Java and Spring Backend Interview Questions
Practice production-oriented Java, HTTP, PostgreSQL, Spring, MyBatis, security, testing, reliability, DevOps, and system-design discussions.
Learning objectives
- Structure backend interview answers around mechanism, trade-off, evidence, and failure modes
- Connect language and framework facts to real production decisions
Answer each question in four moves: define the mechanism, apply it to a concrete backend flow, state the trade-off or failure mode, and name the evidence or test you would use. Avoid memorized absolutes such as “JWT is stateless and therefore better.”
01How do equals and hashCode affect a HashMap used by backend code?
Focus: Java value semantics and collection correctness
Strong answer
- Equal objects must have equal hash codes; keys should not mutate in fields used for equality while stored
- Explain collision lookup and connect the contract to DTO/value-object design
Weak signals
- Says HashMap compares only hash codes
Follow-ups
- What changes with a record key?
- When would ConcurrentHashMap help—and not help?
02What creates a Java memory leak when the JVM has garbage collection?
Focus: Reachability, retention, and diagnostic evidence
Strong answer
- Objects remain reachable through unintended long-lived roots such as static caches, listeners, ThreadLocal values, or unbounded queues
- Use heap dump, dominator/retained-size analysis, allocation evidence, and lifecycle review
Weak signals
- Says GC prevents all memory leaks
Follow-ups
- How can ThreadLocal interact with request pools or virtual threads?
03What happens during an HTTPS request to a Spring Boot API?
Focus: End-to-end request lifecycle
Strong answer
- Cover DNS, TCP, TLS, proxy/load balancer, servlet filters/Security, MVC mapping, service, transaction, SQL, serialization, and response
- Name timeout, logging, and trace boundaries
Weak signals
- Starts and ends at the controller
Follow-ups
- Where can 502, 503, and 504 originate?
04How would you design an idempotent payment or voucher-redemption endpoint?
Focus: HTTP, transactions, uniqueness, and concurrent duplicates
Strong answer
- Scope an idempotency key, bind it to a request fingerprint, atomically persist outcome with a unique constraint, and return the stored result for an exact replay
- Discuss in-progress state, expiry, retries, and changed-payload conflict
Weak signals
- Only checks an in-memory cache
Follow-ups
- What if the client times out after commit?
05How does a composite PostgreSQL B-tree index support a query?
Focus: Predicate and ordering alignment
Strong answer
- Start from equality predicates, then range/order columns and a unique tie-breaker; leading columns determine useful scan bounds
- Verify estimated/actual rows, scan, buffers, sort, and write cost with representative plans
Weak signals
- Adds every filtered column in arbitrary order
Follow-ups
- When is a sequential scan the right plan?
06How does @Transactional work, and why can self-invocation fail?
Focus: Spring AOP proxy semantics and rollback
Strong answer
- An external call enters a Spring proxy that uses transaction metadata and a transaction manager around the method
- A same-instance call bypasses the default proxy; RuntimeException/Error roll back by default while checked exceptions do not
Weak signals
- Treats the annotation as compiler magic
Follow-ups
- Why avoid remote calls inside the boundary?
- What does REQUIRES_NEW cost?
07How do #{} and ${} differ in MyBatis?
Focus: SQL binding and injection
Strong answer
- #{} binds a prepared-statement parameter; ${} inserts raw text
- Dynamic identifiers need a server-owned allowlist mapped to fixed fragments
Weak signals
- Says both are safe placeholders
Follow-ups
- How would you test dynamic sorting?
08When would you choose a server session instead of JWT?
Focus: Authentication trade-offs
Strong answer
- A single browser application often benefits from compact secure cookies and straightforward server invalidation
- Discuss CSRF for automatic cookies, shared session storage, token revocation, XSS, independent resource servers, and logout
Weak signals
- Calls JWT automatically more secure or truly stateless in every system
Follow-ups
- How does refresh-token rotation detect reuse?
09What belongs in unit, MVC slice, and PostgreSQL integration tests?
Focus: Risk-based test boundaries
Strong answer
- Unit tests cover pure rules and service decisions; MVC slices cover mapping/validation/security; real PostgreSQL covers SQL, constraints, result maps, rollback, and concurrency
- Use a small full-flow set for wiring and deployment
Weak signals
- Mocks PostgreSQL behavior to verify SQL
Follow-ups
- How do you keep concurrent tests deterministic?
10How would you diagnose database connection-pool exhaustion?
Focus: Observability and causal investigation
Strong answer
- Correlate latency/errors with active, idle, pending, acquisition time, database sessions, slow queries, locks, transaction duration, and thread state
- Mitigate load/leaks/slow work first; do not blindly increase pool size beyond database capacity
Weak signals
- Only restarts the service or doubles the pool
Follow-ups
- What alert and runbook improvement follows?
11When should a small system use a modular monolith rather than microservices?
Focus: System boundary and operational cost
Strong answer
- Prefer one deployment with enforced module boundaries until independent ownership, scaling, reliability, or release evidence justifies distribution
- Compare network failure, data consistency, observability, delivery, and team costs
Weak signals
- Chooses microservices because they scale by definition
Follow-ups
- How would you prepare a module for a later split?
12What makes a Spring Boot deployment production ready?
Focus: Delivery and operations evidence
Strong answer
- Name immutable artifact, non-root image, secrets, migration, probes, graceful shutdown, limits, tests/scans, logs/metrics/traces, alerts, backups/restores, smoke test, rollback, and ownership
- Distinguish readiness, liveness, and business smoke signals
Weak signals
- Says Docker and HTTPS are sufficient
Follow-ups
- How do you roll back after a schema change?
Retrieval check
Before you continue
- Explain the main idea in your own words without rereading the page.
- Name one production problem this knowledge helps prevent.
- Describe where you would apply it in a Spring Boot project.
Source metadata
Primary references checked on 2026-07-16. Version scope is stated at the top of this page.
JDK 25 Documentation (opens in a new tab)
Oracle · official-docs
Spring Boot 3.5.16 System Requirements (opens in a new tab)
Spring · official-docs
Using @Transactional (opens in a new tab)
Spring · official-docs
Servlet Authentication Architecture (opens in a new tab)
Spring · official-docs
PostgreSQL 18 Documentation (opens in a new tab)
PostgreSQL Global Development Group · official-docs
Docker Build Best Practices (opens in a new tab)
Docker · official-docs