← All topics

System Design Middle interview questions and answers

75 questions for a System Design (Middle) interview - with correct answers, explanations and links to the docs.

Take this quiz
  1. 1.What is the right way to start answering a frontend system design question?
  2. 2.Why is cursor pagination better than offset pagination for a feed?
  3. 3.How would you design an infinite feed with thousands of posts?
  4. 4.What matters when designing autocomplete?
  5. 5.What is the main trade-off of GraphQL compared to REST?
  6. 6.What is the N+1 problem in GraphQL and how is it solved?
  7. 7.When is tRPC a good fit?
  8. 8.What caching layers exist between the user and the database?
  9. 9.How should JS and CSS bundles be cached?
  10. 10.What does Cache-Control: max-age=60, stale-while-revalidate=600 do?
  11. 11.Why is cache invalidation called one of the hardest problems?
  12. 12.What is the main drawback of stateless JWTs compared to server-side sessions?
  13. 13.Where is it safer to store a session token in the browser?
  14. 14.Why use a pair of access and refresh tokens?
  15. 15.Which OAuth flow is recommended for SPAs and mobile apps?
  16. 16.How does OpenID Connect differ from OAuth 2.0?
  17. 17.How do you protect against CSRF with cookie-based authentication?
  18. 18.What should you use for real-time notifications that only flow from the server?
  19. 19.What should be handled when a WebSocket reconnects?
  20. 20.How do you safely retry a payment request after a network error?
  21. 21.Why add random jitter to exponential retry backoff?
  22. 22.How should user file uploads to cloud storage be organized?
  23. 23.How do you reliably upload multi-gigabyte files?
  24. 24.How do you handle conflicts when two users edit the same record?
  25. 25.How would you build offline mode for a notes app?
  26. 26.What makes an app a PWA?
  27. 27.Which rendering strategy makes sense for a landing page, a catalog and a user dashboard?
  28. 28.What's wrong with fully hydrating a large content page?
  29. 29.How do you track performance for real users?
  30. 30.How do you speed up navigation to the page the user is likely to open next?
  31. 31.Why are third-party scripts (analytics, chats, ads) dangerous for performance?
  32. 32.How does a canary release differ from blue-green?
  33. 33.How do you gradually enable a new feature for 10% of users?
  34. 34.What are the pros and cons of a monorepo for several frontend apps?
  35. 35.What is the foundation of a scalable design system?
  36. 36.How should the UI behave when one dashboard widget fails?
  37. 37.Why pass a request id / trace id from the frontend through to the backend?
  38. 38.How does the token bucket rate limiting algorithm work?
  39. 39.How do you show other participants' cursors in a collaborative editor without flooding the network?
  40. 40.The unread message counter differs between tabs. How do you fix it?
  41. 41.How do you load translations in a multilingual SPA without bloating the bundle?
  42. 42.Which HTTP security headers should a web app configure?
  43. 43.How do you send analytics events efficiently?
  44. 44.Why can returning totalCount in every list response be expensive?
  45. 45.How does an API Gateway differ from a BFF?
  46. 46.How do you update the client cache after a mutation so the user sees the changes?
  47. 47.What is the back/forward cache and how do you avoid breaking it?
  48. 48.How do you handle an access token expiring while the user is working?
  49. 49.Why is search for large catalogs done on the server rather than by filtering on the client?
  50. 50.How do you manage focus when opening a modal in an SPA?
  51. 51.How do Cache-Control: no-cache and no-store differ?
  52. 52.What does Cache-Control: private mean for a CDN?
  53. 53.When does the browser send a CORS preflight request, and how can you avoid it?
  54. 54.What do SameSite=Lax and SameSite=Strict cookies change?
  55. 55.What is IDOR, and how is it prevented?
  56. 56.How does PATCH differ from PUT?
  57. 57.Why use a standard error format like RFC 9457 Problem Details?
  58. 58.How should a client react to 429 Too Many Requests with a Retry-After header?
  59. 59.What does <link rel="preconnect"> give you?
  60. 60.What does 103 Early Hints allow?
  61. 61.Which service worker caching strategy fits which resource?
  62. 62.What does Background Sync help with in an offline-capable app?
  63. 63.When should heavy computation move to a Web Worker?
  64. 64.How should a global app handle dates and times?
  65. 65.How does synthetic monitoring differ from real user monitoring (RUM)?
  66. 66.How do SLI, SLO and SLA differ?
  67. 67.A page needs data from 6 microservices. What reduces chattiness for the client?
  68. 68.Why should a webhook endpoint respond quickly and process the event asynchronously?
  69. 69.How do liveness and readiness probes differ?
  70. 70.What do GraphQL persisted queries give you?
  71. 71.How do you announce asynchronous updates (e.g. "3 new messages") to screen reader users?
  72. 72.Why can sticky sessions on a load balancer cause problems?
  73. 73.How should secrets (API keys, DB passwords) be managed in a deployment?
  74. 74.Why can an unbounded GET /api/items (no limit) become an incident?
  75. 75.What is a key frontend concern when designing a large multi-step form (wizard)?