Full Stack Developer Interview Questions India 2026: Frontend, Backend, and System Design

HTML/CSS: 'What is the CSS box model?' (content + padding + border + margin; box-sizing: border-box makes width include padding and border, preventing layout surprises). 'What is the difference between flexbox and CSS Grid?' (flexbox: one-dimensional layout along one axis (row or column); grid: two-dimensional layout along both row and column axes simultaneously; use flexbox for components (nav bar, card row), grid for page layouts). 'What is CSS specificity and how is it calculated?' (inline styles: 1000, IDs: 100, classes/pseudoclass/attributes: 10, elements/pseudoelements: 1; when selectors conflict, higher specificity wins; when equal specificity, last-declared wins).

JavaScript: 'What is a closure?' (a function that retains access to variables from its outer scope even after the outer function has returned; powers: module pattern for data privacy, factory functions, memoisation). 'What is event delegation?' (attach one listener to a parent; use event.target to identify which child triggered the event; relies on event bubbling; advantages: memory efficiency for many children, works for dynamically added elements). 'What is the difference between null and undefined?' (undefined: variable declared but not assigned, function with no return value; null: intentional absence of value, assigned explicitly).

React: 'What is the virtual DOM?' (JavaScript representation of the real DOM; React diffs previous and next virtual DOM, batches and applies minimal real DOM changes; avoids expensive full DOM rebuilds). 'When do you use useState vs useReducer?' (useState: simple state (boolean, number, string); useReducer: complex state with multiple sub-values or when next state depends on the previous state's structure). 'What is the purpose of useCallback and useMemo?' (useCallback: memoises a function reference, preventing a child component from re-rendering when the parent re-renders and would otherwise create a new function instance; useMemo: memoises a computed value; use when the computation is expensive and dependencies rarely change).

REST API design: HTTP method semantics (GET: read, idempotent; POST: create, not idempotent; PUT: full replace, idempotent; PATCH: partial update; DELETE: remove, idempotent), status codes (200 OK, 201 Created, 204 No Content, 400 Bad Request, 401 Unauthenticated, 403 Forbidden, 404 Not Found, 409 Conflict, 422 Unprocessable Entity, 429 Too Many Requests, 500 Internal Server Error), versioning strategies (URI versioning /v1/resource vs custom header vs content negotiation).

Authentication and security: 'How does JWT authentication work?' (server creates a signed token (base64url(header).base64url(payload).signature); client stores and sends in Authorization: Bearer header; server verifies signature without database lookup; tokens expire via exp claim; use short-lived access tokens + long-lived refresh tokens for security). 'What is CORS and how does it work?' (Cross-Origin Resource Sharing: browser policy that restricts JavaScript from accessing resources from a different origin; server opts-in by setting Access-Control-Allow-Origin header; preflight OPTIONS request checks permissions before the actual request for non-simple requests). 'What is SQL injection and how do you prevent it?' (attacker injects SQL via user input; prevention: parameterised queries / prepared statements (never string-concatenate user input into SQL), ORM usage).

Node.js backend: 'How do you handle authentication middleware in Express?' (jwt.verify() in a middleware that runs before protected routes; attach decoded payload to req.user; call next() if valid, send 401 if invalid). 'What is the N+1 query problem?' (fetching a list of N items, then making one query per item for related data = N+1 queries total; fix: JOIN query or ORM eager loading).

SQL: 'Write a query to find the top 3 customers by total order value.' (SELECT customerid, SUM(amount) AS total FROM orders GROUP BY customerid ORDER BY total DESC LIMIT 3). 'What is a database index and when should you add one?' (a data structure (typically B-tree) that allows O(log n) lookup instead of O(n) full table scan; add indexes on columns in WHERE clauses, JOIN ON conditions, and ORDER BY columns; trade-off: faster reads, slower writes and inserts because the index must be updated). 'What is the N+1 problem and how do you fix it in SQL?' (running one query to fetch N records, then N additional queries for related data; fix: use JOIN to fetch everything in one query, or in ORM: eager loading (Django: selectrelated / prefetchrelated; Rails: includes; Hibernate: JOIN FETCH)).

NoSQL: 'What is the difference between SQL and MongoDB?' (SQL: fixed schema, ACID transactions, relational data model with foreign keys; MongoDB: flexible document schema (each document can have different fields), horizontal scaling via sharding, good for hierarchical/nested data, but no native JOIN (use $lookup for document-level join)). 'When would you use Redis in a full stack application?' (caching (reduce database load for hot data), session storage (stateless server: session in Redis instead of server memory), rate limiting (increment a counter per IP per time window), pub/sub messaging (real-time notifications)).

System design expectations by experience level: (0-1 year): data modelling ('design the database schema for a food delivery app: tables for users, restaurants, menuitems, orders, orderitems, reviews; relationships and foreign keys'). Basic component awareness ('what components make up a basic web application: client, load balancer, web servers, database, cache, CDN'). (2-4 years): simple distributed system design. URL shortener is the standard starter: API (POST /shorten returns short code, GET /{code} redirects), data model (id, shortcode, longurl, createdat, userid), base62 encoding for short code generation (6 chars = 56B unique codes), Redis cache for hot short codes, read replica for scale. (5+ years): full system design at SDE-2 to SDE-3 level.

Common full stack system design patterns: 'How would you implement real-time features (chat, notifications)?' (WebSockets for persistent bidirectional connection; alternatively Server-Sent Events (SSE) for server-to-client-only streaming; for scale: move WebSocket state to Redis Pub/Sub so any server can deliver messages to any connection). 'How would you implement search in a web application?' (for basic: SQL LIKE or full-text search (PostgreSQL tsvector); for scale: Elasticsearch or Algolia (inverted index for fast text lookup, ranked by relevance)).