should secrets and config be managed and rotated in production? Why are plain env vars sometimes insufficient?17. Describe your backend testing strategy: what belongs in unit vs integration vs e2e tests, and where do you draw mocking boundaries?18. Compare shared-schema (tenant_id column), schema-per-tenant, and database-per-tenant multi-tenancy. What breaks operationally at 1,000 tenants?19. WebSockets vs SSE vs long polling — tradeoffs, and how do you broadcast events across multiple server instances?20. Design exercise: a webhook ingestion endpoint that must survive a 10x traffic spike without losing events or falling over. Frontend Engineering 1. What triggers a re-render in React? Explain reconciliation and why key choice matters in lists.2. What's the correct mental model for useEffect? Give examples of effects that should be derived state or event handlers instead.3. When do useMemo and useCallback actually help, and when do they add cost for nothing?4. How do you split local state, server state, and global client state? Why do React Query/SWR often replace Redux?5. What do React Server Components change about data fetching and bundle size? Where's the client/server boundary in Next.js App Router?6. Choose between SSR, SSG, ISR, and CSR for: a marketing page, a pharmacist dashboard, and a patient-facing prescription page. Justify each.7. What are request waterfalls, and how do you parallelize or hoist data fetching to eliminate them?8. Implement an optimistic update: what happens on mutation failure, and how do you roll back cleanly?9. Controlled vs uncontrolled form inputs: tradeoffs, and how do you keep a 50-field clinical form performant?10. Explain LCP, CLS, and INP. For each, name two concrete fixes.11. How do you approach bundle size: code splitting, route-level lazy loading, and finding what to cut with bundle analysis?12. A table must render 10,000 rows smoothly — walk through list virtualization and its tradeoffs.13. What does accessibility mean beyond ARIA? Cover semantic HTML, keyboard navigation, and focus management in modals.14. Where should auth tokens live — localStorage vs httpOnly cookies? Connect your answer to XSS and CSRF risk.15. How do service workers and the Cache API enable offline support? Explain stale-while-revalidate.16. How do error boundaries and Suspense boundaries compose? What belongs in global error reporting?17. What do you test at each level — unit (Vitest), component (Testing Library), e2e (Playwright) — and what do you deliberately not test?18. Design a component API for a shared design system: props vs compound components, theming via tokens, versioning across teams.19. Show how you'd use TypeScript generics and discriminated unions to model a fetch state machine (idle | loading | success | error) safely.20. Design exercise: a real-time prescription-status dashboard with live updates, reconnection handling, and graceful offline behavior. Database 1. How does a B-Tree index work internally, and why does it make equality and range lookups fast?2. For a composite index on (tenant_id, status, created_at), which queries can use it? Explain leftmost-prefix matching.3. Read this query plan: when is a sequential scan actually the right choice over an index scan?4. Give four reasons Postgres ignores your index (function on column, type mismatch, low selectivity, leading-wildcard LIKE).5. When do you reach for a GIN index instead of B-Tree — e.g., JSONB containment or full-text search?6. Explain 1NF–3NF briefly, then give a case where deliberate denormalization is the right call.7. Walk through the four isolation levels and the read phenomena (dirty, non-repeatable, phantom) each prevents. What does Postgres default to?8. What makes long-running transactions dangerous in production (lock contention, vacuum bloat)?9. How do deadlocks occur between two transactions, and what coding practices prevent them?10. How do you detect and fix N+1 queries — joins, batching, DataLoader-style patterns?11. Compare SELECT ... FOR UPDATE with a version-column optimistic lock. Which fits a high-contention inventory decrement?12. Why does connection pooling matter, and how do PgBouncer's transaction vs session modes differ?13. Design a zero-downtime migration: adding a NOT NULL column with a default to a 100M-row table. Why CONCURRENTLY for indexes?14. Why does OFFSET 100000 get slow, and how does keyset (cursor) pagination fix it at the SQL level?15. How does streaming replication work, and what bugs does read-replica lag cause for read-your-writes?16. Partitioning vs sharding: what problem does each solve, and when is a table "big enough" to partition?17. OLTP vs OLAP: why would you pipe Postgres data into Redshift rather than running analytics on the primary?18. Compare Postgres Row-Level Security with application-level tenant filtering. What are the failure modes of each?19. Soft delete vs hard delete: implications for unique constraints, indexes (partial indexes), and data-retention compliance.20. Design exercise: schema for a multi-tenant pharmacy system — prescriptions, an immutable audit trail, and fast per-tenant reporting. Security 1. Explain how SQL injection works and why parameterized queries fix it. Where can ORMs still leave you exposed?2. Compare stored, reflected, and DOM-based XSS. What does React escape by default, and when is dangerouslySetInnerHTML acceptable?3. How does CSRF work, and how do SameSite cookies and CSRF tokens mitigate it? Does a JWT-in-localStorage SPA need CSRF protection?4. Sessions vs JWTs: how do you handle logout and revocation with stateless tokens? Explain refresh token rotation.5. How should passwords be stored? Why bcrypt/argon2 over SHA-256, and what are salt and pepper?6. Walk through the OAuth 2.0 authorization code flow with PKCE. Why is the implicit flow deprecated?7. What is IDOR (broken object-level authorization), and why is it the classic multi-tenant vulnerability? How do you test for it?8. RBAC vs ABAC: model permissions for a pharmacy app where pharmacists, admins, and auditors share endpoints.9. What does CORS actually protect (and not protect)? Explain preflight and common misconfigurations like reflecting Origin with credentials.10. How does a Content Security Policy stop XSS? Nonce vs hash strategies, and how do you roll CSP out with report-only first?11. How do secrets leak into client bundles and logs, and what processes/tooling prevent it?12. Design login defenses against brute force and credential stuffing: throttling, lockout, MFA, breached-password checks.13. Encryption at rest vs in transit: where does TLS terminate in your architecture, and when is field-level encryption of PHI warranted?14. Explain SSRF and why the AWS metadata endpoint (169.254.169.254) is the classic target. How do you mitigate it?15. Secure a file-upload feature end to end: type validation, storage isolation, malware scanning, presigned URLs, safe content disposition.16. How do you manage supply-chain risk in npm dependencies — lockfiles, audits, typosquatting, SBOMs?17. What do HSTS, frame-ancestors, and Referrer-Policy headers each defend against?18. For HIPAA-style compliance, what must an audit log capture, and how do you make it tamper-evident?19. Name three subtle cross-tenant data leaks beyond SQL: shared caches, queue messages, search indexes. How do you isolate each?20. Threat-modeling exercise: an e-signature feature for prescriptions — identify the top five threats and a mitigation for each. JavaScript (TypeScript) 1. var vs let vs const: hoisting, the temporal dead zone, and why const is not deep immutability.2. What is a closure? Give a production use and a leak.3. How is this determined? Function vs arrow, call/apply/bind, and class fields vs prototype methods.4. Prototype chain vs class syntax. When does instanceof fail?5. == vs === vs Object.is. How do NaN, -0, and boxed primitives behave?6. How do ToBoolean and ToPrimitive hide bugs in APIs — plus, if (value), and query params?7. Task vs microtask in the language. Where do queueMicrotask, Promise jobs, and setTimeout run?8. Promise.all vs allSettled vs race vs any. What happens on unhandled rejection?9. Sequential await vs Promise.all. Error handling, waterfalls, and AbortSignal.10. Iterables, for...of vs for...in, generators, and when an async generator is the right shape.11. ESM vs CommonJS: live bindings, default export interop, circular imports, and tree-shaking.12. Shallow vs deep copy: spread, structuredClone, and JSON.parse(JSON.stringify) failure modes.13. Common JavaScript memory leaks: closures, timers, listeners, and unbounded Maps.14. Structural typing vs nominal typing. Excess property checks, and why a variable assignment accepts extra fields.15. unknown vs any vs never vs void.16. How does TypeScript narrow: typeof, in, discriminated unions, type predicates, and asserts?17. Generics, constraints, infer — and when a generic adds no safety.18. type vs interface, declaration merging, and mapped or conditional types.19. What does TypeScript erase at compile time, and why is Zod required at the HTTP boundary?20. Design exercise: a typed Result / Either for a fallible parse-and-save path, with exhaustive switch and no any. 閱讀下一篇筆記人生之詩