Q: What's the difference between async and defer on a tag?

Both download the script in parallel with HTML parsing. async executes the moment the download finishes; defer waits until the whole document is parsed. Use defer for scripts that need the DOM (like the bundle that renders your app). Use async for scripts that don't — analytics, for instance.

Question 1

What's the difference between async and defer on a <script> tag?

Accepted Answer

Both download the script in parallel with HTML parsing. async executes the moment the download finishes; defer waits until the whole document is parsed.

Use defer for scripts that need the DOM (like the bundle that renders your app). Use async for scripts that don't — analytics, for instance.

Question 2

Is JavaScript pass-by-reference or pass-by-value?

Accepted Answer

JavaScript is pass-by-value. Arguments are copied into the function; reassigning them doesn't touch the original. The confusion is objects: what gets copied is a pointer to the object. The copy still points at the original, so mutating the object inside a function mutates the original. Pass-by-value — even when it feels like pass-by-reference.

Question 3

What resource do closures make JavaScript consume more of?

Accepted Answer

Memory. A closure means the function remembers the lexical scope it was created in, so the garbage collector can't reclaim anything still reachable from it. That's heap memory — RAM. It's a big part of why JavaScript is a memory-heavy language.

Question 4

How can you improve a bad CLS (Cumulative Layout Shift)?

Accepted Answer

CLS happens when elements get added to the DOM as you render, or change size as CSS, fonts and images arrive late. Three fixes: extract critical CSS for the above-the-fold view, set explicit width and height on images (the browser reserves the space before the file loads), and use skeleton placeholders for data-dependent elements.

Question 5

Which web performance metric suffers most from excessive re-renders?

Accepted Answer

INP — Interaction to Next Paint: the time from a user interaction to the repaint. Google's bar for good is under 200ms. Unnecessary re-renders are the usual cause. Fix with React.memo, useMemo, useCallback — and the early-return pattern in component design.

Question 6

What can class components do that functional components can't?

Accepted Answer

Hook into lifecycle methods like componentDidCatch and getDerivedStateFromError — the error-boundary machinery. Rarely needed, but if you're building something like a logging library (react-sentry style), that's the escape hatch.

Question 7

Which performance metric improves most with SSR?

Accepted Answer

LCP. The server pre-renders the component tree to HTML, so the browser paints the largest element as soon as it arrives instead of waiting for JavaScript. CLS improves too — pre-rendered elements don't shift — and the white screen of death disappears. The lineup: FCP = first element painted; FID = time until the page responds to input; TTFB = first byte from the server; LCP = largest element painted.

Question 8

What are TypeScript generics, and when do you use them?

Accepted Answer

Code constructs that take type arguments — flexibility without giving up strict checking.

You use one daily: React's useState. `useState<number>(0)` fixes the state's type via a generic type argument.

Question 9

What's the difference between git rebase and git merge?

Accepted Answer

Both integrate branches. git rebase rewrites history, replaying your commits on top of the target branch — a linear, cleaner log. git merge preserves history as it happened, with a merge commit.

Question 10

Which HTTP status code means forbidden access?

Accepted Answer

403. Client errors are the 4xx range: 401 means no credentials were provided (unauthorized); 403 means credentials were provided but this resource is off-limits.

Question 11

What is a preflight request?

Accepted Answer

An OPTIONS request the browser sends automatically before the real one, to check CORS: the server answers with the allowed origins, methods and headers. It fires whenever you fetch a domain other than your own.

Question 12

What is content negotiation?

Accepted Answer

Serving the same resource in different formats based on request headers. The browser says `Accept: gzip, br` and the server returns the compressed variant if it has one.

That's what enables end-to-end compression — a CSS file shipped as .css.gzip instead of raw.

Question 13

What are valid ways to version an API for breaking changes?

Accepted Answer

URI (api.com/v2), query parameter (?version=v2), or the Accept header.

URI versioning is the most common: cleaner separation, fewer caching surprises, and frontend developers switch versions by switching a URL.

Question 14

Which REST methods are idempotent?

Accepted Answer

GET, PUT and DELETE. POST and PATCH are not. Idempotent means repeating the action changes nothing further — multiplying by one, not adding one. It matters in microservices, where flaky networks make clients retry requests that already succeeded.

Question 15

WebSockets vs Server-Sent Events — what's the difference?

Accepted Answer

WebSockets are bidirectional: both sides push events. Right for live chat. Server-sent events are one-directional — the server streams, the client listens. That's ChatGPT-style LLM apps and live tickers.

Question 16

What is cyclomatic complexity?

Accepted Answer

A code-quality metric counting the linearly independent paths through code — an if/else has complexity 2.

Tools like SonarQube measure it per commit and flag functions that have grown too branchy to test.

Question 17

How does a database index make queries faster?

Accepted Answer

It builds a B-tree over the indexed column, so lookups run in logarithmic time instead of a full table scan — for a million rows, ~19 lookups instead of a million. The trade: writes and updates get slower, because the tree has to be maintained too.

Question 18

What prevents a DDoS attack?

Accepted Answer

Traffic filtering plus load balancing: block known-bad IPs and absorb the spike without falling over. Rate limiting helps against a single abusive client, but a distributed attack rotates sources — it's not the primary defense.

Question 19

In the Open-Closed Principle, what does 'closed' mean?

Accepted Answer

Closed for modification, open for extension: you can change a component's behavior without touching its internals.

React version: a dropdown that takes an onSelect callback prop is open for extension — new behavior, zero edits to the component. That's SOLID in the frontend.

Question 20

Which deployment strategy has zero downtime?

Accepted Answer

Blue/green: build a fresh environment, verify it's healthy, then switch traffic. The old environment stays warm for instant rollback.

Question 21

How do you prevent a man-in-the-middle attack?

Accepted Answer

TLS — HTTPS — encrypting the traffic between the two parties end to end. Everything else is secondary.

Question 22

Which of these qualify as reverse proxies?

Accepted Answer

Load balancers, CDNs and API gateways — they all act on behalf of the server. A VPN is a regular proxy: it acts on behalf of the client.

Question 23

What's the drawback of round-robin load balancing?

Accepted Answer

Unfair distribution: it rotates blindly, assuming every server and every request is equal. A heavy request lands on an already-busy instance anyway.

Better: least connections, or balancing on APM metrics like CPU and memory.

Question 24

What is the 'microservices tax'?

Accepted Answer

The extra complexity of running a microservices architecture: service-to-service auth, security, networking. You pay it in engineering effort long before you pay it in cloud bills.

Question 25

Garbage collection and memory leaks — which statements are true?

Accepted Answer

Two things are true: memory leaks still happen in garbage-collected languages (see closures in JavaScript), and circular references can keep the collector from reclaiming memory.

GC is neither complete nor real-time — it frees what's unreachable, when it gets around to it.

The 25 Most Asked Technical Interview Questions

Real questions, senior answers