The defining feature is calibration rather than difficulty. Every interviewer works from the same rubric and writes evidence-based feedback, so the panel is trying to place you at a level rather than decide whether you can do the job. That means the coding round is genuinely algorithmic and time-boxed, the design round widens in scope as the level rises, and a strong answer with no stated trade-offs scores worse than a middling answer that names what it gave up.
Scored on top of a correct answer
•Signal at a level: the same design question is scored on blast radius, so a staff candidate is expected to talk about organisational and migration cost, not just the architecture
•Structured communication under time pressure, because the interviewer is writing down evidence and cannot credit what you did not say out loud
•Behavioural answers that survive a follow-up on your specific contribution rather than the team's
How candidates lose it
Optimising the algorithm and never stating the complexity or the constraint that made it necessary
Designing for a scale nobody asked about, which reads as pattern-matching rather than judgement
Behavioural stories with no measurable outcome and no disagreement in them
One week: how to spend it
Front-load breadth, put the two hardest rounds mid-week when you still have time to react to a bad session, and keep the last evening for a timed loop and your stories. Two hours a night done every night beats one eight-hour Saturday, because retrieval improves with spacing and a single long session mostly produces the feeling of having worked.
The plan
1Day 1 - fundamentals sweep
about 3.5 hr
Read the sheets for the core sections of this track at speed. Mark the items you could not answer; they become your revision list all week.
The state is unchanged - the minimum cost to transform the first i characters of one string into the first j of the other - because the subproblem structure does not depend on what operations cost. Only the recurrence changes, adding a per-operation weight instead of a uniform 1, and the base cases become multiples of the insert and delete costs rather than i and j.
Nines only mean something as a downtime budget over a stated window, and dependencies in series multiply: five hard dependencies at three nines each put your own ceiling near 99.4 percent, so the target is met by removing dependencies from the critical path rather than by asking each owner for more nines.
For one stock counter, optimistic locking with a compare-and-set loop fits: read, refuse at zero, and publish the decrement only if nobody changed the value meanwhile. A lock suits a larger critical section. Prove it by arguing each sale consumes one unit, plus a stress test seen to fail on the broken code.
One-hot is unusable at that width, so the options are frequency encoding, smoothed target encoding, hashing, or a library's native categorical handling. Target encoding is the strongest and the most dangerous, because it must be fitted inside each fold or it leaks the label. Use this categorical encoding answer to show the decision, trade-off, and evidence rather than a memorised definition.
rand() % 6 yields 0 to 5, and because RAND_MAX + 1 is not a multiple of 6 it shows modulo bias towards 0 and 1. Rejection sampling fixes the bias. It becomes a vulnerability when an attacker benefits from predicting the value, as with tokens, keys or nonces, because rand() is predictable. Those need a CSPRNG.
Precompute, for each prefix of the pattern, the length of the longest proper prefix of the pattern that is also a suffix of that prefix. On a mismatch you fall back to that length instead of rewinding the text, which is what turns the quadratic naive scan into a linear one.
Every distinct combination of label values is a separate time series with its own index entry, so an unbounded label multiplies series count by the number of users rather than adding one dimension. Metrics are the wrong tool for per-entity questions: keep labels bounded, move per-user debugging to exemplar-linked traces, and guard against the next unbounded label.
The dialog was built as a styled div, so nothing marks the rest of the page inert. Focus was never moved in, never constrained, never restored on close, and Escape was never wired. A correct dialog moves focus in, keeps it in, restores it, marks background inert and is labelled - which native dialog with showModal gives you almost for free.
Spring Data JPA saveAll batching needs a Hibernate batch size, statements for the same table kept adjacent, and an identifier strategy that does not force a round trip per row. IDENTITY generation silently prevents insert batching, because Hibernate has to execute each insert to learn the key.
Because you cannot score a million-item catalogue per request inside a few tens of milliseconds. Retrieval reduces millions to hundreds with a cheap model judged on recall, then a far more expensive ranker orders those hundreds and is judged on the ordering it produces at the top of the list.
One exception. WhenAll's task faults with an AggregateException holding every failure, but await rethrows only the first inner exception, so recovering the rest means keeping the WhenAll task in a variable and reading its Exception property.
An unhandled promise rejection in Node.js means a promise failed before any code observed the error. Treat it as a bug, await or return the promise chain, and make the process-level handler a last-resort alarm.
Shared memory gives you bytes, not coordination. Process synchronisation needs a mutex inside the region, marked PTHREAD_PROCESS_SHARED and initialised once. If the holder dies, a plain mutex stays locked forever; a robust mutex returns EOWNERDEAD, but repairing half-written data is your job.
An elevator system splits into a state machine per lift that decides its own next floor, and a dispatcher that assigns each hall call to one lift through a pluggable strategy such as a nearest-suitable-car cost. Car buttons go straight to their lift, and one control loop owns all state, so no god class and no locks.
Split the values across a max-heap of the lower half and a min-heap of the upper half, so the median is read off one or both tops. Balancing by size alone is what breaks it: a new value has to enter through the heap it belongs to by value and be transferred across, never pushed into whichever heap is currently smaller.
Replace the switch with a registry the application builds once at startup: a map from discriminator to a factory, validated for duplicate and missing keys as it is constructed, injected rather than global, and with a decided answer for a type the consumer has never seen.
Treat it as a confirmed breach until proven otherwise: preserve logs, scope who saw what, and start the disclosure clock alongside the investigation. The cause is almost always tenant scoping living in application code, where one forgotten filter leaks everything - so move enforcement below the code, to row-level security.
A training row must contain only feature values that were knowable at its own event timestamp. A naive equality join on entity id attaches whatever the feature table holds now, including values derived from after the event, which leaks the future and produces offline metrics that collapse in production.
A saga has no rollback. Each step already committed in its own database and was visible to everyone, so you can only run new forward transactions that semantically offset it. Compensations are not atomic, some actions cannot be compensated at all, and compensations themselves fail - so a saga needs idempotent handlers and an ordering rule for irreversible steps.
A thread-safe connection pool pairs a Semaphore of N permits, which bounds how many connections exist and gives acquire its timeout, with a queue of idle connections. Acquire returns a lease that releases exactly once from a finally block, and a broken connection is discarded without losing its permit.
Forecast at whichever levels have signal, then reconcile so the numbers are coherent by construction. Bottom-up preserves detail but accumulates noise, top-down is stable but allocates by an assumed proportion, and optimal reconciliation projects independent forecasts onto the set that adds up.
A global limit protects the service from overload but says nothing about how capacity is divided, so one tenant can consume most of it while staying under the ceiling. Fairness needs per-tenant accounting: a token bucket for the steady-state contract, a concurrency limit so expensive requests cannot hog workers, and round-robin queueing so a burst queues behind itself.
CPU is compressible, so the kubelet throttles it rather than evicting for it. Eviction comes from memory, ephemeral storage or inodes - and which pods die is decided by QoS class, not by who caused the pressure. Check node conditions and eviction thresholds first, then fix the requests and limits so critical workloads are Guaranteed rather than BestEffort.
Make the write idempotent before you make it correct: partition-level replace rather than append, so rerunning a day produces the same result whether it runs once or five times. Then work out how far the contamination spread, because a downstream table that accumulated rather than recomputed will not fix itself when the source is repaired.
The queue records that work was sent but cannot know whether the server received it, so any crash between sending and recording the acknowledgement replays the action. At-least-once delivery is the only thing a mobile client can guarantee, so the fix is to make the operation idempotent with a client-generated key persisted alongside the queued action, not to try harder to deliver exactly once.
The endpoint is an unauthenticated internet-facing entry point that writes to your core systems, so treat every field as attacker-controlled. Verify an HMAC over the raw body in constant time, reject stale timestamps, deduplicate on event id, bound the body size, and hand off to a queue rather than processing inline.
The contract captured the shape the consumer sends, not the rules the provider enforces. Optionality lived in the schema while the real requirement lived in provider validation, and no recorded example ever omitted the field. Contract tests only verify interactions they contain, so add the negative example and verify against real code.
A partial index only contains rows matching its predicate, so indexing WHERE deleted_at IS NULL stores five million entries instead of forty million - smaller, shallower, and far likelier to stay cached. The catch is the planner only uses it when it can prove the query predicate implies the index predicate, and it does nothing about dead rows still in the heap.
Async controls when a script downloads, not what it does to the main thread once it executes, so an async tag can still block interaction handling. Prove it with field data attributed to the interaction: INP breaks into input delay, processing and presentation, and each points elsewhere. Then move the work off the critical path.
Work backwards from the review capacity. Fix the alert budget the team can clear, evaluate precision and recall at exactly that budget on data at the real prevalence, define the label and its arrival delay before modelling, and never report accuracy, which a do-nothing model scores 99.95% on.
Write the legal transitions down as a table first, then give the entity one entry point that consults it and no state setter at all. The design question is where the transition rules live and how side effects stay outside the decision that changed the state.
Keep a deque of indices whose values strictly decrease from front to back. Each step drops the front if it has left the window, pops smaller or equal values from the back, then appends. The front is the window maximum. Each index enters and leaves once, so it is amortised O(n), against O(n log k) for a balanced tree.
Build the split to imitate the gap between training and deployment. Group all of an entity's rows onto one side when rows repeat per entity, split forward in time for anything temporal with an embargo covering the label window, and treat a plain random shuffle as the default that silently inflates almost every score.
A collector is a supplier of a mutable container, an accumulator that folds one element into it, a combiner that merges two containers, and a finisher. The combiner runs only in parallel, which is why an untested combiner is the usual defect, and the characteristics tell the pipeline what it may skip or reorder.
A single threshold on a single window cannot separate a real outage from a brief spike, so it either pages on noise or misses slow burns. Replace it with multi-window multi-burn-rate alerting: a fast rule that pages and a slow rule that files a ticket, each gated by a short window so a spike that already stopped does not keep paging.
Reactive scaling has a latency of its own — metric window, evaluation, provisioning, warm-up, health checks — and a surge that arrives faster than that latency is served entirely by the capacity you already had. The fix is a scheduled floor plus a saturation-based signal, not a more aggressive policy.
Configuration, feature flags, content and reference data, schema migrations, infrastructure definitions and dependency updates all change production behaviour, and most organisations ship them through channels that were designed to be faster than the release pipeline.
A composite gives leaves and containers one interface so callers recurse without branching. The two decisions that matter are whether child management appears on that shared interface, and which operations genuinely aggregate - because price, availability and delivery date do not combine the same way. It also connects tree structures to the point an interviewer is testing.
Make time and scheduling injectable. Take a java.time.Clock as a dependency so a test can fix it, and replace a fixed sleep with a bounded poll on the observable outcome, so a fast machine does not wait and a slow one does not fail.
A single large POST fails on the last percent and starts again, and it drags every proxy body limit and idle timeout into your critical path. Either hand out a scoped credential so bytes go straight to storage, or model the upload as a resource with a committed offset the client can resume from.
One queen per row is forced, so search row by row and keep sets of used columns, used sums and used differences to reject a conflict before recursing. The anti-diagonal is the row plus column and the main diagonal the row minus column, and that difference must be shifted into range, not reduced with an absolute value.
Every producer must have a declared answer — block, buffer to a bounded local store, or drop — chosen per event class rather than once for the whole fleet, because the default of blocking on a full in-memory buffer turns a broker outage into an outage of every service that publishes to it.
Rank the causes by how often they are to blame and test them in that order: target leakage, a validation split that ignored group or time structure, train-serve skew, then genuine distribution shift. One cheap experiment separates most of them, which is rescoring logged production rows offline with the same artefact.
Nothing in the pricing engine was broken, so the control has to sit on the change itself: bounds relative to the previous price and the cost, a rate limit on bulk movement, and a kill switch. Then pause dispatch before anyone debates whether to honour the orders.
When a Terraform plan wants to destroy production, stop and identify whether the diff comes from state drift, a provider change, a renamed resource or real configuration intent. Do not approve until the blast radius is understood. It also connects IAC to the point an interviewer is testing.
Attribute observability cost by signal, service and pricing dimension. Then cut by value per byte: debug and duplicate logs at source, logs that should be counters, hot retention nobody queries. Protect audit and security logs, error events and SLO signals from sampling, and never cut by a flat percentage.
Give each thread its own WebDriver session held in thread-local storage, remove every other piece of shared mutable state including test data and static fields, size the run to the grid's slots so requests queue rather than time out, and quit every session even on abnormal exit.
Two transactions can each run the SELECT before either commits, so neither sees the other and both inserts succeed. The fix is a serialisation point the database owns - a unique index on a natural or client-supplied key - plus a defined answer for whoever loses the race. It also connects idempotency to the point an interviewer is testing.
Usually yes for the label and no for the concept. A fossil name is still the word that lets you and the business point at the same thing, so keep it as the shared term, but model what the queue is for today rather than the channel it was named after.
Translate each finding from security language into the same terms the roadmap is already prioritised by — a concrete failure scenario, its business cost, and the cheapest point in the system's lifecycle to fix it — rather than asking for time on the strength of the threat model alone.
Find out what the six weeks is made of before negotiating anything, then choose between cutting scope, splitting the release, launching to a limited cohort and moving the date — and tell everyone who depends on the date the same day you know.
A short, structured technical screen that asks a few questions resembling what the loop will probe, with pass criteria written in advance, run by someone able to follow up. Judge it by whether screen-passers clear the coding round more often without the pipeline collapsing, and count the candidate's time as a cost.
Declare it, take the incident commander role explicitly, and mitigate before you diagnose - roll back or shed load first, understand later. Keep one channel as the record, publish updates on a fixed cadence, hand over rather than push through, and let the review produce owned actions instead of narrative.
Name the one or two things that would genuinely change your answer if you had an offer, ask them of the person best placed to answer, and say why they matter to you. Vagueness here reads as indifference to the job rather than as politeness.
Describe a direction rather than a title, tie it to work this employer plausibly has, and be honest about which parts you have not settled. The question is a retention and self-awareness check, and both an over-rehearsed plan and a shrug fail it.
Scope is the union of the track's sections, the rounds this employer type asks regardless of role, and the industry if you named one. Weights above 1.0 pull a section up the order; below 1.0 push it down. Nothing is excluded - a deprioritised section still appears when its best question is the most relevant thing left.