Full-Stack Engineer Interview — Complete Preparation Guide
How to use this page. This is the end-to-end reference for anyone targeting a full-stack engineer role (frontend + backend + data + mobile + DevOps), from a junior 0–2 yrs to a senior 7+ yrs. It complements the system-design-focused pages in this module — start with
OVERVIEWfor the 4-step framework, then return here for the full-stack stack-specific drills.
1. What "Full-Stack" Actually Means in 2026
A "full-stack engineer" today is not a one-person army — it's someone who can own a feature end-to-end, design its API, ship its UI, observe it in production, and ship the next iteration. The exact boundary shifts per company, but the expected skills fall into five rings.
| Level | What you must own | What you must understand |
|---|---|---|
| Junior (0–2 yrs) | Frontend feature OR backend endpoint | The other half of the stack, basic Git/PR hygiene |
| Mid (3–5 yrs) | A full feature: DB → API → UI | Deployment, observability, basic scaling |
| Senior (6+ yrs) | A full product surface, mentorship, on-call rotation | Cost, security, multi-region, system design |
| Staff+ | Technical direction across services | Org-level trade-offs, hiring, platform strategy |
2. The Interview Loop — What to Expect
A full-stack loop is typically 4–6 rounds spread over 2–4 weeks.
💡 The exact mix depends on the company. Big tech leans DSA + system design heavy; startups lean full-stack live coding + behavioral heavy.
3. Frontend Deep Dive
3.1 Core concepts the interviewer will test
| Topic | What you should be able to explain in 30 seconds | Drill question |
|---|---|---|
| Browser rendering | Critical render path, reflow vs repaint | "Why does document.write block rendering?" |
| Event loop | Microtask vs macrotask queues | "What's the order of: setTimeout(fn, 0), Promise.resolve().then(fn), queueMicrotask(fn)?" |
| React/Vue internals | Virtual DOM, reconciliation, hooks rules | "Why does useEffect(() => fn(), [obj]) run every render?" |
| State management | Local state, context, store, server cache | "When would you reach for Redux vs React Query?" |
| CSS layout | Flexbox vs Grid, BFC, stacking contexts | "Why does margin: auto not centre vertically inside a flex item?" |
| Accessibility | ARIA roles, keyboard navigation, contrast | "How would you make a custom dropdown accessible?" |
| Build tooling | Vite/Webpack, tree-shaking, code splitting | "How do you split a route and pre-load it on hover?" |
| Performance | Web Vitals, lazy loading, prefetching | "How do you measure and improve LCP on a slow 4G?" |
| Security | XSS, CSRF, CORS, CSP, JWT pitfalls | "Why is storing JWT in localStorage risky?" |
3.2 Live-coding pattern: build a feature, not a toy
You will usually be asked to build a small app end-to-end. Pick the right stack-fast and structure it properly.
60-second clarifying checklist:
- Single-select or multi-select? (changes state shape)
- Remote or local data? (changes loading + cache strategy)
- Accessibility expectations — keyboard navigation required?
- Performance budget — list size, debounce interval?
- Empty / loading / error states — what should each look like?
3.3 React patterns you must be able to write from memory
tsx
// 1. Debounced search with cancellation
function useDebounced<T>(value: T, ms = 300): T {
const [v, setV] = useState(value);
useEffect(() => {
const t = setTimeout(() => setV(value), ms);
return () => clearTimeout(t);
}, [value, ms]);
return v;
}
// 2. Cache + cancel in-flight fetch
function useSearch(query: string) {
const [data, setData] = useState<Result[]>([]);
useEffect(() => {
if (!query) return;
const ctrl = new AbortController();
fetch(`/api/search?q=${query}`, { signal: ctrl.signal })
.then((r) => r.json())
.then(setData)
.catch(() => {}); // ignore AbortError
return () => ctrl.abort();
}, [query]);
return data;
}3.4 Common frontend traps
| Trap | Better |
|---|---|
Putting state in useEffect instead of computing during render | Derive; only sync with useEffect |
useMemo / useCallback everywhere (over-engineering) | Only memo when profiled |
| Fetching in a parent then drilling props | React Query / SWR / a store |
| Mixing CSS-in-JS, Tailwind, and global CSS | Pick one system per project |
JSON.parse(userInput) in a <script> block | Never — that's XSS |
4. Backend Deep Dive
4.1 What you must know cold
| Topic | Drill question | One-line answer |
|---|---|---|
| HTTP semantics | PUT vs PATCH? | PUT is full replace; PATCH is partial |
| Idempotency | Why do payment APIs require an idempotency key? | Network retries otherwise double-charge |
| AuthN vs AuthZ | JWT carries which? | Identity, not permissions — put permissions in scopes |
| Sessions vs tokens | When to use each? | Sessions for first-party web; tokens for APIs/mobile |
| Rate limiting | Token bucket vs leaky bucket? | Token allows bursts; leaky smooths flow |
| Caching | Cache-aside vs write-through? | Cache-aside is simpler; write-through is fresher |
| Queues | At-least-once vs exactly-once? | Queues are at-least-once; consumers make it effectively-once via idempotency |
| Transactions | ACID vs BASE? | ACID is strong consistency; BASE is eventual |
4.2 Build a CRUD API from memory (Node + Express)
javascript
// server.js — minimum-viable production API
import express from "express";
import { z } from "zod";
import { Pool } from "pg";
const app = express();
app.use(express.json());
const db = new Pool({ connectionString: process.env.DATABASE_URL });
const TodoInput = z.object({
title: z.string().min(1).max(200),
done: z.boolean().optional(),
});
app.post("/todos", async (req, res, next) => {
try {
const body = TodoInput.parse(req.body);
const { rows } = await db.query(
"INSERT INTO todos(title, done) VALUES($1, $2) RETURNING *",
[body.title, !!body.done]
);
res.status(201).json(rows[0]);
} catch (e) {
if (e.issues) return res.status(400).json({ error: e.issues });
next(e);
}
});
app.get("/todos/:id", async (req, res) => {
const { rows } = await db.query("SELECT * FROM todos WHERE id = $1", [
req.params.id,
]);
if (!rows[0]) return res.status(404).json({ error: "Not found" });
res.json(rows[0]);
});
app.use((err, _req, res, _next) => {
console.error(err);
res.status(500).json({ error: "Internal Server Error" });
});
app.listen(3000);What this snippet shows the interviewer:
- Validation at the boundary, not inside business logic.
- HTTP semantics:
201 Created,404 Not Found,400 Validation,500 Internal. - Parameterised queries — SQLi safe.
- Centralised error handler.
4.3 Schema design drill (interview favourite)
"Design a schema for a multi-tenant SaaS billing system."
How to talk about it:
- Multi-tenant isolation: row-level security (Postgres RLS) or schema-per-tenant.
- Idempotent invoicing: store
period_start+period_endas a unique key per tenant. - Soft delete with
deleted_at; neverDELETEfinancial records.
4.4 Backend traps
| Trap | Better |
|---|---|
try/catch inside await chains instead of letting express-async-errors do it | Use a wrapper or express-async-errors |
Storing passwords with md5(password) | Use bcrypt / argon2id |
| Trusting the client to compute the price | Server-side re-price every order |
| Returning stack traces in 500s | Generic message + server-side logging |
| Hard-coded secrets in code | Environment vars + a secrets manager |
5. Database — Where Most Full-Stackers Lose Points
5.1 Decision matrix
| Need | Reach for | Why |
|---|---|---|
| Strict transactions, joins, reports | PostgreSQL / MySQL | ACID, mature tooling |
| Document-shaped data, evolving schema | MongoDB / Firestore | Schema flexibility |
| Key-value with TTL, atomic counters | Redis / DynamoDB | Sub-ms latency, simple semantics |
| Time-series / metrics | TimescaleDB / InfluxDB | Compression + time-aware queries |
| Search full-text | Elasticsearch / OpenSearch / Meilisearch | Inverted index, relevance scoring |
| Vector / RAG | pgvector / Pinecone / Weaviate | ANN search |
| OLAP / analytics | ClickHouse / Snowflake / BigQuery | Columnar, fast aggregation |
5.2 Indexing — the one thing that decides performance
sql
-- Query: get the latest 20 orders for a customer
SELECT * FROM orders WHERE customer_id = $1 ORDER BY created_at DESC LIMIT 20;
-- Bad: index on customer_id only → sort step is O(n log n)
-- Good: composite index on (customer_id, created_at DESC)
CREATE INDEX idx_orders_customer_created
ON orders (customer_id, created_at DESC);Rule of thumb: index the columns in the same order as the WHERE → ORDER BY → LIMIT chain. Leftmost-prefix matters.
5.3 N+1 problem — the classic trap
sql
-- N+1: 1 query for users, then N queries for posts
SELECT id FROM users WHERE org_id = 1; -- query 1
SELECT * FROM posts WHERE author_id = $1; -- query 2..N+1
-- Fixed: JOIN
SELECT u.id, p.*
FROM users u
LEFT JOIN posts p ON p.author_id = u.id
WHERE u.org_id = 1;Or in an ORM:
javascript
// Sequelize / Prisma: use `include` / `with`
const users = await User.findAll({
where: { orgId: 1 },
include: [{ model: Post }],
});6. Mobile (React Native / Flutter / Native) — Often Asked at Full-Stack Roles
6.1 What to know
| Topic | One-liner |
|---|---|
| Offline-first | Persist locally, sync on reconnect, resolve conflicts |
| Auth on mobile | Use the platform keystore (Keychain / Keystore), never localStorage |
| Push notifications | FCM (Android) / APNs (iOS); never store secrets in the app binary |
| App size & startup | Code-split, lazy-load heavy screens; track cold-start time |
| Platform quirks | iOS permissions, Android background limits, deep links |
| OTA updates | CodePush / Expo Updates for JS bundles; never OTA native code |
6.2 Offline-first sketch
javascript
// 1. Write locally first
const local = await db.todos.put({ id: uuid(), title, done: false });
// 2. Enqueue sync job (works offline)
await syncQueue.add({ op: "create", table: "todos", id: local.id });
// 3. Background worker flushes when online
syncQueue.on("online", async () => {
for (const job of await syncQueue.pending()) {
await fetch(`/api/${job.table}`, {
method: "POST",
body: JSON.stringify(job.payload),
});
await syncQueue.ack(job.id);
}
});Conflict resolution: prefer last-write-wins for simple counters; CRDT for collaborative data.
7. DevOps, Security, and Observability
7.1 CI/CD pipeline you'll be asked to draw
Interview answer template:
"On push, GitHub Actions runs lint + unit tests + integration tests. A Docker image is built and pushed to ECR. Argo CD sees the new tag in the staging overlay and rolls it out. Once smoke tests pass, a manual approval promotes the same image to production with a canary strategy (5% → 25% → 100%) using Istio. Datadog watches error rate, p99 latency, and saturation; if any breach SLOs for 5 minutes, the rollout auto-rolls back."
7.2 Observability — the three pillars
| Pillar | What it answers | Tool |
|---|---|---|
| Logs | What happened to this request? | ELK, Loki, CloudWatch |
| Metrics | How is the system doing overall? | Prometheus, Datadog, CloudWatch |
| Traces | Where did this request spend its time? | OpenTelemetry → Jaeger / Tempo |
Correlation is what ties them together: every log line and every span carries a trace_id so you can jump from a metric to a slow trace to the offending log line.
7.3 Security checklist
| Layer | Defence |
|---|---|
| Transport | HTTPS everywhere, HSTS, TLS 1.2+ |
| Auth | OAuth 2.0 / OIDC; rotate keys; short-lived access tokens |
| Input | Server-side validation; reject unknown fields |
| Output | Encode by context (html, attr, url, js); CSP headers |
| Data at rest | KMS-encrypted DBs and S3 buckets |
| Secrets | Vault / AWS Secrets Manager; never in .env committed to Git |
| Dependencies | npm audit / pip-audit in CI; renovate-bot for updates |
| Infra | Least-privilege IAM; private subnets for DBs; WAF in front of public apps |
8. System Design — The Full-Stack Lens
You will almost certainly have one or two system-design rounds. Use the 4-step framework — here is the full-stack-specific twist.
8.1 What "full-stack" adds to the conversation
A pure backend candidate draws boxes and arrows. A full-stack candidate is expected to also discuss:
- Edge rendering vs SPA vs SSR (Next.js, Remix, Astro)
- CDN strategy for static assets, images, video
- WebSocket / SSE for realtime features
- Mobile-specific offline, push, deep links
- Browser caching (
Cache-Control,ETag, service workers)
8.2 A 60-minute walkthrough template
| Min | Phase | What you say / draw |
|---|---|---|
| 0–5 | Clarify | "What are the core features, who are the users, what's the scale, what's the consistency budget?" |
| 5–10 | Estimate | "10M DAU, 100 rps peak, 10:1 read-write, 1 KB avg record → 1 TB/year." |
| 10–20 | HLD | Client → CDN → LB → app tier → cache → DB. Get buy-in. |
| 20–40 | Deep dive | Pick the two most interesting components (cache + feed, search + ranking, etc.). |
| 40–55 | Trade-offs | "I chose X because Y; the cost is Z; here's when I'd flip it." |
| 55–60 | Wrap | SPOFs, monitoring, next 10× iteration. |
8.3 Common full-stack design prompts
- Design a news feed (pull vs push, fanout on write vs read)
- Design Google Drive (sync, conflicts, chunks, quotas)
- Design YouTube (upload pipeline, transcoding, CDN, recommendations)
- Design Uber (geo-indexing, dispatch, surge pricing)
- Design a Slack-like chat (WebSockets, presence, history)
- Design Notion (CRDT, blocks, realtime collab)
- Design a payment system (idempotency, ledger, reconciliation)
- Design a rate limiter (token bucket, Redis Lua, per-tenant keys)
📖 The system-design drills are in practice-problems, and the deep dives for each component (caching, queues, sharding, etc.) live in the System Design module index and across 02-scalability/, 03-databases/, 04-caching/, 05-messaging/.
9. Coding Drills — Must-Solve Patterns
You will be given arrays, strings, trees, graphs, and dynamic programming. The high-frequency patterns below cover ~80% of full-stack interview questions.
9.1 The 12 patterns
- Two pointers — sorted array dedupe, pair sums
- Sliding window — longest substring without repeat
- Hash map / set — first non-repeating character
- Stack / queue — valid parentheses, next greater element
- Binary search — search in rotated sorted array
- Linked list — reverse, detect cycle, merge
- Trees (BFS/DFS) — level-order, max depth, lowest common ancestor
- Graphs — number of islands, course schedule (topological sort)
- Heap / priority queue — kth largest, merge k lists
- Backtracking — permutations, N-queens, word search
- Greedy — jump game, meeting rooms
- Dynamic programming — climbing stairs, coin change, longest common subsequence
9.2 The 60-minute live-coding pattern
9.3 A worked example — "Longest Substring Without Repeating Characters"
javascript
// Problem: given a string, return the length of the longest substring without repeating chars.
function lengthOfLongestSubstring(s) {
const seen = new Map(); // char → last index
let best = 0,
start = 0;
for (let end = 0; end < s.length; end++) {
if (seen.has(s[end]) && seen.get(s[end]) >= start) {
start = seen.get(s[end]) + 1; // jump past the duplicate
}
seen.set(s[end], end);
best = Math.max(best, end - start + 1);
}
return best;
}What you say out loud while coding:
"Sliding window. I'll keep a left pointer
startand a hashmap of last seen indices. When I hit a duplicate, I jumpstartpast the previous occurrence. TimeO(n), spaceO(min(n, Σ))."
10. The Behavioral Round — Where Senior Hires Are Made
Most candidates under-prepare this. It is 30–50% of the final score.
10.1 The STAR(C) framework
| Letter | Meaning | What you must say |
|---|---|---|
| S | Situation | 1 sentence of context (project, team, time) |
| T | Task | The specific thing you owned |
| A | Action | 3–5 bullets of what you did (use "I", not "we") |
| R | Result | Quantified outcome (perf, $, bugs, people) |
| C | Complexity / Trade-off (the senior version) | What did you give up? What would you do differently? |
10.2 Stories you must have ready
- A bug you shipped to production — and how you detected + fixed it.
- A technical disagreement with a senior peer — how you resolved it.
- A project where scope grew 3× — how you cut it back to ship.
- A time you optimised something with a before/after metric.
- A cross-team collaboration — what made it work.
- A failure / missed deadline — what you learned and changed.
- A time you mentored a junior into shipping independently.
- An ambiguous problem you took from 0 → shipped.
10.3 Questions you should ask them
- "What does onboarding look like for the first 90 days?"
- "What's the biggest technical debt the team is carrying right now?"
- "How does on-call rotation work, and what's the typical pager volume?"
- "How are disagreements about tech stack decided?"
- "What's the promotion rubric for the next level?"
- "What does success look like for this role in 12 months?"
11. The Project Walkthrough — Your Secret Weapon
Almost every full-stack loop has "walk me through a project you're proud of" — usually the first 10 minutes of a behavioural or a system-design round.
11.1 Build a one-pager before the interview
Use this template. Print it. Memorise it. Time yourself at 4 minutes.
1. The hook — 1 sentence: what it does and why it matters
2. The problem — 2 sentences: what was broken / missing before
3. Your role — 1 sentence: "I owned the API + frontend + deployment"
4. Architecture — 1 ASCII box diagram (no fancy art)
5. Key decision 1 — "I chose Postgres over Mongo because …"
6. Key decision 2 — "I introduced Redis here to keep p99 < 50 ms"
7. The trade-off — "I gave up real-time consistency; the alternative was …"
8. Outcome — "Reduced p95 from 1.2 s → 180 ms; cost $X/month; team size Y"
9. What I'd redo — "I'd add feature flags and a circuit breaker"11.2 What NOT to do
| Don't | Do |
|---|---|
| 12-minute monologue | 4 minutes, then ask "Want me to deep-dive on any part?" |
| Use "we" everywhere | Use "I" for your work, "we" for team work |
| Take credit for a team's output | Be honest about who did what |
| Hand-wave over the hard parts | Those are exactly where the score is won |
| Recite a feature list | Tell the story with stakes |
12. 8-Week Study Plan
If you are starting from zero, this is the minimum viable plan to be ready for a mid-level full-stack loop.
Daily rhythm (2–3 hrs/day):
- Mon–Fri — 1 hr DSA, 1 hr stack topic, 30 min reading.
- Sat — 1 mock interview (peer or Pramp).
- Sun — Rest, or write a study note / blog post (forces teaching).
12.1 Top resources (free + paid)
| Topic | Resource |
|---|---|
| DSA | NeetCode 150, LeetCode, "Grokking the Coding Interview" |
| React | react.dev, Epic React, official docs |
| Backend | "Designing Data-Intensive Applications" (DDIA) — the bible |
| System design | "System Design Interview Vol 1 & 2" (Alex Xu), this repo |
| Behavioural | "Cracking the PM Interview" + STAR worksheet |
| Mock interviews | Pramp, interviewing.io, a friend |
13. Day-Before Checklist
- [ ] Re-read your project walkthrough notes (4-minute timer).
- [ ] Rehearse 3 STAR stories out loud.
- [ ] Re-skim latency numbers (cache 100 ns, RAM 100 µs, disk 10 ms, WAN 100 ms).
- [ ] Re-skim the 4-step system design framework.
- [ ] Charge laptop, test camera/mic, clear desk.
- [ ] Have water, a notebook, and a pen.
- [ ] Pick 3 questions to ask the interviewer (see §10.3).
- [ ] Sleep 8 hours. Interviews at 2 PM after 4 hours sleep is a self-inflicted loss.
14. TL;DR Cheat-Sheet
- Frontend — own the browser: HTML/CSS/JS fundamentals, React internals, a11y, performance.
- Backend — own the request: HTTP, auth, validation, error handling, observability.
- Data — own the schema: SQL, indexes, joins, transactions, replication.
- DevOps — own the deploy: CI/CD, containers, monitoring, on-call.
- System design — follow the 4-step framework; lead with trade-offs.
- Coding — pattern recognition > memorising 500 problems.
- Behavioural — STAR(C), quantified outcomes, "what you'd do differently."
- Walkthrough — 4-minute one-pager; time yourself.
Related pages in this module
- Module Overview — 4-step system-design framework
- Insider's Guide — end-to-end URL Shortener walkthrough
- Requirements Clarification — Step 1 deep dive
- Back-of-the-Envelope Estimation — Step 2 deep dive
- High-Level Design — Step 3 deep dive
- Deep Dive & Detailed Design — Step 4 deep dive
- Practice Problems — Node.js / SQL / GraphQL drills
- Wrap-Up — single points of failure, monitoring, future scaling
- Trade-offs — explicit trade-off catalogue
- Topic deep dives: Caching, Databases, Database Scaling, Load Balancing, Message Queues, Microservices, Storage Systems, Rate Limiting, Security, Network Protocols, GraphQL vs REST, Consistency Patterns, Monitoring & Observability