Q1Why must a NestJS DTO be a class rather than a TypeScript interface?Core
Q2In the request lifecycle, which runs FIRST?Request Lifecycle
Q3Which building block is the right place for authorization (RBAC)?Request Lifecycle
Q4What is the main cost of making a provider REQUEST-scoped?DI & Modules
Q5You need to inject a value behind an interface. What do you do?DI & Modules
Q6Same service class is listed in two modules' `providers`. What happens?DI & Modules
Q7What does `whitelist: true` on ValidationPipe do?Config & Validation
Q8Which TypeORM setting should NEVER be true in production?Data & ORM
Q9Why register a global guard via APP_GUARD instead of app.useGlobalGuards(new X())?Request Lifecycle
Q10When is CSRF protection NOT needed?Auth
Q11Best practice for storing user passwords?Auth
Q12In a Nest unit test, how do you replace a real dependency with a mock?Testing
Q13What happens when you inject @Res() in a controller without passthrough?Core
Q14Which enhancer is the ONLY one that resolves lowest-level-first (route → controller → global)?Request Lifecycle
Q15What's the recommended first response to a circular dependency?DI & Modules
Q16Best way to catch a missing required env var?Config & Validation
Q17Inside an I/O callback, which fires first: setTimeout(fn, 0) or setImmediate(fn)?Node.js Core
Q18Which of these does NOT use the libuv thread pool?Node.js Core
Q19Why prefer stream.pipeline() over readable.pipe(writable)?Node.js Core
Q20You have a CPU-bound task that must run in-process without blocking requests. Use:Node.js Core
Q21Which Promise combinator resolves with the first FULFILLED value (ignoring rejections unless all fail)?Node.js Core
Q22What does process.nextTick risk if used recursively?Node.js Core
Q23Which decorator pairs with client.emit() for fire-and-forget events?Microservices
Q24Across microservices, how do you keep data consistent without distributed 2PC?Microservices
Q25DataLoader fixes the N+1 problem primarily by:GraphQL
Q26Rate limiting / caching / queues default to in-memory. What breaks across replicas?Performance
Q27Which adapter typically gives ~2× throughput for JSON-heavy APIs?Performance
Q28How do you correctly measure event-loop lag?Performance
Q29The Node.js permission model (--permission) is best described as:Security
Q30An attacker sends `__proto__` in JSON that your deep-merge copies. This is:Security
Q31In a pool-model multi-tenant app, the cardinal sin to prevent is:Architecture
Q32Why must queue/job consumers be idempotent?Queues & Jobs
Q33After an uncaughtException, the recommended action is to:Node.js Core
Q34What's the strongest reason to extract a module into a separate microservice?Architecture