The core-subject rounds common in campus hiring and still used to probe depth in experienced interviews.
26 published across 6 topics.
Processes and threads, scheduling, virtual memory and paging, synchronisation, and deadlock handling.
Deadlock needs all four Coffman conditions at once: mutual exclusion, hold and wait, no preemption and circular wait. Breaking any one prevents it, and the practical choice is usually circular wait, by making every thread take locks in one global order.
A process is a running program with its own address space and OS resources; a thread runs inside a process with its own stack and registers but shares its memory and files. In a process vs thread answer, the trap is calling sharing a free win: it makes threads cheap and makes one thread's bug everyone's.
Shared memory gives you bytes, not coordination. Process synchronisation needs a mutex inside the region, marked PTHREAD_PROCESS_SHARED and initialised once. If the holder dies, a plain mutex stays locked forever; a robust mutex returns EOWNERDEAD, but repairing half-written data is your job.
Suspect a bounded resource rather than a saturated one: file descriptors, threads, ephemeral ports or the listen queue. Each has a different scope — per process, per user, per cgroup, per system — and each announces itself with a different error, which is how you tell them apart. Use this RLIMIT answer to show the decision, trade-off, and evidence rather than a memorised definition.
A context switch in an operating system saves one thread's CPU state, runs the scheduler and restores another thread. Application developers care because excessive switches add latency through cache and TLB disruption, lock contention and oversized thread pools. It also connects scheduling to the point an interviewer is testing.
Virtual memory gives each process a private address space and lets the MMU map virtual pages to physical frames. A page fault traps to the kernel; a minor fault maps memory cheaply, while a major fault waits for storage and can dominate performance. It also connects PAGING to the point an interviewer is testing.
The layered model, TCP versus UDP, congestion control, routing, and what happens when you load a URL.
Six steps in order: the browser checks its cache, DNS resolution turns the hostname into an IP address, a TCP handshake opens a connection, a TLS handshake authenticates the server and agrees keys, an HTTP request fetches the page, and the browser renders it. Panels push on DNS, the handshakes and certificates.
TCP guarantees an ordered byte stream and pays for it with head-of-line blocking and retransmissions that arrive too late to be useful. UDP is right when a late packet is worthless, when you need multicast, or when you intend to build your own reliability with different trade-offs.
A TTL is an upper bound on how long a resolver may cache a record, not a promise about when clients will notice a change. Lowering it only takes effect after one old TTL has elapsed, negative answers are cached under a different rule, and pooled connections keep using an address they resolved hours ago.
The browser checks its caches, resolves the hostname through browser, OS and resolver caches, opens a TCP connection, completes a TLS handshake, sends the request, then parses the streamed response. QUIC fuses transport and crypto setup into one round trip and stops one lost packet stalling every stream.
Relational algebra, functional dependencies, normal forms, and concurrency-control theory.
In a transfer, atomicity means the debit and credit commit together or not at all, consistency means declared constraints such as a non-negative balance still hold, isolation stops concurrent transactions seeing or overwriting each other's half-done work, and durability means a confirmed commit survives a crash.
Normalise by naming each functional dependency and splitting on it: atomic values for 1NF, no column depending on part of a composite key for 2NF, no non-key column depending on another for 3NF. Undo it only for a measured read path, and say who keeps the copies in step.
This is write skew. Both transactions read the same snapshot, decide independently, and write disjoint rows, so there is no write-write conflict for the engine to catch. The invariant spanned rows it never saw as related, so either make the conflict physical or use true serialisability.
Normalisation removes redundancy so a fact is stored once; 3NF is reached when every non-key column depends on the key and nothing but the key. You denormalise knowingly, to buy read performance with write complexity. ACID guarantees far less than candidates assume, particularly its C.
A schedule is serialisable when its effect matches running the same transactions one after another in some order, which is the criterion isolation is defined against. Two-phase locking achieves it by forbidding a transaction from acquiring any lock after releasing one, and the price is deadlock.
Abstraction and the classical definitions, plus the terminology questions asked verbatim in screens.
OOP examples beat definitions: a class refusing a bad withdrawal shows encapsulation, a caller depending on an interface shows abstraction, a subclass reusing a parent method shows inheritance, and one loop running different overrides shows polymorphism. Inheritance is wrong when the child breaks a parent promise.
Substitutability is a claim about behaviour, and signatures carry none of it. A subclass that rejects an argument its supertype accepted has strengthened a precondition, which the compiler cannot see: the code type-checks, and it breaks callers that were written correctly against the base type.
Encapsulation, inheritance, polymorphism and abstraction are worth stating as consequences rather than definitions - what each one buys you and what it costs. Abstraction decides what a type means to its caller; encapsulation protects how that meaning is upheld.
The compiler cannot know, so it emits an indirect call through a per-class table of function pointers that the object carries a reference to. The lookup itself is a couple of memory accesses; the real cost is the optimisations the compiler cannot perform when the target is not known until run time.
Compilation phases, interpretation versus JIT, memory layout, and garbage-collection theory.
Regular expressions in the formal sense describe exactly the regular languages, the ones a finite automaton recognises with fixed memory, so they cannot match balanced parentheses or anything needing an unbounded count. Backreferences take practical regex past that class and cost the linear-time matching guarantee.
A JIT compiles against a profile gathered earlier, so its fast code rests on assumptions that can be invalidated: a new receiver type at a call site, a branch taken for the first time, a class loaded that gives an interface a second implementation. The method deoptimises and recompiles from a worse profile. It also connects deoptimisation to the point an interviewer is testing.
Source is tokenised, parsed, checked, lowered to an intermediate representation, optimised and emitted - either ahead of time to machine code or to bytecode executed by a runtime. A JIT compiles hot bytecode at run time using profiles, which is why managed programs get faster after warm-up. Use this compilers answer to show the decision, trade-off, and evidence rather than a memorised definition.
OWASP categories, cryptography basics, hashing versus encryption, and secure-by-default habits.
rand() % 6 yields 0 to 5, and because RAND_MAX + 1 is not a multiple of 6 it shows modulo bias towards 0 and 1. Rejection sampling fixes the bias. It becomes a vulnerability when an attacker benefits from predicting the value, as with tokens, keys or nonces, because rand() is predictable. Those need a CSPRNG.
Escaping is meaningless without a destination, and at the point input arrives you do not know which parser will consume it. Injection is a property of the sink, so the defence belongs at each sink — bound parameters, an argument vector rather than a shell string, encoding chosen by output context — not at the edge. It also connects input validation to the point an interviewer is testing.
A certificate binds a public key to a domain name and is signed by a chain ending at a root already in your device's trust store. It proves that whoever holds the matching private key controlled that name at issuance - nothing about the operator's honesty - and revoking it early barely works.
Password hashing vs encryption comes down to reversibility: encrypted passwords can be recovered with a key, while hashes are verified one way. Password storage needs salts and slow memory-hard algorithms such as Argon2, bcrypt or scrypt, not fast SHA-256.