The network and the web
1. What happens when you type a URL and press enter?
The browser resolves the hostname via DNS (checking its own cache, then the OS, then a resolver). It opens a TCP connection to the resulting IP, completing the three-way handshake, then performs a TLS handshake for HTTPS to agree keys and verify the server's certificate. It sends an HTTP request; the server - possibly behind a load balancer, CDN or reverse proxy - returns a response. The browser parses the HTML, requests linked resources, builds the DOM and renders. This one question touches almost every layer worth knowing, which is why it is asked so often.
2. What is the difference between TCP and UDP, and when would you choose UDP?
TCP is connection-oriented and reliable: it establishes a connection, guarantees ordered delivery and retransmits lost packets, at the cost of latency and overhead. UDP is connectionless and unreliable but minimal. Choose UDP where late data is worthless - live video and voice, real-time game state, DNS queries - because retransmitting a frame that should already have been displayed is worse than dropping it.
3. What is the difference between authentication and authorisation?
Authentication establishes who you are; authorisation establishes what you are allowed to do. Logging in is authentication; being refused access to another user's records is authorisation. They fail differently and are often conflated in code, which is how one of the most common classes of security vulnerability arises - a system that verifies identity correctly and then never checks permission on the specific resource requested.
Practice this now
Related reading
Operating systems and concurrency
4. What is the difference between a process and a thread?
A process has its own memory space; threads within a process share it. That makes threads cheaper to create and to switch between, and communication between them trivial - which is also exactly why they are dangerous, since shared mutable state without synchronisation produces race conditions. Processes are isolated, so a crash in one does not corrupt another.
5. What is a race condition, and how do you prevent one?
A bug where the outcome depends on the interleaving of concurrent operations - two threads reading a value, both incrementing it and both writing back, so one increment vanishes. Prevention means making the critical section atomic: a lock, an atomic operation, a transaction, or eliminating the shared mutable state entirely. Race conditions are intermittent and load-dependent, which is why they reach production and are so unpleasant to reproduce.
6. What is a deadlock, and what conditions are required for one?
Two or more threads each waiting for a resource the other holds, so none proceeds. Four conditions must all hold: mutual exclusion, hold and wait, no preemption, and circular wait. Break any one and deadlock becomes impossible - which is why the standard practical fix is imposing a global ordering on lock acquisition, eliminating the circular wait.
Practice this now
Data structures and complexity
7. What is Big-O notation, and why does it matter more than raw speed?
It describes how an algorithm's cost grows with input size, ignoring constant factors. It matters because constants are bounded and growth is not: an O(n²) algorithm can beat an O(n log n) one on a hundred items and be hopeless on a million. It is a statement about scaling, not about which code runs faster today.
8. How does a hash table work, and when does it stop being O(1)?
A key is hashed to an index in an array of buckets, giving average O(1) lookup. It degrades when many keys collide into the same bucket - in the worst case, every key - turning lookup into a linear scan. A good hash function and a bounded load factor (resizing and rehashing as it fills) are what keep the average case true, which is why the O(1) is always qualified as average.
9. What is the difference between a stack and a queue, and where does each appear in real systems?
A stack is last-in-first-out, a queue is first-in-first-out. Stacks appear in function call management, expression evaluation, undo history and depth-first traversal; queues appear in breadth-first traversal, task scheduling, message brokers and request buffering. Choosing the wrong one produces systems that starve their oldest work.
Practice this now
Databases
10. What is a database index, and what does it cost?
A separate data structure - usually a B-tree - that lets the database find rows without scanning the whole table, turning a linear search into a logarithmic one. The cost is real: extra storage, and slower writes, since every insert, update and delete must maintain every index on the table. This is why indexing every column is a mistake rather than an optimisation.
11. What do the ACID properties guarantee?
Atomicity - a transaction happens entirely or not at all. Consistency - it moves the database from one valid state to another. Isolation - concurrent transactions do not observe each other's partial work. Durability - once committed, it survives a crash. The one worth understanding deeply is isolation, since real databases offer several levels of it and the weaker ones permit anomalies your code may not expect.
12. When would you choose a non-relational database over a relational one?
When your access pattern genuinely does not fit relations: very high write throughput with simple lookups, schema that varies per record, documents read as a whole, or horizontal scale beyond what a single relational instance handles. The honest answer includes the reverse - most applications are better served by a relational database, and 'we chose NoSQL for scale' is frequently a decision made before any scale existed.
Practice this now
Systems, security and correctness
13. How should passwords be stored?
Never in plaintext and never with a fast general-purpose hash. Use a deliberately slow password-hashing function designed for the purpose, with a unique random salt per user so identical passwords produce different hashes and precomputed tables are useless. The slowness is the security property - it makes brute-force attempts expensive. Anyone who answers 'hash it with a fast hash' has identified the right idea and the wrong tool.
14. What is idempotency, and why does it matter for APIs?
An operation is idempotent if performing it repeatedly has the same effect as performing it once. It matters because networks fail ambiguously: a client that gets no response cannot tell whether the request succeeded, so it retries. If the operation is not idempotent, the retry charges the card twice. GET and PUT are naturally idempotent; POST is not, which is why payment APIs use client-supplied idempotency keys.
15. What does caching cost you, and why is invalidation the hard part?
A cache trades correctness risk for speed. Reads get faster, but now two copies of the truth exist and they can disagree - so every cache needs an answer to how stale data becomes correct again. The hard part is invalidation because it requires knowing every place a value is cached and every event that changes it, which is a global property of the system rather than a local one. Bonus concept: eventual consistency, where the copies converge over time and your code must tolerate reading a stale value.
How to read your own score
The value of this list is not the total but the location of the gaps. Missing the network questions points at the layer between your code and the user; missing concurrency points at the bugs you will meet under load; missing databases points at where your performance will go; missing security means a real risk rather than a knowledge gap.
- ✓Answered all fifteen with the trade-offs, not just the definitions - you have the fundamentals a senior interview probes.
- ✓Ten to fourteen - solid. Read up on the specific misses; each is a self-contained topic worth an evening.
- ✓Five to nine - normal for someone early in their career, and the fastest possible improvement available to you. These concepts explain a disproportionate share of real problems.
- ✓Fewer than five - you have found your study plan, and it is a good one. Start with concurrency and databases, since those produce the most confusing production behaviour.
- ✓The test for genuinely knowing any of these is whether you can name what it costs. Anyone can define an index; knowing that it slows writes is the part that changes decisions.