Pick an answer; it instantly marks it right or wrong and explains why. Your answers are saved in this browser, so you can come back and finish.
Score 0 / 0 answered · 208 total
Q1Why must a NestJS DTO be a class rather than a TypeScript interface?Core
Q2In the request lifecycle, which runs FIRST?Request Lifecycle
Q3Which building block is the right place for authorization (RBAC)?Request Lifecycle
Q4What is the main cost of making a provider REQUEST-scoped?DI & Modules
Q5You need to inject a value behind an interface. What do you do?DI & Modules
Q6Same service class is listed in two modules' `providers`. What happens?DI & Modules
Q7What does `whitelist: true` on ValidationPipe do?Config & Validation
Q8Which TypeORM setting should NEVER be true in production?Data & ORM
Q9Why register a global guard via APP_GUARD instead of app.useGlobalGuards(new X())?Request Lifecycle
Q10When is CSRF protection NOT needed?Auth
Q11Best practice for storing user passwords?Auth
Q12In a Nest unit test, how do you replace a real dependency with a mock?Testing
Q13What happens when you inject @Res() in a controller without passthrough?Core
Q14Which enhancer is the ONLY one that resolves lowest-level-first (route → controller → global)?Request Lifecycle
Q15What's the recommended first response to a circular dependency?DI & Modules
Q16Best way to catch a missing required env var?Config & Validation
Q17Inside an I/O callback, which fires first: setTimeout(fn, 0) or setImmediate(fn)?Node.js Core
Q18Which of these does NOT use the libuv thread pool?Node.js Core
Q19Why prefer stream.pipeline() over readable.pipe(writable)?Node.js Core
Q20You have a CPU-bound task that must run in-process without blocking requests. Use:Node.js Core
Q21Which Promise combinator resolves with the first FULFILLED value (ignoring rejections unless all fail)?Node.js Core
Q22What does process.nextTick risk if used recursively?Node.js Core
Q23Which decorator pairs with client.emit() for fire-and-forget events?Microservices
Q24Across microservices, how do you keep data consistent without distributed 2PC?Microservices
Q25DataLoader fixes the N+1 problem primarily by:GraphQL
Q26Rate limiting / caching / queues default to in-memory. What breaks across replicas?Performance
Q27Which adapter typically gives ~2× throughput for JSON-heavy APIs?Performance
Q28How do you correctly measure event-loop lag?Performance
Q29The Node.js permission model (--permission) is best described as:Security
Q30An attacker sends `__proto__` in JSON that your deep-merge copies. This is:Security
Q31In a pool-model multi-tenant app, the cardinal sin to prevent is:Architecture
Q32Why must queue/job consumers be idempotent?Queues & Jobs
Q33After an uncaughtException, the recommended action is to:Node.js Core
Q34What's the strongest reason to extract a module into a separate microservice?Architecture
Q35Given a route with one guard, one interceptor, and one pipe (on a single param), in what order do they first touch the request on the way in?Request Lifecycle
Q36A guard injects a request-scoped provider. What is the direct consequence for that guard's instantiation behavior?Request Lifecycle
Q37Inside an interceptor, why does logic placed immediately after the synchronous call to next.handle() (but not inside a .pipe() operator) fail to run 'after the handler completes' as intended?Request Lifecycle
Q38Why does ValidationPipe skip validation for a handler parameter typed as a plain string (e.g. @Param('id') id: string)?Request Lifecycle
Q39An exception filter is declared with @Catch(HttpException) and registered globally via APP_FILTER. A service throws a raw `new Error('db down')` that is not wrapped in an HttpException. What happens?Request Lifecycle
Q40Which statement correctly distinguishes how multiple guards versus multiple exception filters are evaluated for a single request?Request Lifecycle
Q41Why is `catchError(err => of(fallbackValue))` inside an interceptor's RxJS pipe potentially dangerous for error handling?Request Lifecycle
Q42Inside a `createParamDecorator` factory, you need the raw Express `Response` object to set a cookie manually. What's the correct way to get it from `ExecutionContext`?Core
Q43A guard needs to check for `@Roles()` metadata that may be set on either the handler method or the controller class, with method-level taking precedence. Which `Reflector` call is the idiomatic implementation?Core
Q44You write `applyDecorators(SetMetadata('roles', roles), UseGuards(RolesGuard))` for a composite `@Auth()` decorator. What does this actually produce, and how does its execution order compare to writing `@SetMetadata('roles', roles) @UseGuards(RolesGuard)` stacked?Core
Q45A `DynamicModule` object returned from `forRoot()` defines a provider but the team reports that other modules importing it via `imports: [MyModule.forRoot(opts)]` can't inject that provider. What's the most likely missing piece?Core
Q46Why does `forRootAsync()` typically use a `useFactory` + `inject` pattern rather than accepting a plain `Promise<Options>` directly as an argument?Core
Q47Inside a custom param decorator, you write `@CurrentUser('email')` to get only the user's email, and `@CurrentUser()` to get the full user object. What determines the value of the `data` parameter in the factory function?Core
Q48Setting `global: true` on a DynamicModule's return value does what, precisely?Core
Q49A NestJS service receives an injected `QueryRunner` and calls `queryRunner.startTransaction()`, then inside the try block calls `this.userRepository.save(user)` using the globally-injected `Repository<User>` instead of `queryRunner.manager.save(user)`. What actually happens?Data & ORM
Q50Why does Prisma's `$transaction(async (tx) => {...})` impose a default 5-second timeout on the callback?Data & ORM
Q51Why is `synchronize: true` considered dangerous specifically in production, beyond "it's just risky in general"?Data & ORM
Q52A team needs to rename a `users.name` column to `users.full_name` with zero downtime during a rolling deploy where old and new app versions run simultaneously. What is the correct migration strategy?Data & ORM
Q53What is the key structural reason the Repository pattern is easier to unit test than Active Record in a NestJS/TypeORM codebase?Data & ORM
Q54A GraphQL API has a `Post.author` field resolver that runs `prisma.user.findUnique({ where: { id: post.authorId } })` independently for each post in a list of 100. What is the standard fix and why does it work?Data & ORM
Q55Two transactions both run SELECT ... FOR UPDATE to lock rows 1 and 2, but transaction A locks row 1 then waits on row 2, while transaction B locks row 2 then waits on row 1. What does the database do, and what's the standard prevention?Data & ORM
Q56A NestJS app uses AuthGuard('jwt') globally via APP_GUARD. The /auth/refresh endpoint must accept only refresh tokens, never access tokens. What's the most robust way to enforce this distinction?Auth
Q57Why does Nest's AuthGuard call passport.authenticate() under the hood instead of NestJS reimplementing strategy verification itself?Auth
Q58A RolesGuard checks `req.user.roles.includes(requiredRole)`. In production, a user demoted from admin to regular user mid-session still successfully calls an admin-only endpoint for the next 15 minutes. What's the most likely root cause?Auth
Q59In CASL, given the rules `can('update', 'Post'); cannot('update', 'Post', { published: true });`, what does `ability.can('update', somePublishedPost)` evaluate to, and why?Auth
Q60A team stores refresh tokens in localStorage 'because cookies are vulnerable to CSRF.' What is the strongest counterargument for using an httpOnly cookie instead, scoped correctly?Auth
Q61Why might a senior engineer deliberately choose stateful server-side sessions over stateless JWTs for an internal admin dashboard with under 50 concurrent users, even though the company's public API uses JWTs?Auth
Q62A PoliciesGuard calls `ability.can('update', 'Post')` (the class/string form) and allows the request, but the service layer then lets a non-owner edit someone else's post. What's the architectural gap?Auth
Q63A NestJS service uses ClientProxy.send() against a TCP microservice, piped through timeout(3000). The call times out client-side, but the server handler was mid-execution and eventually completes successfully, calling its return statement. What happens to that result?Microservices
Q64Why is Kafka often chosen over RabbitMQ for a NestJS service that needs a new analytics consumer to backfill against 30 days of historical order events?Microservices
Q65In NestJS's Kafka transport, what is the purpose of calling client.subscribeToResponseOf(requestTopic) before sending a @MessagePattern-style request?Microservices
Q66A team configures RabbitMQ with noAck: false in a NestJS microservice but the handler never calls channel.ack() via the injected RmqContext. What's the operational consequence?Microservices
Q67In a NestJS hybrid application, what does calling app.connectMicroservice() actually do to the application's dependency injection setup, and does it also extend the main app's global pipes/guards to the microservice?Microservices
Q68Why does an unhandled exception thrown inside an @EventPattern handler in NestJS not propagate any error back to the original publisher?Microservices
Q69A `@ResolveField()` for `Author.books` calls `booksService.findByAuthorId(parent.id)` directly (no DataLoader) and is hit by a query returning 200 authors with their books. What is the precise execution behavior?GraphQL
Q70Why must a DataLoader's `batchLoadFn` return an array the same length as the input keys array, in the same order, even when some keys have no corresponding record?GraphQL
Q71A team registers a DataLoader as a NestJS provider with `{ scope: Scope.DEFAULT }` (the implicit singleton default) and injects it into multiple resolvers. What bug does this introduce in production?GraphQL
Q72Why does Apollo Federation require a gateway-aware composition step rather than simply having a client query multiple independent GraphQL services and merging the JSON responses?GraphQL
Q73In a NestJS GraphQL subscription using the default in-memory `PubSub`, a mutation is handled by server instance A while a subscribed client's WebSocket connection is pinned to server instance B (behind a load balancer). What happens?GraphQL
Q74What's the key risk with relying solely on a `@UseGuards()` check at WebSocket `onConnect` time to secure a GraphQL subscription, without any per-event filtering logic?GraphQL
Q75In code-first NestJS GraphQL, what is the actual source of truth that the GraphQL SDL schema is generated from at application bootstrap?GraphQL
Q76A NestJS API applies @CacheInterceptor globally with the default trackBy. Two different authenticated users send GET /api/dashboard with identical query strings but different session cookies. What happens?Performance
Q77Which scenario is the best fit for switching a NestJS service from the default in-memory cache-manager store to a Redis-backed store?Performance
Q78A hot Redis-cached key expires under heavy concurrent traffic, and dozens of requests miss simultaneously and all hit the origin database at once. What is this failure mode called, and what's an effective Redis-native mitigation?Performance
Q79You invalidate a cached entity by calling cacheManager.del() on its known key after a successful update. Why might a stale value still reappear in the cache shortly afterward?Performance
Q80A resource (a user record) is reachable through several distinct cached query results: GET /users/42, GET /users?role=admin, and GET /teams/7/members. What's the most maintainable invalidation strategy when user 42 is updated?Performance
Q81Before adding caching to a NestJS endpoint that's reported as slow, profiling shows three independent downstream service calls are awaited sequentially, each taking ~100ms, with no shared expensive computation. What should be fixed first?Performance
Q82What does the current cache-manager `wrap(key, fn, ttl)` helper guarantee, and what does it NOT guarantee that teams sometimes assume it does?Performance
Q83A unit test builds its TestingModule by importing the real UsersModule (which itself imports TypeOrmModule.forFeature([User])) instead of declaring UsersService and a mock repository directly. What's the most likely consequence?Testing
Q84In an e2e Supertest test, why is request(app.getHttpServer()) preferred over starting the app with app.listen(3000) and pointing Supertest at http://localhost:3000?Testing
Q85You override a route's guard in an e2e test using .overrideGuard(RolesGuard).useValue({ canActivate: () => true }). What does this test now NOT verify?Testing
Q86A NestInterceptor's intercept() method is being unit tested. The fake CallHandler's handle() returns of({ id: 1 }) from RxJS. Why is this necessary instead of just returning { id: 1 } directly?Testing
Q87Why does main.ts's app.useGlobalPipes(new ValidationPipe()) have no effect on an e2e test that builds its own app via Test.createTestingModule(...).compile()?Testing
Q88A guard's canActivate calls this.reflector.getAllAndOverride(IS_PUBLIC_KEY, [context.getHandler(), context.getClass()]). In a unit test for this guard, what's the correct way to control its behavior without a real controller?Testing
Q89A NestJS service uses AsyncLocalStorage to carry a correlation id, but a developer adds a setImmediate() call inside a request handler to defer some logging. What happens to the correlation id inside that setImmediate callback?Deploy & Ops
Q90A team configures their Kubernetes readiness probe to call the same Terminus endpoint as their liveness probe, and that endpoint checks both the event loop and a downstream Postgres connection. During a 90-second Postgres failover, what is the most likely observed behavior?Deploy & Ops
Q91Why does OpenTelemetry auto-instrumentation for a NestJS + Postgres service typically require its initialization file to run via node -r ./tracing.js dist/main.js rather than being imported inside an AppModule provider?Deploy & Ops
Q92What is the core reason tail-based sampling for distributed traces requires routing spans through a Collector tier, rather than each service instance deciding independently?Deploy & Ops
Q93In a multi-stage NestJS Dockerfile, what's the main reason for running COPY package.json pnpm-lock.yaml ./ and RUN pnpm install BEFORE COPY . .?Deploy & Ops
Q94A NestJS container's Dockerfile uses CMD npm start, where start runs node dist/main.js. During a rolling deploy, pods take the full terminationGracePeriodSeconds to die and in-flight requests get connection-reset errors despite app.enableShutdownHooks() being called in code. What is the most likely root cause?Deploy & Ops
Q95Why is BatchSpanProcessor the recommended choice over SimpleSpanProcessor for OpenTelemetry tracing in a typical (non-serverless) production NestJS deployment?Deploy & Ops
Q96A BullMQ job processor catches every error internally, logs it, and returns `{ success: false }` instead of rethrowing. What happens to BullMQ's configured `attempts` and `backoff` for that job?Queues & Jobs
Q97Why is plain exponential backoff (no jitter) considered insufficient for retries against a shared downstream dependency that just recovered from an outage?Queues & Jobs
Q98A BullMQ Worker crashes mid-job without renewing its lock. What does BullMQ do with that job once `stalledInterval` elapses, and what does this imply for processor design?Queues & Jobs
Q99Why can't you simply publish a message to Kafka/RabbitMQ inside the same application code right after committing a database write, as a substitute for the transactional outbox pattern?Queues & Jobs
Q100In @nestjs/cqrs, what is the architecturally correct place to put orchestration logic like "when OrderPlacedEvent fires, dispatch a ReserveInventoryCommand"?Queues & Jobs
Q101A team runs three replicas of a NestJS service using @nestjs/cqrs's default EventBus. A command handler on replica A publishes an event, and an `@EventsHandler` for that event type is registered only on replica B. What happens?Queues & Jobs
Q102What does BullMQ's `FlowProducer` (parent/child jobs) provide that adding N independent jobs to a queue does not?Queues & Jobs
Q103A DTO has `@ValidateNested() address: AddressDto` but no `@Type()` decorator. A request sends a malformed nested `address` object missing a required `city` field defined on `AddressDto`. What happens?Config & Validation
Q104Why does Nest's `ConfigModule` documentation favor Joi over a class-validator-based schema as the default recommended approach for validating `process.env`?Config & Validation
Q105`ValidationPipe` is configured globally with `{ whitelist: true }` (no `forbidNonWhitelisted`). A client sends a DTO payload with an extra, undeclared property `isAdmin: true`. What's the resulting behavior?Config & Validation
Q106A route handler uses `@Param('id') id: string` with only a global `ValidationPipe({ transform: true })` applied — no `ParseIntPipe`, no DTO class wrapping the param. The client requests `/users/abc`. What happens?Config & Validation
Q107Which combination correctly implements "a field is required only when a sibling discriminator field equals a specific value," using class-validator idioms?Config & Validation
Q108In a custom async class-validator constraint that injects a repository to check DB uniqueness, what is `useContainer(app, { fallbackOnErrors: true })` responsible for?Config & Validation
Q109A Joi schema for `ConfigModule.forRoot({ validationSchema })` is written as `Joi.object({ PORT: Joi.number().default(3000) })` with no `.unknown(true)` and no `validationOptions` override. What's the most likely operational symptom?Config & Validation
Q110From inside an `fs.readFile` callback in a Node/Nest app, you schedule both `setTimeout(fn, 0)` and `setImmediate(fn2)`. Which fires first, and why?Node.js Core
Q111A Nest service calls `dns.lookup()` heavily for outbound requests, and you notice it's contending with `fs` and `crypto.pbkdf2` calls for the same limited resource. What's the most direct explanation?Node.js Core
Q112Why does `stream.pipeline()` get recommended over manual `.pipe()` chains for a Nest controller streaming a file transform to the HTTP response?Node.js Core
Q113A staff engineer proposes adding `cluster.fork()` calls inside a NestJS app that already runs as one container per pod under Kubernetes with `replicas: 4`. What's the strongest objection?Node.js Core
Q114Your Nest app wraps a CPU-intensive synchronous image-resize loop in an `async` function and `await`s a `Promise.resolve()` before calling it, expecting this to keep the server responsive. What actually happens under concurrent requests?Node.js Core
Q115Why is `process.nextTick()` recursion considered more dangerous than `setImmediate()` recursion for starving I/O in a Node server?Node.js Core
Q116A worker_threads-based pool in a Nest provider shares state between workers using a `SharedArrayBuffer` and coordinates with `Atomics.wait()`/`Atomics.notify()`. Where is it safe to call `Atomics.wait()`?Node.js Core
Q117A NestJS service runs as 4 replicas behind a load balancer with @nestjs/throttler configured using the default in-memory storage and a limit of 100 requests/minute per IP. What is the actual effective limit a single client can achieve in steady state?Security
Q118Which CORS configuration allows a browser to send an authenticated (cookie-bearing) cross-origin request from any website to your NestJS API and have the response be readable by that website's JavaScript?Security
Q119A login endpoint using Mongoose receives a JSON body where the password field is { "$ne": null } instead of a string, and the handler passes req.body directly into User.findOne(). What is the most direct, idiomatic NestJS fix?Security
Q120Comparing NestJS's three built-in API versioning strategies, which statement correctly identifies a caching tradeoff?Security
Q121Why is forbidNonWhitelisted: true in NestJS's ValidationPipe considered a stronger security control than whitelist: true alone, for an endpoint vulnerable to mass assignment?Security
Q122An API serves images from a different origin than the frontend that embeds them via <img src>. After adding helmet() with its defaults, the images stop loading even though there's no CORS error in the console. What is the most likely cause?Security
Q123Which scenario best illustrates why @nestjs/throttler alone is an insufficient defense against credential stuffing on a login endpoint?Security
Q124Injecting a REQUEST-scoped provider into a singleton (DEFAULT-scoped) controller in NestJS results in:Architecture
Q125What is the primary advantage of using AsyncLocalStorage over REQUEST-scoped providers for carrying per-request context like tenant id or correlation id?Architecture
Q126A BullMQ job processor reads `als.getStore()` expecting the tenant id from the request that enqueued the job, but gets `undefined`. Why?Architecture
Q127In a NestJS modular monolith, what is the gap between using `exports` in a `@Module()` and actually enforcing a module boundary?Architecture
Q128What are NestJS "durable providers" specifically designed to optimize?Architecture
Q129A team wants to extract a module from their NestJS modular monolith into a standalone microservice. Which property of the existing module design makes that extraction cheap?Architecture
Q130Why should a NestJS WebSocket gateway generally avoid REQUEST-scoped providers, unlike an HTTP controller?Architecture
Q131A DTO field is typed as `email: string` with no `@ApiProperty()` decorator, and the CLI plugin is NOT enabled. What does the generated Swagger schema show for that field?Core
Q132Why must a NestJS DTO be defined as a class rather than a TypeScript interface for Swagger documentation to work?Core
Q133You add `.addBearerAuth()` to your `DocumentBuilder` config but forget `@ApiBearerAuth()` on a JWT-protected controller. What's the practical consequence?Core
Q134What is the main limitation when trying to document a generic response wrapper class like `ApiResponseDto<T>` directly with `@ApiProperty()` on its `data: T` field?Core
Q135Why is securing only the Swagger UI HTML page (e.g. with Basic Auth) but leaving `/docs-json` unprotected an incomplete fix?Core
Q136When generating separate versioned API documentation for /v1 and /v2 routes that live in different NestJS modules, what option on `SwaggerModule.createDocument` scopes each generated document to only its own version's routes?Core
Q137An endpoint returns `UserDto[]`. Which is the correct way to document that with `@ApiResponse()`?Core
Q138A NestJS endpoint uses <code>@UseInterceptors(FileInterceptor('avatar'))</code> with default options and no <code>ParseFilePipe</code>. A client uploads a 2GB file. What happens?Core
Q139By default, how does current NestJS's built-in <code>FileTypeValidator</code> determine a file's type?Core
Q140What is the primary architectural benefit of a direct-to-S3 presigned-URL upload over routing the file body through the NestJS API?Core
Q141Why should the S3 object key in a presigned-upload flow always be generated server-side rather than accepted from the client?Core
Q142An upload endpoint buffers files into memory with <code>memoryStorage</code> and forwards them to S3 with a single <code>PutObjectCommand</code> built from <code>file.buffer</code>. Under load with several large concurrent uploads, what is the most likely failure mode?Core
Q143Which statement correctly distinguishes <code>FilesInterceptor</code> from <code>FileFieldsInterceptor</code> in NestJS?Core
Q144In a presigned POST upload to S3, how can you enforce a maximum file size without ever routing the bytes through your NestJS API?Core
Q145Two providers in the same NestJS module, ServiceA and ServiceB, inject each other via plain constructor parameters with no forwardRef(). What happens at application bootstrap?DI
Q146What does wrapping a dependency in forwardRef(() => ServiceB) actually change about how Nest resolves it?DI
Q147ServiceA (in ModuleA) and ServiceB (in ModuleB) depend on each other across a module boundary. Which forwardRef() touch points are required to fully resolve the cycle?DI
Q148Why is ModuleRef.get() generally unsafe to call directly inside a constructor to break a circular dependency?DI
Q149Why is a circular dependency between two NestJS feature modules considered an architectural smell rather than just an inconvenience to wrap in forwardRef()?DI
Q150Which refactor removes a circular dependency by having both originally-coupled modules depend on a new abstraction instead of on each other directly?DI
Q151A test suite mocks every dependency individually and never boots the full root AppModule. Why might this fail to catch a real circular dependency bug before it reaches CI/production?DI
Q152In NestJS, what is the required return type of a handler decorated with @Sse()?WebSockets
Q153Which field of a NestJS MessageEvent, when set on the client's last received frame, gets echoed back by the browser's EventSource as the Last-Event-ID request header on reconnect?WebSockets
Q154Why can't EventSource clients attach an Authorization: Bearer header to an SSE request?WebSockets
Q155A NestJS @Sse() endpoint needs to stream binary audio chunks to the browser as efficiently as possible. What's the key tradeoff versus using a WebSocket for this?WebSockets
Q156An SSE connection sits idle (no events) for several minutes behind a corporate proxy and gets silently dropped. What's the standard mitigation?WebSockets
Q157A NestJS backend runs three load-balanced replicas behind a round-robin LB. A client holds an open SSE connection to replica A. An event is published to a Redis pub/sub channel while replica B happens to receive the publish. What must be true for the SSE client to actually receive that event?WebSockets
Q158A NestJS @Sse() endpoint returns a 401 because the client's session expired. What does the browser's EventSource do next, per the WHATWG spec?WebSockets
Q162A colleague builds a busy work-loop where each unit of work re-schedules the next with recursive process.nextTick(), and reports the HTTP server has stopped responding to requests at 100% CPU. What is the root cause?Node.js Core
Q163The same top-level snippet mixing process.nextTick, Promise.then, and setTimeout prints in a different order when run as index.mjs than as index.cjs. What explains the difference?Node.js Core
Q164Which V8 collector runs on the new (young) space, and what makes it cheap?Node.js Core
Q165A service's heap climbs steadily under constant traffic and eventually OOM-crashes. A teammate proposes bumping --max-old-space-size from 2048 to 4096. What's the right read?Node.js Core
Q166You suspect a leak in one operation. Which workflow most directly identifies both what leaked and who's retaining it?Node.js Core
Q167Your logs show "possible EventEmitter memory leak detected. 11 listeners added." What does this indicate and what's the correct first move?Node.js Core
Q168A process shows flat V8 heap in snapshots but steadily rising RSS. Which explanation best fits, given how Buffers are stored?Node.js Core
Q169Which stream type reads input and produces transformed output as a function of that input (e.g. gzip)?Node.js Core
Q170What does writable.write(chunk) returning false tell you?Node.js Core
Q171You chain three streams with sourceStream.pipe(transform).pipe(dest) and the source errors mid-flight. What's the problem versus using stream.pipeline()?Node.js Core
Q172Why does for await (const chunk of readable) apply backpressure to the source without any manual pause/resume?Node.js Core
Q173A NestJS controller must return a 2 GB report file to the client. What's the right return value?Node.js Core
Q174Consider: Promise.all([Promise.resolve(1), Promise.reject(new Error('boom')), Promise.resolve(3)]) versus Promise.allSettled([...the same...]). What does each produce?Node.js Core
Q175You want the first server among several mirrors that returns a successful response, tolerating that some mirrors error out. Which combinator fits?Node.js Core
Q176Three independent fetches each take ~100ms. What's the latency of running them as three back-to-back awaits versus one Promise.all of the three?Node.js Core
Q177In modern Node, what is the correct role of process.on('uncaughtException') / process.on('unhandledRejection')?Node.js Core
Q178You're consuming a paginated REST API and want to iterate every item lazily without holding all pages in memory. What's the idiomatic tool?Node.js Core
Q179In CommonJS, what does the second require('./config') of the same module return?Node.js Core
Q180Why can ES Modules be tree-shaken while CommonJS generally cannot?Node.js Core
Q181Module A requires B, and B requires A while A is still mid-evaluation. What does B receive from require('./a') in CommonJS?Node.js Core
Q182A single Node process ends up with two in-memory copies of the same library — one loaded via require (CJS build) and one via import (ESM build). What is this called, and what breaks?Node.js Core
Q183A NestJS provider with the default scope is a singleton. Which statement is the most precise account of why?Node.js Core
Q184Which definition correctly extracts a function's return type using a conditional type with <code>infer</code>?TypeScript
Q185You're building a <code>PublicUser</code> DTO that must never leak secret fields, even ones added to <code>User</code> later. Which is the safer derivation?TypeScript
Q186Which tsconfig flag makes <code>arr[i]</code> and <code>record[key]</code> resolve to <code>T | undefined</code>, catching "assumed the key exists" bugs?TypeScript
Q187In an exhaustive <code>switch</code> over a discriminated union, what goes in the <code>default</code> branch to force a compile error when a new variant is added?TypeScript
Q188Which statement about <code>interface</code> vs <code>type</code> is correct?TypeScript
Q189A payment service must record a charge in its database and publish a "PaymentSucceeded" event to a broker. What is the correct way to avoid the dual-write inconsistency?Microservices
Q190Which statement about the CAP theorem is the most accurate senior framing?Microservices
Q191Why is achieving true "exactly-once delivery" in a distributed message system considered unrealistic, and what do teams do instead?Microservices
Q192A worker acquires a Redis lock with a 30s TTL, then a long GC pause freezes it for 40s. What is the real risk, and what mitigates it?Microservices
Q193Your service calls a downstream API that has become slow and is failing intermittently. Requests pile up and threaten to exhaust your connection pool. Which resilience pattern most directly prevents this failure from cascading into your own service?Microservices
Q194Your Node.js Lambda is CPU-bound (image resizing) and you set it to 128MB "to save money." It runs slowly and the bill is high. What's the most likely fix?AWS & Cloud
Q195A candidate says "Fargate is cheaper than Lambda above ~1.5M requests/month, so we should migrate." What's the best senior response?AWS & Cloud
Q196You need to broadcast an "order placed" event so that three independent services (email, analytics, fulfillment) each process it durably and can retry on their own. What's the standard AWS pattern?AWS & Cloud
Q197Which statement about RDS Multi-AZ vs read replicas is correct?AWS & Cloud
Q198A single Lambda execution role grants "dynamodb:*" on all resources ("Resource": "*") and is reused across every function in the account. Why is this a problem?AWS & Cloud
Q199An alert fires on high event-loop lag. Following the diagnostic loop, what's the correct FIRST profiling action?Performance
Q200On a CPU flame graph from clinic flame or 0x, which visual feature identifies the hotspot to optimize?Performance
Q201Requests are slow but a flame graph shows the event loop mostly idle. Which tool best diagnoses this, and what does it typically reveal?Performance
Q202You're hunting a memory leak with heap snapshots. Which procedure actually isolates it?Performance
Q203During a sustained autocannon load test you watch process memory. What distinguishes a healthy service from one with a leak?Performance
Q204Which statement best describes broken access control (OWASP A01) and its primary defense?Auth
Q205A NestJS guard reads the user's role from a token via <code>jwt.decode(token)</code> and trusts it. What is the vulnerability?Auth
Q206Per the current OWASP Password Storage guidance, which is the most accurate statement for a new NestJS application?Auth
Q207A Mongoose login handler runs <code>User.findOne(req.body)</code> and a client sends <code>{ "username": "admin", "password": { "$ne": null } }</code>. What happens and how is it prevented?Auth
Q208A team stores JWTs in <code>localStorage</code> "because cookies are vulnerable to CSRF." What's the flaw in that reasoning?Auth