Interview prep · 14 questions with model answers
Technical and system design interview questions for GCC tech jobs
Technical interview questions for software roles in Riyadh, Dubai and Doha - system design, APIs, SQL vs NoSQL, security, CI/CD, caching and AI integration - with answer frameworks.
Overview
- 1Hard
How do you design a scalable microservices architecture?
How to approach it: Domain boundaries, async decoupling, data isolation, failure resilience.
Model answer
Service boundaries defined by business domain (DDD); API contracts with OpenAPI/Protobuf; independent deployment; database per service (no shared schemas); async event-driven communication (Kafka/RabbitMQ) for workflows and sync (gRPC/REST) for queries; centralized telemetry (OpenTelemetry); circuit breakers (Resilience4j) and transactional outbox for consistency.
Gulf recruiter tip: Always mention trade-offs: microservices add operational cost; state when you would NOT use them.
- 2Medium
How do you design a REST API?
How to approach it: RESTful principles, HTTP verbs, security, developer ergonomics.
Model answer
Resource-based nouns (/api/v1/orders); correct HTTP verbs (GET, POST, PUT, PATCH, DELETE); standard status codes (200, 201, 400, 401, 404, 429); cursor-based pagination; OAuth2 JWT auth; rate limiting; idempotency headers for POST transactions; structured error envelopes; comprehensive OpenAPI specs.
Gulf recruiter tip: Mention idempotency and API versioning strategies.
- 3Medium
SQL vs NoSQL: how do you choose?
How to approach it: Consistency, schema volatility, access patterns, polyglot persistence.
Model answer
SQL (Postgres) for structured data requiring ACID transactions, complex joins, and financial ledger integrity. NoSQL (Mongo, DynamoDB) for unstructured documents, high write velocity, or key-value caching. In modern architecture, polyglot persistence (SQL primary + Redis cache + Elasticsearch search) is standard.
Gulf recruiter tip: Explain how business consistency requirements dictate the choice.
- 4Hard
How do you handle authentication and authorization?
How to approach it: Defense in depth, token rotation, RBAC/ABAC, secure crypto.
Model answer
Passwords hashed with Argon2id or bcrypt (cost 12); stateless JWT access tokens (short TTL ~15m) paired with httpOnly secure refresh token rotation in Redis; OAuth2/OIDC for SSO; granular Role-Based Access Control (RBAC); MFA enforcement on sensitive routes; never rolling custom cryptography.
Gulf recruiter tip: Emphasize secure cookie storage over insecure localStorage.
- 5Hard
How do you debug a production issue?
How to approach it: Triage -> Mitigate -> Isolate -> Root-Cause -> Postmortem.
Model answer
1. Mitigate immediate impact (rollback deploy, flip feature flag, add capacity); 2. Check telemetry dashboards, error spikes, and distributed traces; 3. Formulate data-backed hypothesis before touching code; 4. Replicate in staging; 5. Deploy fix through CI/CD; 6. Publish blameless postmortem with preventive backlog items.
Gulf recruiter tip: Never debug directly in production databases without safety controls.
- 6Medium
How do you approach caching?
How to approach it: Cache layers, invalidation strategy, stampede mitigation.
Model answer
Identify read-heavy, low-mutation data; implement multi-tier caching (browser HTTP cache, CDN edge, Redis in-memory); choose invalidation strategies (TTL expiration vs event-driven purge); guard against cache stampedes using distributed locks or probabilistic early expiration.
Gulf recruiter tip: Quote: 'There are only two hard things in Computer Science: cache invalidation and naming things.'
- 7Medium
How do you ensure code quality in a team?
How to approach it: Automated gates + human culture.
Model answer
Automated pre-commit hooks (ESLint, Prettier, TypeScript strict); mandatory CI test coverage thresholds; required 2-engineer peer reviews with clear guidelines; Architecture Decision Records (ADRs); blameless retrospectives.
Gulf recruiter tip: Emphasize that tooling should automate the mechanical checks so humans focus on logic.
- 8Hard
Walk me through your CI/CD pipeline.
How to approach it: Commit -> Build -> Test -> Security Scan -> Staging -> Canary -> Prod.
Model answer
Git push triggers GitHub Actions / GitLab CI; runs unit & integration tests in parallel; static analysis (SonarQube) and dependency CVE audit (Snyk); builds immutable Docker image pushed to private registry; deploys automatically to Staging; releases to Production via automated canary / blue-green with automated rollback on error spikes.
Gulf recruiter tip: Highlight automated rollback mechanisms and zero-downtime deployments.
- 9Hard
How do you design for security?
How to approach it: OWASP Top 10, least privilege, zero trust.
Model answer
Strict input validation with Zod schemas; parameterized ORM queries preventing SQL injection; Context-aware escaping against XSS; secrets managed in HashiCorp Vault or AWS Secrets Manager (never in git); TLS 1.3 encryption in transit and AES-256 at rest; strict CSP and security headers in proxy middleware.
Gulf recruiter tip: Referencing local GCC data sovereignty guidelines (e.g. NCA in KSA, DESC in Dubai) is a huge plus.
- 10Hard
Design a URL shortener (System Design Classic)
How to approach it: Scale estimation, Base62 encoding, distributed ID generation, caching.
Model answer
Functional requirements (shorten, redirect); Traffic estimation (100M URLs/mo, 100:1 read ratio); Base62 encoding (6-7 chars = trillions of combinations); Distributed ID generator (Snowflake); Database (Postgres for persistence + Redis for hot redirects); 301 vs 302 redirect strategy; rate limiting per IP.
Gulf recruiter tip: Explain why 302 redirect is used if you want accurate click analytics.
- 11Hard
How do you integrate AI (LLMs) into an application responsibly?
How to approach it: Use-case fit, prompt versioning, output guardrails, data privacy, latency control.
Model answer
Validate use-case necessity; structure prompts with versioned schemas; enforce JSON schema output validation; implement semantic caching (Redis) to reduce latency and token costs; guard against prompt injections; ensure sensitive PII is redacted before sending to third-party LLMs; maintain deterministic fallbacks.
Gulf recruiter tip: High demand in the Gulf right now; a structured answer here immediately stands out.
- 12Medium
Monolith vs microservices: which and when?
How to approach it: Evolutionary architecture, team topology, complexity trade-offs.
Model answer
Start with a well-structured modular monolith. It provides fast iteration, simple transactions, and low operational overhead. Split into microservices only when organizational scaling (independent team domains) or distinct scalability bottlenecks demand it.
Gulf recruiter tip: Shows maturity by resisting premature architectural complexity.
- 13Easy
How do you review someone else's code?
How to approach it: Constructive feedback, logic correctness, non-blocking suggestions.
Model answer
Verify functional correctness and edge cases first; assess readability and adherence to team conventions; ask questions to understand intent rather than giving commands; clearly label blocking issues vs non-blocking 'nits'; praise clever, elegant solutions.
Gulf recruiter tip: Be kind and review the code, not the person.
- 14Medium
How do you estimate task timelines?
How to approach it: Decomposition, PERT estimation, buffer for unknowns, clear confidence communication.
Model answer
Decompose requirements into subtasks under 1–2 days each; apply three-point estimation (optimistic, nominal, pessimistic); add contingency buffer for external dependencies; communicate estimates as confidence intervals rather than fixed promises; calibrate retrospectively.
Gulf recruiter tip: Distinguish an architectural estimate from a contractual business commitment.
Interview booked? Make sure your CV backs up every answer
Recruiters read your CV before and during the interview. Build an ATS-friendly Gulf CV that matches the stories you will tell.