🚀 Node.js & SQL Interview Roadmap

A complete, topic-wise and category-wise roadmap to prepare for Node.js backend interviews — including a full SQL section. Use this as a checklist: read the concept, then attempt the linked questions from memory before checking answers elsewhere.

📑 Table of Contents

Part A — Node.js

Fundamentals & Runtime
Event Loop & Asynchronous Programming
Modules & Package Management
Core Modules
Streams & Buffers
Error Handling
Express.js & Web Frameworks
Middleware & REST API Design
Authentication & Authorization
Security
Databases & ORMs (Node side)
Child Processes, Clustering & Worker Threads
Testing
Performance, Debugging & Memory
Microservices & Architecture
Design Patterns in Node.js
Deployment, DevOps & Monitoring
Advanced / Miscellaneous

Part B — SQL 19. SQL Basics 20. Joins 21. Aggregation & Grouping 22. Subqueries & CTEs 23. Window Functions 24. Indexes & Query Performance 25. Transactions & ACID 26. Normalization & Database Design 27. Stored Procedures, Triggers & Views 28. Practical / Scenario-Based SQL Questions

Part C — Extras 29. System Design Questions (Node + SQL context) 30. Quick-Fire Rapid Round

Part A — Node.js

1. Fundamentals & Runtime

Concepts: V8 engine, libuv, single-threaded event loop, JS runtime vs browser runtime, REPL, global object.

What is Node.js and why is it single-threaded?
How does Node.js handle concurrency despite being single-threaded?
What is libuv and what role does it play?
Difference between Node.js and browser JavaScript environments.
What is the purpose of the global object? Name a few global objects.
What is the difference between process.nextTick() and setImmediate()?
What is the Node.js REPL used for?
Explain the difference between synchronous and asynchronous code with an example.
What is the difference between module.exports and exports?
What are the differences between Node.js versions (LTS vs Current)? Why does it matter in production?

2. Event Loop & Asynchronous Programming

Concepts: Call stack, callback queue, microtask queue, phases of the event loop, callbacks, promises, async/await.

Explain the phases of the Node.js event loop (timers, pending callbacks, poll, check, close callbacks).
What is the difference between the microtask queue and macrotask queue?
Why do Promise.then() callbacks run before setTimeout() callbacks even with a 0ms delay?
What is "callback hell" and how do you avoid it?
Explain Promise.all, Promise.race, Promise.allSettled, and Promise.any with use cases.
How does async/await work under the hood? Is it syntactic sugar over Promises?
What happens if you don't await an async function call?
How do you handle multiple parallel async operations vs sequential ones?
What is an event emitter and how does it relate to async patterns in Node?
What's the difference between blocking and non-blocking code? Give a real example (fs.readFileSync vs fs.readFile).

3. Modules & Package Management

Concepts: CommonJS vs ES Modules, npm/yarn/pnpm, semantic versioning, package.json, package-lock.json.

Difference between CommonJS (require) and ES Modules (import/export).
How does Node.js resolve modules (module resolution algorithm)?
What is the purpose of package-lock.json vs package.json?
Explain semantic versioning (^, ~, exact versions).
What are peerDependencies, devDependencies, and dependencies?
How do circular dependencies happen in Node.js, and how do you resolve them?
What is npx and how is it different from npm?
How do you publish a private npm package?
What is tree-shaking and does it apply to CommonJS?
How would you migrate a CommonJS project to ES Modules?

4. Core Modules

Concepts: fs, path, http/https, events, os, crypto, url, querystring, util.

Difference between fs.readFile and fs.createReadStream — when would you use each?
How do you create a basic HTTP server without Express?
How does the EventEmitter class work? Implement a simple pub-sub with it.
How do you hash a password using the crypto module (or note where bcrypt fits in)?
Difference between path.join() and path.resolve().
What is util.promisify() used for?
How do you read environment variables and why use a .env file with dotenv?
What does the os module provide? Give 3 practical use cases.
How do you parse and construct query strings and URLs?
What is the difference between http and https modules in Node?

5. Streams & Buffers

Concepts: Readable, Writable, Duplex, Transform streams, backpressure, Buffer class.

What are the 4 types of streams in Node.js?
What is backpressure and how does Node.js handle it?
How do you pipe streams together? Why is .pipe() preferred over manual data handling?
What is a Buffer and why does Node.js need it (binary data vs strings)?
How would you process a large CSV/log file without loading it entirely into memory?
Explain the difference between stream.pipeline() and .pipe().
How do you create a custom Transform stream?
What happens if you don't handle the error event on a stream?
How do streams relate to memory efficiency in a Node.js server?
Compare buffering the entire file vs streaming it for a file upload API.

6. Error Handling

Concepts: try/catch, error-first callbacks, custom error classes, unhandled rejections, domain vs process-level handling.

What is the "error-first callback" convention?
How do you handle errors in async/await code cleanly?
Difference between operational errors and programmer errors.
How do you create and use custom error classes in Node.js?
What happens on an uncaught exception in Node — how do you handle it gracefully (process.on('uncaughtException'))?
What is an unhandled promise rejection and how do you catch it globally?
How do you implement centralized error-handling middleware in Express?
Should you crash the process on an uncaught exception? Why or why not?
How do you handle errors in a stream pipeline?
What is the difference between throwing an error and passing it to next(err) in Express?

7. Express.js & Web Frameworks

Concepts: Routing, middleware chain, request/response lifecycle, templating, alternatives (Fastify, Koa, NestJS).

How does middleware chaining work in Express (next())?
What is the difference between application-level, router-level, and error-handling middleware?
How do you structure a scalable Express project (MVC / layered architecture)?
How does routing work internally in Express?
Compare Express vs Fastify vs Koa vs NestJS — when would you choose each?
How do you validate request bodies (e.g., Joi, Zod, express-validator)?
What is CORS and how do you configure it in Express?
How do you implement rate limiting in an Express API?
How do you serve static files in Express?
How would you version your REST APIs (/api/v1/...)?

8. Middleware & REST API Design

Concepts: REST principles, status codes, pagination, versioning, idempotency, HATEOAS.

What makes an API "RESTful"? What are the key constraints?
Explain idempotency — which HTTP methods are idempotent?
How do you design pagination for a large dataset (offset vs cursor-based)?
What status codes would you use for: successful creation, validation failure, unauthorized, forbidden, not found, server error?
How do you handle API versioning strategies (URI, header, query param)?
What is the difference between PUT and PATCH?
How would you design a rate-limited, paginated /users endpoint?
What is content negotiation in REST APIs?
How do you handle file uploads in a REST API (multipart/form-data)?
Design a RESTful API for a "blog with comments" feature (endpoints + methods).

9. Authentication & Authorization

Concepts: JWT, sessions, OAuth2, RBAC, refresh tokens, password hashing.

Difference between authentication and authorization.
How does JWT-based authentication work end-to-end?
Where should you store JWTs on the client — cookies vs localStorage — and why?
How do refresh tokens work, and why are they needed alongside access tokens?
How do you implement role-based access control (RBAC) middleware?
What is OAuth 2.0 and how does the authorization code flow work?
How do you securely hash and store passwords (bcrypt/argon2, salting)?
What is session-based auth and how does it differ from token-based auth?
How do you handle logout with JWTs (since they're stateless)?
What is CSRF and how do session-based apps protect against it?

10. Security

Concepts: OWASP Top 10 for Node, input validation, rate limiting, helmet, dependency vulnerabilities.

What are common Node.js security vulnerabilities (OWASP Top 10 relevant ones)?
How do you prevent SQL injection in a Node.js app?
How do you prevent NoSQL injection (e.g., MongoDB query injection)?
What does the helmet middleware do?
How do you prevent XSS in a Node/Express app?
How do you securely manage secrets/environment variables in production?
What is prototype pollution and how can it occur in Node.js apps?
How do you keep npm dependencies secure (npm audit, Snyk, lockfiles)?
How would you implement rate limiting / brute-force protection on a login endpoint?
What is the principle of least privilege and how does it apply to DB users/API keys?

11. Databases & ORMs (Node side)

Concepts: Connecting to SQL/NoSQL DBs, ORMs (Sequelize, TypeORM, Prisma), connection pooling, migrations.

What is connection pooling and why does it matter in a Node.js app?
Compare using a raw SQL driver (e.g., pg, mysql2) vs an ORM (Prisma/Sequelize/TypeORM).
How do you handle database migrations in a Node.js project?
How do you prevent N+1 query problems when using an ORM?
What is the difference between SQL and NoSQL, and when would you choose each in a Node backend?
How do you manage transactions using an ORM (e.g., Prisma's $transaction)?
How do you handle database connection failures and retries gracefully?
What is an ODM (e.g., Mongoose) and how does it differ from an ORM?
How would you structure a repository pattern for database access in Node?
How do you seed a database for local development/testing?

12. Child Processes, Clustering & Worker Threads

Concepts: child_process, cluster module, worker_threads, CPU-bound vs I/O-bound tasks.

Node.js is single-threaded — how do you scale it across multiple CPU cores?
Difference between the cluster module and worker_threads.
When would you use worker_threads vs spawning a child_process?
Difference between spawn, exec, and fork in child_process.
How does a load balancer distribute requests among clustered Node processes?
How do you share state/data between clustered worker processes?
How would you offload a CPU-intensive task (e.g., image processing) without blocking the event loop?
What is PM2 and how does it help with clustering in production?
What are the trade-offs of clustering vs using worker threads for CPU-bound work?
How do zero-downtime restarts work in a clustered Node app?

13. Testing

Concepts: Unit vs integration vs e2e testing, Jest/Mocha, mocking, supertest, TDD.

Difference between unit, integration, and end-to-end tests.
How do you mock a database call in a unit test?
How do you test an Express route (e.g., using supertest)?
What is TDD and how does it change your development workflow?
How do you test asynchronous code (promises, async/await) in Jest/Mocha?
What is code coverage and what's a reasonable target?
How do you set up test fixtures/factories for consistent test data?
How do you mock external API calls in tests (e.g., nock, msw)?
What is the difference between a stub, a mock, and a spy?
How would you structure CI to run tests automatically on every PR?

14. Performance, Debugging & Memory

Concepts: Memory leaks, profiling, --inspect, heap snapshots, event loop lag, caching.

How do you detect and fix a memory leak in a Node.js app?
What tools would you use to profile a Node.js application (--inspect, Chrome DevTools, clinic.js)?
What causes event loop blocking, and how do you detect "lag"?
How would you diagnose a Node.js process consuming high CPU in production?
What is the difference between the stack and the heap in memory management?
How do you implement caching in a Node app (in-memory vs Redis)?
What is garbage collection in V8 and how does it affect performance?
How would you optimize a slow Express API endpoint?
What's the impact of synchronous code (e.g., JSON.parse on huge payloads) on throughput?
How do you load-test a Node.js API (e.g., using k6, Artillery, autocannon)?

15. Microservices & Architecture

Concepts: Monolith vs microservices, message queues, API gateways, service discovery, inter-service communication.

What are the trade-offs of microservices vs a monolithic Node.js app?
How do microservices communicate (REST, gRPC, message queues)?
What is the role of a message broker (RabbitMQ/Kafka) in a Node.js microservices architecture?
How do you handle distributed transactions across microservices (Saga pattern)?
What is an API Gateway and why is it used in microservices?
How do you handle service-to-service authentication?
What is eventual consistency and how does it apply to microservices data?
How would you implement a circuit breaker pattern in Node.js?
How do you handle logging and tracing across multiple microservices (correlation IDs, distributed tracing)?
What is a monorepo, and how does it help/hurt in a Node microservices setup?

16. Design Patterns in Node.js

Concepts: Singleton, Factory, Observer, Middleware, Module, Dependency Injection.

How is the Observer pattern used in Node.js (EventEmitter)?
How would you implement a Singleton pattern for a DB connection in Node?
What is the Middleware pattern and how does Express use it?
How does dependency injection help testability in a Node.js service?
Explain the Factory pattern with a Node.js example (e.g., creating different logger instances).
What is the Module pattern and how does Node's module system relate to it?
How would you implement a simple Pub/Sub system in Node.js?
What is the Repository pattern and why use it with a database layer?
How does the Strategy pattern apply to, say, choosing different payment providers?
What is the Decorator pattern and where might you use it in a Node API?

17. Deployment, DevOps & Monitoring

Concepts: Docker, CI/CD, environment configs, logging, health checks, horizontal scaling.

How do you containerize a Node.js application with Docker (key Dockerfile practices)?
How do you manage different configs for dev/staging/production?
What is a health check endpoint and why is it needed in production?
How do you implement structured logging (e.g., Winston/Pino) in a Node app?
What is graceful shutdown and how do you implement it (handling SIGTERM)?
How would you set up a CI/CD pipeline for a Node.js API?
What is horizontal vs vertical scaling, and how does Node.js fit into each?
How do you monitor a Node.js app in production (APM tools like Datadog, New Relic)?
How do you handle zero-downtime deployments?
What environment variables/secrets management approach would you use in Kubernetes?

18. Advanced / Miscellaneous

What is the difference between process.env.NODE_ENV values and how do they affect app behavior?
Explain how V8 optimizes/de-optimizes JavaScript code (hidden classes, inline caching) at a high level.
What is the difference between require() caching and how can it cause bugs?
How does Node.js handle DNS resolution, and what issues can arise with it (getaddrinfo)?
What is HTTP/2 and does Node.js support it natively?
How would you implement WebSockets in Node.js (native ws vs Socket.IO)?
What is the difference between Object.freeze() and const in the context of immutability?
How do you handle backward compatibility when upgrading a major Node.js version?
What is the Temporal Dead Zone in JavaScript and how does it relate to let/const?
Explain how you'd design a rate limiter using Redis + Node.js (token bucket / sliding window).

Part B — SQL

19. SQL Basics

Difference between DELETE, TRUNCATE, and DROP.
What is the difference between WHERE and HAVING?
Difference between CHAR and VARCHAR.
What is a PRIMARY KEY vs a UNIQUE constraint?
What is a FOREIGN KEY and what does ON DELETE CASCADE do?
Difference between UNION and UNION ALL.
What is the difference between IS NULL and = NULL?
Explain DISTINCT — what happens when used with multiple columns?
What is the order of execution of SQL clauses (FROM → WHERE → GROUP BY → HAVING → SELECT → ORDER BY → LIMIT)?
Difference between BETWEEN and comparison operators for ranges.

20. Joins

Explain INNER JOIN, LEFT JOIN, RIGHT JOIN, and FULL OUTER JOIN with examples.
What is a SELF JOIN and when would you use one?
What is a CROSS JOIN and how is it different from a Cartesian product mistake (missing WHERE)?
How do you find rows in Table A that don't exist in Table B (anti-join pattern)?
Write a query to find duplicate rows using a JOIN or GROUP BY.
What happens to unmatched rows in a LEFT JOIN?
How do you join more than 2 tables in a single query?
Difference between JOIN ... ON and JOIN ... USING.
Can you JOIN on a non-key column? What are the performance implications?
How would you optimize a query with multiple large joins?

21. Aggregation & Grouping

Difference between COUNT(*), COUNT(column), and COUNT(DISTINCT column).
How does GROUP BY interact with aggregate functions like SUM, AVG, MIN, MAX?
Why can't you use aggregate functions directly in WHERE? (Use HAVING instead — explain why.)
Write a query to find the top 3 highest-paid employees per department.
How do you find departments with more than 5 employees?
What happens when you GROUP BY a column not included in SELECT (in strict SQL modes)?
How do NULL values behave inside aggregate functions?
Write a query to calculate a running total (without window functions, using a self-join or subquery).
How would you pivot rows into columns in SQL (e.g., using CASE WHEN + GROUP BY)?
Difference between grouping by one column vs multiple columns.

22. Subqueries & CTEs

What is a correlated subquery vs a non-correlated subquery?
What is a CTE (WITH clause) and how does it improve query readability?
Difference between a subquery in the WHERE clause vs the FROM clause (derived table).
When would you use a CTE over a subquery, and vice versa?
What is a recursive CTE? Give an example (e.g., traversing an org hierarchy).
Can a CTE be referenced multiple times in the same query?
Write a query using a subquery to find employees earning more than their department's average salary.
What are the performance considerations of nested subqueries vs joins?
Difference between EXISTS and IN — when is one preferred over the other?
How do you avoid redundant computation when using the same subquery multiple times?

23. Window Functions

What is a window function and how is it different from a GROUP BY aggregate?
Explain ROW_NUMBER(), RANK(), and DENSE_RANK() — how do they differ?
What does the PARTITION BY clause do inside OVER()?
Write a query to get the top N records per group using ROW_NUMBER().
How do you calculate a running total using SUM() OVER (ORDER BY ...)?
What is LAG() and LEAD() used for? Give a practical example (e.g., month-over-month change).
Difference between RANGE and ROWS in a window frame specification.
How would you find the second-highest salary using a window function?
Can you use a window function result inside a WHERE clause directly? Why not (and how do you work around it)?
Write a query to compute a 7-day moving average of daily sales.

24. Indexes & Query Performance

What is an index and how does it speed up queries (B-tree basics)?
Difference between a clustered index and a non-clustered index.
What is a composite (multi-column) index, and how does column order matter?
When can adding an index hurt performance (e.g., on writes)?
What is a covering index?
How do you read and interpret an EXPLAIN / EXPLAIN ANALYZE output?
What is a full table scan, and how do you avoid it?
How does a LIKE '%value%' query affect index usage, and how would you optimize text search instead?
What is query plan caching, and how does parameterization affect it?
How would you diagnose and fix a slow-running query in production?

25. Transactions & ACID

Explain ACID properties (Atomicity, Consistency, Isolation, Durability) with examples.
What are the SQL transaction isolation levels (READ UNCOMMITTED, READ COMMITTED, REPEATABLE READ, SERIALIZABLE)?
What is a dirty read, non-repeatable read, and phantom read?
How do you start, commit, and roll back a transaction in SQL?
What is a deadlock, and how can you prevent/detect one?
What is optimistic vs pessimistic locking?
How does SELECT ... FOR UPDATE work, and when would you use it?
What is the difference between a transaction and a savepoint?
How do distributed transactions differ from single-database transactions (2PC, Sagas)?
What happens if a connection drops mid-transaction?

26. Normalization & Database Design

What is normalization? Explain 1NF, 2NF, 3NF with examples.
What is denormalization and when would you intentionally denormalize?
What is a composite primary key?
How do you design a many-to-many relationship in a relational schema (junction/bridge table)?
What is referential integrity, and how do foreign keys enforce it?
How would you design a schema for an e-commerce system (orders, products, users, inventory)?
What is a surrogate key vs a natural key?
How do you handle soft deletes in schema design (deleted_at pattern) vs hard deletes?
What are the trade-offs between storing data as JSON in a column vs normalized tables?
How would you design a schema to support versioned/audit-trailed records?

27. Stored Procedures, Triggers & Views

What is a stored procedure, and what are its pros/cons vs application-level logic?
What is a trigger, and give an example use case (e.g., auto-updating a updated_at column).
What is a view, and how is it different from a materialized view?
When would you use a materialized view, and what's the trade-off (staleness vs performance)?
What is a function vs a stored procedure in SQL?
How do triggers affect performance and debuggability of an application?
Can a view be updatable? Under what conditions?
How would you use a stored procedure to enforce complex business rules atomically?
What are the security benefits of using stored procedures (e.g., against SQL injection)?
How do you version-control and deploy changes to stored procedures/triggers?

28. Practical / Scenario-Based SQL Questions

Write a query to find the second-highest salary in an employees table.
Write a query to find duplicate email addresses in a users table.
Write a query to find employees who have the same manager as another specific employee.
Given orders(order_id, customer_id, order_date, amount), write a query to find each customer's most recent order.
Write a query to find customers who have placed orders in every month of the current year.
Write a query to swap values of two columns without using a temporary column.
Write a query to delete duplicate rows while keeping one copy.
Given a employees(id, name, salary, department) table, write a query for the Nth highest salary per department.
Write a query to find gaps in a sequence of IDs.
Design and write the SQL to implement a simple leaderboard with ranks (handling ties).

Part C — Extras

29. System Design Questions (Node + SQL context)

Design a URL shortener — discuss schema (SQL), API design (Node/Express), and caching strategy.
Design a rate limiter for an API gateway — discuss data store choice (Redis vs SQL) and algorithm (token bucket/sliding window).
Design the backend for a chat application — discuss WebSocket handling in Node and message storage schema in SQL.
How would you design a notification system (email/SMS/push) using a Node.js queue-based architecture?
Design a schema and API for a job-board application (jobs, applications, employers, candidates).
How would you scale a Node.js + PostgreSQL application from 1,000 to 1,000,000 users (read replicas, caching, sharding)?
Design an idempotent payment processing API — how do you prevent double charges at both the app and DB level?
How would you implement full-text search — SQL LIKE/tsvector vs a dedicated search engine (Elasticsearch)?
Design a schema and background job system for a "scheduled reminders" feature.
How would you handle database schema migrations with zero downtime in a live Node.js production system?

30. Quick-Fire Rapid Round

Is Node.js single-threaded or multi-threaded? (Single-threaded event loop, multi-threaded under the hood via libuv's thread pool.)
== vs === in JavaScript — quick answer.
let vs const vs var — quick answer.
SQL vs NoSQL — one-line trade-off.
INNER JOIN vs LEFT JOIN — one-line difference.
npm vs yarn vs pnpm — one differentiator each.
authentication vs authorization — one-line difference.
PUT vs PATCH — one-line difference.
process.nextTick() vs setImmediate() — one-line difference.
clustered index vs non-clustered index — one-line difference.

📌 How to use this roadmap

Go category by category — don't skip fundamentals even if you feel confident.
For every question, try to answer out loud or in writing before checking references.
Pair every SQL "write a query" question with actually running it against a local Postgres/MySQL instance.
Revisit the Quick-Fire Rapid Round the night before your interview as a final refresher.

Good luck! 💪

carefree-ladka/Node.js & SQL Interview Roadmap.mdx