Interview Q&A

Short answer: Global filters apply to all MVC actions, registered via AddControllers or AddMvc options. Controller or action filters are applied via attributes directly on controllers or actions. Global filters are best for cross-cutting concerns like logging, exception handling. Controller/action filters are best for behavior specific to particular routes or endpoints.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Filter attributes are instantiated per request and support parameters, but have limited DI capabilities. Service-based filters (using ServiceFilter or TypeFilter) allow filters to be resolved from DI container, enabling constructor injection. Use service-based filters when you need dependencies injected.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: uthentication). Use filters for MVC-specific concerns tied to action execution (authorization, validation, caching). Filters can complement middleware for granular control within MVC. Example: Use middleware for global exception logging, filters for handling MVC-specific exceptions and returning appropriate views or API responses. Versioning,… CORS

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use middleware for concerns that affect all requests (logging, CORS, authentication). Use filters for MVC-specific concerns tied to action execution (authorization, validation, caching). Filters can complement middleware for granular control within MVC. Example: Use middleware for global exception logging, filters for handling MVC-specific exceptions and returning appropriate views or API responses. Versioning, CORS

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: API versioning enables multiple versions of your API to coexist, allowing clients to migrate gradually.

Explain a bit more

Common ways to version APIs in ASP.NET Core: URL versioning (e.g., /api/v1/products) Query string versioning (e.g., /api/products?api-version=1.0) Header versioning (custom header like api-version: 1.0) ● Media type versioning (via Accept header, e.g., application/json;v=1) Use the Microsoft.AspNetCore.Mvc.Versioning NuGet package: services.AddApiVersioning(options => { options.AssumeDefaultVersionWhenUnspecified = true;

Example code

options.DefaultApiVersion = new ApiVersion(1, 0);
options.ReportApiVersions = true; });

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: api-version=1.0) Header versioning (custom header like api-version: 1.0) Media type versioning (via Accept header, e.g., application/json;v=1) Use the Microsoft.AspNetCore.Mvc.Versioning NuGet package: services.AddApiVersioning(options => { options.AssumeDefaultVersionWhenUnspecified = true; options.DefaultApiVersion = new ApiVersion(1, 0);……… api-version=1.

Explain a bit more

0) Header versioning (custom header like api-version: 1.0) Media type versioning (via Accept header, e.g., application/json;v=1) Use the Microsoft.AspNetCore.Mvc.Versioning NuGet package: services.AddApiVersioning(options => { options.AssumeDefaultVersionWhenUnspecified = true; options.DefaultApiVersion = new ApiVersion(1, 0); options.ReportApiVersions = true; }); api-version=1.0) Header versioning (custom header like api-version: 1.0) Media type versioning (via Accept header, e.g., application/json;v=1) Use the Microsoft.AspNetCore.Mvc.Versioning NuGet package: services.AddApiVersioning(options => { options.AssumeDefaultVersionWhenUnspecified = true; options.DefaultApiVersion = new…

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Semantic versioning (semver) uses MAJOR.MINOR.PATCH format, e.g., 1.2.0. MAJOR version changes break backward compatibility. MINOR versions add functionality in a backward-compatible manner. PATCH versions are for backward-compatible bug fixes. Version negotiation allows clients and servers to agree on an API version via headers or URL. Servers should support multiple versions and respond with supported version info.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Mark old versions as deprecated via documentation and HTTP response headers. Return warning headers or custom fields indicating version deprecation. Gradually phase out old versions, allowing clients to migrate. Consider introducing sunset policies and endpoints to notify clients.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: pp.UseCors("AllowSpecificOrigin"); pp.UseCors("AllowSpecificOrigin"); pp.UseCors("AllowSpecificOrigin"); pp.UseCors("AllowSpecificOrigin"); pp.UseCors("AllowSpecificOrigin"); pp.UseCors("AllowSpecificOrigin"); pp.UseCors("AllowSpecificOrigin"); pp.UseCors("AllowSpecificOrigin");

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Configure in Startup.cs or Program.cs: services.AddCors(options => { options.AddPolicy("AllowSpecificOrigin", builder => { builder.WithOrigins(" .AllowAnyHeader() .AllowAnyMethod(); }); }); Enable middleware: app.UseCors("AllowSpecificOrigin");

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: For certain CORS requests (e.g., methods other than GET/POST or custom headers), browsers send an OPTIONS request first, called a preflight. The server must respond with allowed methods, headers, and origins. Properly configured CORS policies handle preflight requests automatically.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Global CORS: Apply a policy for all endpoints by adding middleware early in the pipeline with app.UseCors(...). Per-endpoint CORS: Apply CORS policies selectively using the [EnableCors("PolicyName")] or [DisableCors] attributes on controllers or actions.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: To allow cookies or credentials in cross-origin requests, configure: builder.WithOrigins(" .AllowCredentials() .AllowAnyHeader() .AllowAnyMethod(); Clients must send requests with credentials: 'include'. Note: Allowing credentials disables the wildcard (*) origin.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Improperly configured CORS can expose your API to CSRF and data theft. Avoid using AllowAnyOrigin with AllowCredentials as browsers block it. Restrict origins to trusted domains. Validate CORS headers and avoid overly permissive policies. Use HTTPS to secure cross-origin requests. Cross‑Cutting / Advanced / “Miscellaneous”

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Kestrel is the default cross-platform web server for ASP.NET Core, lightweight and fast. IIS acts as a reverse proxy on Windows, forwarding requests to Kestrel. Reverse proxies improve security, manage SSL, handle load balancing. On Linux, Nginx or Apache often act as reverse proxies to Kestrel.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: InProcess hosting runs ASP.NET Core app inside the IIS worker process (w3wp.exe), better performance. OutOfProcess hosting runs the app in a separate process, IIS proxies requests to it. InProcess is default in ASP.NET Core 3.0+ for IIS hosting.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Health checks provide endpoints to report app health. Use Microsoft.AspNetCore.Diagnostics.HealthChecks. Configure checks for databases, external services, dependencies. Useful for Kubernetes, load balancers.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: ASP.NET Core has built-in logging with providers (Console, Debug, EventSource). Third-party libs like Serilog and NLog offer rich sinks, structured logging. Configure logging via appsettings.json or code.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Avoid blocking calls in async code to prevent deadlocks. Use async/await properly. Protect shared data with locks or concurrent collections. Avoid thread starvation with thread pool tuning.

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Memory leaks can occur if IDisposable objects aren’t disposed. Use dependency injection lifetimes properly. Be cautious with static references and events holding objects. Use tools like dotMemory, PerfView.

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Design apps to be stateless so any server instance can handle requests. Use distributed caches or external session stores. Load balancers distribute traffic to multiple instances.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Containerize apps with Docker for consistent deployments. Use Azure App Services, Azure Kubernetes Service for cloud hosting. Set up CI/CD pipelines (GitHub Actions, Azure DevOps) for automated builds and deployments.

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Monitor app health, request metrics, errors. Use OpenTelemetry for distributed tracing. Integrate with Application Insights, Prometheus, Grafana.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Enforce HTTPS. Use Anti-forgery tokens to prevent CSRF. Sanitize input to prevent XSS. Follow OWASP guidelines to secure apps.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use Response Compression Middleware to compress responses. Use Response Caching Middleware to cache GET responses. Middleware can be composed for layered processing.

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.