Backend Developer Interview Questions and Answers (2026): APIs, Databases, Scaling and Scenarios

The short answer: backend interviews test whether you can build services that are correct, fast, secure and reliable under load. Expect questions on HTTP and API design, databases (indexes, transactions, isolation, SQL vs NoSQL), caching, scaling and system design, concurrency and idempotency, authentication and security, observability, and your main language (Node.js, Python, Java, Go or C#), plus a coding round and often a scenario like “this endpoint got slow” or “customers were charged twice.” Answer with trade-offs and real examples from systems you’ve built.

The job market

The U.S. Bureau of Labor Statistics reports a median annual wage of $135,980 for software developers in May 2025, and projects employment of software developers, QA analysts and testers to grow 10% from 2025 to 2035, much faster than average. In Stack Overflow’s 2025 Developer Survey, PostgreSQL was the most used database (55.6% of respondents), and Python’s use rose 7 percentage points from 2024, which the survey links partly to AI and back-end work.

HTTP and API design questions

• “What makes a good REST API?” Resource-oriented URLs (/orders/123), correct HTTP methods and status codes, consistent naming and error format, pagination for lists, versioning, authentication, and documentation (for example an OpenAPI spec).
• “Which HTTP methods are idempotent?” GET, PUT, DELETE (and HEAD, OPTIONS) are idempotent: repeating them has the same effect. POST isn’t, which matters for retries; PATCH may or may not be.
• “Which status codes should you use?” 200 OK, 201 Created, 204 No Content, 400 Bad Request (invalid input), 401 Unauthorized (not authenticated), 403 Forbidden (authenticated but not allowed), 404 Not Found, 409 Conflict, 422 for validation errors in some APIs, 429 Too Many Requests, 500 for server errors, 503 when unavailable.
• “How do you version an API?” In the URL (/v2/) or a header; never break existing clients without a deprecation period.
• “Offset or cursor pagination?” Offset is simple but slow and inconsistent on large, changing tables; cursor (keyset) pagination is stable and fast for feeds and large lists.
• “REST, GraphQL or gRPC?” REST for broad compatibility, GraphQL when clients need flexible queries across related data, gRPC for fast, typed service-to-service calls. See our Web API interview questions.

Database questions

“How do indexes work, and when do they hurt?”

Most indexes are B-trees that let the database find rows without scanning the table. They speed up reads on filtered, joined or sorted columns, but slow down writes and use storage. Use EXPLAIN to check whether a query uses the index you expect.

“What are ACID transactions and isolation levels?”

Atomicity, consistency, isolation and durability. Isolation levels trade consistency for concurrency: read uncommitted, read committed, repeatable read and serializable. In PostgreSQL, Read Committed is the default: each query sees only data committed before that query began. Know the anomalies each level allows (dirty reads, non-repeatable reads, phantoms) and when you’d choose serializable.

More database questions

• “SQL or NoSQL?” Relational databases for structured data, relationships and transactions; document, key-value, wide-column or graph stores when the access pattern, scale or flexibility needs them. Many systems use both.
• “What is the N+1 query problem?” Loading a list, then running one query per item. Fix it with joins, batching or eager loading in your ORM.
• “Normalization vs denormalization?” Normalize to avoid duplicate data and update anomalies; denormalize selectively for read performance, accepting the cost of keeping copies in sync.
• “How do you run a schema migration without downtime?” Make changes backward-compatible: add new columns first, deploy code that writes both, backfill, switch reads, then remove the old column later.

Caching questions

• “Where can you cache?” In the browser and CDN, at the API gateway, in an in-memory cache such as Redis, and inside the application.
• “Explain cache-aside.” The application checks the cache, reads from the database on a miss, and writes the result to the cache with a TTL.
• “How do you handle cache invalidation?” TTLs, explicit invalidation on writes, versioned keys, and accepting short staleness where the business allows it. Protect against stampedes when a popular key expires (locking or request coalescing).

Scaling and system design questions

• “How do you scale a web service?” Keep application servers stateless so you can add instances behind a load balancer (the Twelve-Factor App’s guidance is to “execute the app as one or more stateless processes”), cache reads, add read replicas, partition or shard data when one database can’t keep up, and move slow work to background queues.
• “When would you use a message queue?” To decouple services, smooth traffic spikes, and process slow or retryable work asynchronously (emails, image processing, payments webhooks). Discuss delivery guarantees (at-least-once means consumers must handle duplicates).
• “What does the CAP theorem say?” During a network partition, a distributed system must choose between consistency and availability. Most real designs choose per feature.
• “Monolith or microservices?” A well-structured monolith is often right early; microservices help with independent scaling and team ownership but add network, data consistency and operations costs.

For full design rounds, see our system design interview guide.

Concurrency and idempotency questions

• “What is a race condition, and how do you prevent one?” Two operations interleave and produce a wrong result (two users buying the last item). Use database constraints, transactions with the right isolation, row locks (SELECT ... FOR UPDATE), optimistic locking with version numbers, or atomic operations.
• “How do you make a payment endpoint safe to retry?” Require an idempotency key from the client, store the result of the first request under that key, and return the same result for repeats.

Authentication and security questions

• “Sessions or JWTs?” Server-side sessions are easy to revoke; JWTs are stateless and suit distributed systems but are hard to revoke before expiry, so keep them short-lived and use refresh tokens.
• “What’s the difference between authentication and authorization?” Authentication proves who you are; authorization decides what you can do.
• “What is OAuth 2.0?” A framework for delegated authorization: a user lets an app access resources on their behalf without sharing their password; OpenID Connect adds identity on top.
• “How do you secure an API?” Authenticate every request, check authorization on every object (broken access control is A01 in the OWASP Top 10:2025), validate input and use parameterized queries to prevent injection (A05), keep dependencies patched (software supply chain failures are A03), rate-limit, use TLS, and never log secrets.

Observability and reliability questions

• “How do you know a service is healthy?” Metrics (request rate, error rate, latency percentiles, saturation), structured logs with request IDs, distributed tracing, and alerts tied to user-facing service level objectives.
• “How do you handle a dependency that’s down?” Timeouts, retries with exponential backoff and jitter, circuit breakers, fallbacks, and graceful degradation.

Language-specific questions

• Node.js: “How does the event loop work?” Single-threaded JavaScript execution with non-blocking I/O; CPU-heavy work blocks everything, so move it to worker threads or another service. Also promises vs callbacks and error handling in async code.
• Python: “What is the GIL, and how does it affect concurrency?” In the default CPython build, the global interpreter lock lets one thread run Python bytecode at a time, so use async I/O or threads for I/O-bound work and processes for CPU-bound work. Mention that newer, optional free-threaded builds remove the GIL. Also Django vs FastAPI or Flask.
• Java: garbage collection basics, threads and the java.util.concurrent package, Spring dependency injection and transactions. See our Java interview questions.

Scenario questions

“This endpoint used to take 100 ms and now takes 3 seconds. What do you do?”

“I’d check what changed (deploys, traffic, data volume), then look at traces to see where time goes. In my experience it’s usually the database: a missing index on a growing table, an N+1 query, or lock contention. On one service, a new filter caused a full table scan on a 40-million-row table; adding a composite index brought p95 latency from 2.8 seconds back to 120 ms. Then I’d add an alert on latency so we’d catch it earlier.”

Other scenarios

• “Customers were charged twice.” Find the cause (client retries, a non-idempotent endpoint, duplicate queue messages), refund affected customers, add idempotency keys and deduplication.
• “The database is at 90% CPU.” Find the top queries, add indexes or rewrite queries, cache hot reads, add read replicas, and plan capacity.
• “Design a URL shortener / rate limiter / notification service.” Clarify requirements and scale, sketch the API and data model, then cover storage, caching, scaling and failure cases.

Questions for experienced backend engineers

• “Tell me about a system you designed. What would you change now?”
• “Tell me about a production incident you led. What did the postmortem change?”
• “How do you approach a large migration with no downtime?”
• “How do you decide when to split a service?”

Behavioral questions

• “Tell me about a time you disagreed with a technical decision.”
• “Tell me about a bug that took you a long time to find.”
• “Tell me about a time you improved performance or cost.”

Use the STAR method with numbers: latency, error rates, cost.

Related guides: full-stack developer interview questions, software engineer coding interview guide, Kubernetes interview questions and site reliability engineer interview questions.

Frequently asked questions

Sources

• U.S. Bureau of Labor Statistics, Software Developers, Quality Assurance Analysts, and Testers, Occupational Outlook Handbook. Read on 2 October 2026.
• Stack Overflow, 2025 Developer Survey: Technology. Read on 2 October 2026.
• PostgreSQL documentation, Transaction Isolation. Read on 2 October 2026.
• The Twelve-Factor App. Read on 2 October 2026.
• OWASP, OWASP Top 10:2025. Read on 2 October 2026.