1. What is a Graph? Explain different types of graphs

A graph is a non-linear data structure made up of vertices (nodes) and edges (connections between nodes). Types: Directed Graph (edges have direction u → v), Undirected Graph (edges have no direction), Weighted Graph (edges have associated costs), Unweighted Graph (all edges equal), Cyclic Graph (contains at least one cycle), Acyclic Graph (no cycles, e.g., DAG), Connected Graph (all nodes reachable from each other), Bipartite Graph (nodes can be divided into two sets with edges only between sets).

2. Difference between Min Heap and Max Heap

A Min Heap is a complete binary tree where every parent node is less than or equal to its children — the root holds the minimum element. A Max Heap is a complete binary tree where every parent node is greater than or equal to its children — the root holds the maximum element. Both support insert and extract in O(log n). Used in priority queues, heap sort, and Dijkstra's algorithm.

3. What is Dynamic Programming? Provide an example

Dynamic Programming (DP) solves problems by breaking them into overlapping subproblems, solving each once, and storing results (memoization or tabulation) to avoid recomputation. Example: Fibonacci — instead of recalculating fib(n-1) and fib(n-2) repeatedly, store computed values in an array. Other examples: 0/1 Knapsack, Longest Common Subsequence, Coin Change, Matrix Chain Multiplication.

4. Explain Greedy Algorithm with an example

A Greedy Algorithm makes the locally optimal choice at each step, hoping to find a global optimum. It doesn't reconsider past choices. Example: Activity Selection Problem — always pick the activity that finishes earliest. Other examples: Kruskal's/Prim's MST, Huffman Encoding, Dijkstra's shortest path. Greedy works when the problem has the greedy choice property and optimal substructure.

5. What is a Trie data structure? Where is it used?

A Trie (Prefix Tree) is a tree where each node represents a single character and paths from root to leaf spell out words. Insert and search are O(L) where L is word length. Used in: autocomplete, spell checkers, IP routing tables, word search in a grid, prefix matching, and contact search.

6. Difference between Divide and Conquer vs Dynamic Programming

Both break problems into subproblems. In Divide and Conquer (Merge Sort, Quick Sort), subproblems are independent and don't overlap — results aren't stored. In Dynamic Programming, subproblems overlap and would be solved multiple times without memoization — DP stores results to avoid recomputation. DP trades space for time; D&C doesn't.

7. What is Memoization?

Memoization is a top-down DP optimization technique where results of expensive function calls are cached (usually in a HashMap or array) so repeated calls with the same input return the cached result immediately instead of recomputing. It converts exponential recursive solutions to polynomial time — e.g., Fibonacci from O(2^n) to O(n).

8. Explain Kadane's Algorithm

Kadane's Algorithm finds the maximum sum subarray in O(n) time and O(1) space. It maintains a running sum currentSum and updates maxSum at each step: currentSum = max(nums[i], currentSum + nums[i]) and maxSum = max(maxSum, currentSum). If currentSum becomes negative, it resets to the current element. Used as a base for 2D maximum submatrix sum problems.

9. What is a Disjoint Set / Union-Find?

Disjoint Set Union (DSU) or Union-Find tracks a set of elements partitioned into disjoint (non-overlapping) subsets. Supports two operations: Find (which set does element belong to?) and Union (merge two sets). With path compression and union by rank, both operations are near O(1) amortized. Used in Kruskal's MST, cycle detection, and network connectivity problems.

10. What is Topological Sorting?

Topological Sort arranges nodes of a Directed Acyclic Graph (DAG) in linear order such that for every directed edge u → v, u appears before v. Used in task scheduling, build systems, course prerequisite ordering, and dependency resolution. Implemented via DFS (reverse postorder) or Kahn's Algorithm (BFS with in-degree tracking). Not possible if the graph has a cycle.

1. What is the difference between JDK, JRE, and JVM?

JVM (Java Virtual Machine) executes Java bytecode — it's platform-specific and provides memory management, garbage collection, and runtime environment. JRE (Java Runtime Environment) = JVM + standard class libraries — needed to run Java programs. JDK (Java Development Kit) = JRE + compiler (javac) + debugging tools + development utilities — needed to develop Java programs.

2. What is garbage collection in Java?

Garbage Collection (GC) automatically reclaims memory occupied by objects no longer referenced, preventing memory leaks. Java's GC runs in the background using algorithms like Mark-and-Sweep, Generational GC (Young/Old/PermGen), and G1 GC. You cannot explicitly call GC (System.gc() is a suggestion, not a command). In C/C++, memory management is manual (malloc/free, new/delete).

3. What are decorators in Python?

Decorators are functions that wrap another function to extend or modify its behavior without changing its source code. Syntax: @decorator_name above a function. Examples: @staticmethod, @classmethod, @property. Custom decorators use closures. Common uses: logging, authentication, caching (memoization), timing functions, and access control.

4. What is the GIL in Python?

The Global Interpreter Lock (GIL) is a mutex in CPython that allows only one thread to execute Python bytecode at a time, even on multi-core processors. This simplifies memory management but limits true multi-threading for CPU-bound tasks. Solutions: use multiprocessing (separate processes) for CPU-bound tasks, or use async/await for I/O-bound concurrency. PyPy and Jython don't have a GIL.

5. What are pointers in C++?

A pointer is a variable that stores the memory address of another variable. Declared with *: int* ptr = &x. Dereferencing (*ptr) accesses the value at the address. Pointer arithmetic allows traversal of arrays. Used for dynamic memory allocation (new/delete), passing large objects by reference, and implementing data structures. Dangling pointers (pointing to freed memory) and memory leaks are common bugs.

1. How would you design a URL shortener?

Core components: API server, database, cache (Redis). Flow: user submits a long URL → generate a unique short code (hash or base62 encode an auto-increment ID) → store mapping in DB → return short URL. On access: look up short code in cache first, then DB → redirect to original URL. Handle: hash collisions, custom aliases, expiry, analytics (click count). Scale with read replicas and CDN.

2. Explain the concept of Load Balancing

A load balancer distributes incoming requests across multiple servers to prevent overload, improve availability, and reduce latency. Algorithms: Round Robin (equal distribution), Least Connections (server with fewest active connections), IP Hash (same client always reaches same server). Types: Layer 4 (transport layer, TCP/UDP) and Layer 7 (application layer, HTTP). Examples: Nginx, AWS ALB, HAProxy.

3. What is caching? Types of caching strategies?

Caching stores frequently accessed data in fast storage to reduce latency and database load. Types: In-memory cache (Redis, Memcached), Browser cache (static assets), CDN cache (edge servers), Database query cache. Strategies: Cache-Aside (app manages cache), Write-Through (write to cache + DB simultaneously), Write-Back (cache first, async DB write), Read-Through. Eviction policies: LRU, LFU, FIFO.

4. Explain microservices vs monolithic architecture

A monolith packages all features in one deployable unit — simple to develop/test initially but becomes hard to scale and maintain. Microservices splits the application into independent services (auth, payments, orders), each with its own database and deployable independently. Benefits: independent scaling, tech diversity, fault isolation. Challenges: network latency, distributed transactions, service discovery, operational complexity.

1. What is denormalization and when to use it?

Denormalization intentionally introduces redundancy into a normalized database to improve read performance. Instead of joining multiple tables, data is pre-joined and stored together. Trade-off: faster reads but slower writes and more storage. Use when: read performance is critical, data is read much more than written, joins are expensive, or working with analytical/reporting databases (OLAP).

2. Explain transaction isolation levels

Isolation levels define how transactions interact concurrently. From lowest to highest: Read Uncommitted (can read uncommitted changes/dirty reads), Read Committed (only reads committed data), Repeatable Read (same query returns same results within transaction), Serializable (transactions execute as if serial). Higher isolation = fewer anomalies but lower concurrency and performance.

3. What is sharding in databases?

Sharding is horizontal partitioning that splits a large database into smaller, faster pieces called shards, distributed across multiple servers. Each shard holds a subset of data (e.g., users A-M on shard 1, N-Z on shard 2). Improves write throughput and storage capacity. Challenges: cross-shard queries, rebalancing when adding shards, maintaining consistency.

4. Explain CAP theorem

CAP theorem states a distributed system can guarantee at most 2 of 3 properties: Consistency (every read gets the most recent write), Availability (every request receives a response), Partition Tolerance (system works despite network partitions). Since network partitions are inevitable, systems choose CP (consistent + partition tolerant — HBase, Zookeeper) or AP (available + partition tolerant — Cassandra, DynamoDB).

5. Write a query to find employees who earn more than their manager

SELECT e.name AS employee, e.salary AS emp_salary,
       m.name AS manager, m.salary AS mgr_salary
FROM employees e
JOIN employees m ON e.manager_id = m.emp_id
WHERE e.salary > m.salary;

1. What is Session vs Cookie vs Local Storage?

Cookie: stored on client, sent with every HTTP request, 4KB limit, can have expiry, accessible server-side. Session Storage: stored in browser, cleared when tab closes, ~5MB, not sent with requests. Local Storage: stored in browser, persists until cleared, ~5-10MB, not sent with requests. Use cookies for auth tokens (with HttpOnly + Secure flags), localStorage for user preferences, sessionStorage for temporary tab-specific data.

2. What is OAuth 2.0?

OAuth 2.0 is an authorization framework that allows third-party applications to access user resources without exposing credentials. Flow: user clicks "Login with Google" → app redirects to Google → user grants permission → Google returns authorization code → app exchanges code for access token → app uses token to access user data. The user never shares their password with the third-party app.

3. Explain JWT (JSON Web Token)

JWT is a compact, self-contained token for securely transmitting information between parties as a JSON object. Structure: Header.Payload.Signature (Base64 encoded). Header: algorithm type. Payload: claims (user data, expiry). Signature: HMAC or RSA signature for verification. Server signs the token; client stores it; client sends it with each request; server verifies signature. Stateless — no server-side session storage needed.

4. What is GraphQL? How is it different from REST?

GraphQL is a query language for APIs where the client specifies exactly what data it needs. Unlike REST (multiple fixed endpoints, may over-fetch or under-fetch), GraphQL has a single endpoint and returns only requested fields. Supports queries (read), mutations (write), and subscriptions (real-time). Benefits: eliminates over-fetching, reduces round trips, strongly typed schema. Drawbacks: more complex caching, higher learning curve.

5. Explain event loop in JavaScript

JavaScript is single-threaded with a non-blocking event loop. The call stack executes synchronous code. Async operations (setTimeout, fetch, Promises) are handled by Web APIs. When complete, callbacks are placed in the task queue (macrotasks) or microtask queue (Promises). The event loop continuously checks: if call stack is empty → process all microtasks → then process one macrotask → repeat. Microtasks have higher priority.

1. What is SQL injection? How to prevent it?

SQL injection is an attack where malicious SQL code is inserted into input fields to manipulate the database — e.g., entering ' OR '1'='1 to bypass login. Prevention: use parameterized queries / prepared statements (most effective), input validation and sanitization, use ORM frameworks, principle of least privilege for DB users, WAF (Web Application Firewall).

2. What is XSS attack?

Cross-Site Scripting (XSS) injects malicious scripts into web pages viewed by other users. Stored XSS: malicious script saved in DB, executed for every visitor. Reflected XSS: script in URL, executed immediately. DOM-based XSS: client-side script manipulation. Prevention: sanitize and escape user input before rendering, Content Security Policy (CSP) headers, use frameworks that auto-escape (React).

3. What is SSL/TLS?

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are cryptographic protocols that provide secure communication over the internet. TLS handshake: server presents certificate → client verifies → exchange session keys → encrypted communication begins. Provides confidentiality (encryption), integrity (MAC), and authentication (certificates). HTTPS = HTTP over TLS. Port 443 for HTTPS vs 80 for HTTP.

4. What is two-factor authentication?

2FA requires two forms of identity verification: something you know (password) + something you have (OTP via SMS/authenticator app, hardware token) or something you are (biometric). Even if password is compromised, attacker cannot access account without the second factor. TOTP (Time-based OTP — Google Authenticator) is more secure than SMS (vulnerable to SIM swapping).

1. Tell me about a time you showed leadership

Use STAR: describe a situation where you took initiative — leading a college project, organizing an event, or guiding a junior. Focus on: how you motivated the team, resolved disagreements, kept everyone on track, and the outcome. Quantify if possible: "delivered on time with 3 team members" or "project won best project award."

2. Describe a situation where you resolved a conflict in a team

Highlight your communication and empathy skills. Situation: disagreement on tech stack or approach. Action: organized a discussion, listened to all perspectives, focused on the project goal (not personalities), proposed a compromise. Result: team aligned, project moved forward. Shows maturity and collaboration.

3. Describe a time you had to learn something quickly

Interviewers love growth mindset. Example: needed to learn a new framework for a hackathon in 48 hours — describe how you structured your learning (documentation, tutorials, practice), what you built, and what you retained. Shows adaptability.

4. Tell me about a time you received tough feedback

Shows self-awareness and coachability. Key: you received the feedback graciously (not defensively), reflected on it honestly, made a specific change, and the result improved. Avoid making the person who gave feedback sound unreasonable.

5. Describe a time you failed and what you learned

Be honest — pick a real failure. The key is not the failure itself but your self-awareness and growth. What went wrong → what was your role → what did you learn → what would you do differently. Shows maturity and accountability.

1. How would you handle an unrealistic deadline?

Show planning skills: break work into phases, communicate concerns early (not at the deadline), negotiate scope or resources, present a realistic timeline with trade-offs, and commit to a revised plan. Proactive communication is key.

2. What if your team member is not contributing to the project?

Show team ownership: first have a private, empathetic conversation to understand their challenges. Offer help. If it continues, discuss with the team lead. Never throw teammates under the bus. Focus on solutions, not blame.

1. You have 8 balls, one is heavier. Find it in 2 weighings

Weigh 3 vs 3. If balanced → heavier ball is in remaining 2 (weigh them to find it). If unbalanced → heavier is in the heavier group of 3 (weigh any 2 of the 3 — if balanced, the third is heavier; if unbalanced, the heavier side wins).

2. How do you measure 4 liters using 3L and 5L jugs?

Fill 5L → pour into 3L (5L has 2L left) → empty 3L → pour 2L from 5L into 3L → fill 5L again → pour into 3L (which has 2L, needs 1L more) → 5L now has exactly 4 liters.

3. A clock shows 3:15. What is the angle between the hands?

At 3:15: minute hand at 90° (15 min × 6°/min). Hour hand: at 3:00 it's at 90°, in 15 min it moves 15 × 0.5° = 7.5°, so at 97.5°. Angle between hands = 97.5° - 90° = 7.5 degrees.

4. How many golf balls fit in a school bus?

Estimation: school bus ≈ 2.5m × 2.5m × 8m = 50 cubic meters = 50,000,000 cm³. Golf ball diameter ~4.3cm, volume ~42 cm³. Packing efficiency ~64%. Balls = 50,000,000 × 0.64 / 42 ≈ ~760,000 golf balls. Show the approach — precision matters less than method.

1. What problem does your project solve?

Clearly articulate the real-world problem, who faces it, and how your project addresses it. Avoid vague answers. Example: "Our app reduces the time freshers spend finding verified off-campus job postings from 2 hours to 10 minutes by aggregating and filtering from multiple sources."

2. Why did you choose this particular tech stack?

Show deliberate decision-making. Mention: performance requirements, team expertise, ecosystem, scalability, and trade-offs you considered. Example: "We chose React for the frontend due to component reusability and MongoDB for flexible schema since our data structure was evolving rapidly during development."

3. What was the most challenging feature you built?

Pick something technically interesting — real-time updates, complex filtering, authentication flow, API integration, performance optimization. Describe the challenge, your approach, alternatives you considered, and what you learned.

4. How did you ensure security in your project?

Cover: input validation, password hashing (bcrypt), JWT for authentication, environment variables for secrets (not hardcoded), HTTPS, rate limiting, sanitizing user input to prevent XSS/SQL injection. Even on student projects, mentioning these shows security awareness.