Question 1

Why do we need a backend if we already have a frontend?

Accepted Answer

The browser cannot be trusted: anyone can change the code running in it, so checks of permissions, prices and data must live on the server. The backend holds the business logic, database access and secrets that must never reach the client. It also gives one source of truth for several clients: the website, the mobile app, integrations. In a shop, for example, the frontend shows the cart, while the backend calculates the total and decides whether the order can be placed.

Question 2

Node.js runs JavaScript in a single thread. How does it serve many requests at once, and what can get in its way?

Accepted Answer

Most of the time a request is waiting for a database or the network, and Node takes the next request in the meantime. When the result is ready, the event loop returns to the first request and runs its callback. That is why one thread copes with thousands of connections as long as the work is mostly I/O. Heavy computation in JavaScript gets in the way: while it runs, all the other requests wait.

Question 3

How do CommonJS and ES modules differ in Node.js, and how does Node decide which format a file uses?

Accepted Answer

CommonJS uses require and module.exports, ES modules use import and export. Node treats a file as an ES module if it has the .mjs extension or the nearest package.json has "type": "module". Otherwise it is CommonJS. ES modules load asynchronously and support top-level await, while CommonJS has __dirname and __filename, which ESM lacks. New projects are usually written in ESM.

Question 4

How should a Node.js app handle configuration and secrets, such as a database connection string?

Accepted Answer

Configuration comes from environment variables via process.env instead of being hardcoded. A .env file is handy locally, but it goes into .gitignore and is never committed. In production the values are set by the platform: a container, CI or a secrets manager. The variables are validated at startup so the app fails right away with a clear error instead of on the first request. All values in process.env are strings, so numbers and booleans must be parsed explicitly.

Question 5

In NestJS with no custom filters, a controller throws a NotFoundException, a plain Error with text about a database password, and an HttpException with an object and status 429. What does the client get in each case?

Accepted Answer

NotFoundException gives 404 with a body containing statusCode, message and error. Nest treats a plain Error as unexpected: the client gets 500 and a generic Internal server error, and the error text goes only to the log, not the body. HttpException with an object returns 429, and the passed object becomes the response body as is. This is done by the built-in exception filter, and for a uniform error format it is replaced with a custom one.

Question 6

How do you add Swagger (OpenAPI) to NestJS, and how do you avoid writing @ApiProperty on every DTO field?

Accepted Answer

The @nestjs/swagger package is set up in main.ts: DocumentBuilder assembles the description, SwaggerModule.createDocument builds the document, and SwaggerModule.setup serves the UI. DTO fields are described with @ApiProperty. To avoid writing it by hand, you enable the CLI plugin in nest-cli.json: it adds annotations at build time from TypeScript types and comments. For derived DTOs, helpers like PartialType must be imported from @nestjs/swagger, otherwise the schema loses its metadata.

Question 7

Name the phases of the Node.js event loop in order and say what runs in each. Where do process.nextTick and promises fit in this picture?

Accepted Answer

The phases go like this: timers (setTimeout, setInterval), pending callbacks, idle/prepare (internal), poll (new I/O events, where the loop may wait), check (setImmediate) and close callbacks. process.nextTick and promises are not phases. After every callback Node first drains the nextTick queue, then the microtask queue, and only then moves on. That is why an endless chain of nextTick calls stops the whole loop.

Question 8

A CommonJS file calls setTimeout(..., 0), setImmediate, process.nextTick, Promise.resolve().then and a synchronous console.log. What is the output order, and which part of it is guaranteed?

Accepted Answer

The first three are guaranteed: synchronous code first, then the nextTick queue, then microtasks, that is the promise. The order of setTimeout and setImmediate from the main module is not guaranteed. The Node docs say it depends on process performance: if 1 ms has already passed by the first timers phase, the timer fires first, otherwise setImmediate does. Inside an I/O callback the order is deterministic: setImmediate always runs before the timer.

Question 9

What does the false returned by write() on a Writable stream mean, and what happens if you ignore it?

Accepted Answer

write() returns false when the internal buffer has reached highWaterMark. No data is lost: it is a backpressure signal telling you to stop writing and wait for the drain event. If you ignore it, a fast source keeps writing into memory, the buffer grows, and the process can crash with OOM. pipeline does this pausing automatically. The default highWaterMark is 64 KB for byte streams and 16 objects in object mode.

Question 10

Compare cluster, child_process and worker_threads. What would you choose for a CPU-heavy task, and what for using all cores with an HTTP server?

Accepted Answer

cluster starts separate processes that share one port, which is how an HTTP server uses all cores, and memory is not shared between processes. worker_threads are threads in one process, each with its own V8 isolate and event loop, and they suit CPU-heavy work such as hashing, parsing and compression. For I/O, workers give almost no benefit. child_process is for running a separate program or isolating crashes. In Kubernetes cluster is usually unnecessary: it is simpler to run one process per container and add more pods.

Question 11

Why does --max-old-space-size not protect a Node.js process from a memory blowup when a large Buffer is allocated? Which memory metrics should you watch?

Accepted Answer

The contents of a Buffer live outside the V8 heap, and only a small wrapper object lands in the heap. So heapUsed barely changes while arrayBuffers and rss grow. The --max-old-space-size flag limits only the old space in V8 and does not count buffers, compression or native modules. A process can have a 200 MB heap and 2 GB of RSS, and the container gets killed by the OOM killer without any JavaScript heap out of memory error. That is why you watch rss, heapUsed, external and arrayBuffers together.

Question 12

Inside try/catch you call [1, 2, 3].forEach(async (id) => { await save(id); }) and save(2) throws. Why does catch not fire, and how do you process the array correctly, sequentially and in parallel?

Accepted Answer

forEach calls the callback and discards the returned promise, so the function waits for nothing: done is printed before the error, and the rejection becomes an unhandledRejection. This is a typical cause of a worker that finished "successfully" while some records were not saved. Sequentially you process with for...of and await, in parallel with await Promise.all(ids.map(save)). For thousands of items you need a concurrency limit, otherwise the connection pool is exhausted. If you need all results together with errors, use Promise.allSettled.

Question 13

A service calls an external API thousands of times per minute. What do you configure on the HTTP client, and why is a missing timeout dangerous?

Accepted Answer

Keep-alive removes the TCP and TLS handshake on every request, so connections should be reused. The number of sockets should be limited, because maxSockets is unlimited by default. Without a timeout, a hung dependency accumulates open requests, memory and connections, and someone else's problem becomes yours. Because of the keep-alive race, ECONNRESET is possible, so you may automatically retry only idempotent requests. The built-in fetch runs on its own pool (undici), and http.Agent settings do not affect it.

Question 14

In CommonJS, module a does require('./b') and b does require('./a'). Why is there no infinite loop or error, and what trap does this create?

Accepted Answer

CommonJS puts a module into the cache before its execution finishes. When b asks for a, it receives the existing but unfinished exports object of a, not a second run. That is why there is no loop, and b sees only what a managed to export before calling require. The trap is that top-level destructuring locks in stale or missing values. It is fixed by moving shared code into a third module or by accessing the export lazily inside a function.

Question 15

A module exports a counter n and a function inc that does n++. What does the importer see after calling inc() in CommonJS, and what in ES modules? Why the difference?

Accepted Answer

In CommonJS module.exports is a plain object, and the value of n is copied into it when it is created. After inc() the destructured variable stays 0. In ESM imports are live bindings: the imported variable points to the variable in the exporting module, so after inc() we see 1. An importer cannot reassign the imported variable, only the exporter itself can change it.

Question 16

Where in NestJS do you put JWT and role checks, DTO validation, response time measurement, a uniform error format and response caching? Why might a global guard via useGlobalGuards(new AuthGuard()) not work?

Accepted Answer

Authorization is a guard, because it sees ExecutionContext and the route metadata, which middleware does not know. Validation is done by a pipe, for example ValidationPipe with whitelist. Response time and caching belong in an interceptor, since it wraps the handler call. A uniform error format is an exception filter. A guard created via useGlobalGuards(new ...) in main.ts does not go through DI, so its dependencies are not injected. The correct way is to register it as a provider with the APP_GUARD token in a module.

Question 17

In NestJS, UsersService depends on MailService, which is declared in providers of MailModule, and UsersModule has imports: [MailModule]. The app does not start with Nest can't resolve dependencies. Why, and how do you fix it?

Accepted Answer

A module in Nest is a visibility boundary: a module's providers are private until they are added to exports. The entry imports: [MailModule] gives access only to what that module exports, and MailModule exports nothing. That is why UnknownDependenciesException appears. The one-line fix is to add exports: [MailService] to MailModule. Duplicating MailService in the providers of UsersModule is not advisable, because that creates a second instance.

Question 18

What kinds of custom providers exist in NestJS and what is each for? What does the entry providers: [UsersService] really mean?

Accepted Answer

The entry providers: [UsersService] is shorthand for { provide: UsersService, useClass: UsersService }. useValue gives a ready value or a mock, for example in tests. useClass lets you swap the implementation depending on the environment. useFactory creates a provider with logic and dependencies via inject and can be asynchronous, for example to connect to a database. useExisting creates an alias for an existing provider without a second instance.

Question 19

In NestJS, CheckoutService depends on the interface PaymentGateway, and providers contains the class LiqPayGateway that implements it. Startup fails with Nest can't resolve dependencies. Why, and how do you fix it while keeping the dependency on an abstraction?

Accepted Answer

TypeScript interfaces do not exist at runtime, so Nest has no token: in the constructor metadata an interface is recorded simply as Object. You need an explicit token: a Symbol, a string or an abstract class. You register { provide: PAYMENT_GATEWAY, useClass: LiqPayGateway } and write @Inject(PAYMENT_GATEWAY) in the constructor. That way the service depends on an abstraction, and the implementation is easy to swap in tests or by config.

Question 20

In what order are lifecycle hooks called in NestJS at startup and at shutdown? Where is it better to open a database connection: in the constructor or in onModuleInit?

Accepted Answer

The constructor runs when the app is created, while onModuleInit and onApplicationBootstrap are called at listen or init. Startup order: constructor, onModuleInit, onApplicationBootstrap. Shutdown goes: onModuleDestroy, beforeApplicationShutdown, onApplicationShutdown. An async onModuleInit delays startup, because Nest waits for its Promise. That is why connections are opened in onModuleInit and not in the constructor, which cannot be async. System signals work only after enableShutdownHooks().

Question 21

Name the full request processing chain in NestJS in the correct order. Where do exception filters work?

Accepted Answer

The order is: middleware, guards, interceptors (the part before the handler), pipes, the handler itself, then interceptors on the way back. A pipe runs after an interceptor, not before it. An interceptor wraps the handler call: code before next.handle() runs on the way in, code in tap or map on the way out. Exception filters fire only when an exception was thrown and not caught somewhere in this chain. Within each type the order is: global, then controller, then route.

Question 22

What do the whitelist, forbidNonWhitelisted and transform options do in the NestJS ValidationPipe? What happens to an extra role field in the body and to page=2 in the query?

Accepted Answer

With whitelist: true the pipe silently strips fields that have no validation decorators, so the extra role in the body disappears. forbidNonWhitelisted: true returns 400 saying the property should not exist instead of stripping it. With transform: true the pipe turns a plain object into an instance of the DTO class, and with @Type(() => Number) the string page=2 from the query becomes a number. Without whitelist extra fields pass through and create a mass assignment vulnerability.

Question 23

ValidationPipe is enabled, but POST /orders with items: [{ sku: 5, qty: -1 }] returns 201. CreateOrderDto has only @IsArray(). Why did the ItemDto rules not fire, and what should you add?

Accepted Answer

@IsArray() only checks that the value is an array and does not look inside the elements. The ItemDto[] type in TypeScript disappears at runtime, so the validator does not know what these elements are. You need @ValidateNested({ each: true }) to validate every element, and @Type(() => ItemDto) from class-transformer so the elements become class instances with metadata. Without @Type the elements stay plain objects and the decorators on them have no effect.

Question 24

How do you organize configuration in NestJS so the app does not start without DATABASE_URL instead of failing on the first request?

Accepted Answer

You add ConfigModule.forRoot({ isGlobal: true }) and pass a validationSchema (for example Joi) or a validate function: environment variables are checked at startup and the app fails right away with a clear error. In code you use ConfigService.getOrThrow, which throws if the value is missing. With registerAs the config is grouped into a namespace. Note that registerAs validates nothing by itself, the check is still done by the schema or validate.

Question 25

Walk a request through authentication with Passport and JWT in NestJS, from login to req.user in the controller. What must never go into the token?

Accepted Answer

At login the server compares the password with the hash and signs a JWT via JwtService. On a protected route AuthGuard('jwt') runs JwtStrategy: it takes the Bearer token from the header and verifies the signature and exp. Then validate(payload) is called and its result becomes req.user. A JWT is signed but not encrypted, so its contents can be read without a key, and passwords and sensitive data are never put into it. Authentication answers "who are you", authorization answers "what are you allowed to do".

Question 26

All endpoints of a NestJS API must require a JWT by default, except /health and /auth/login. How do you do this so a new controller cannot be accidentally left open?

Accepted Answer

You register a global guard through the APP_GUARD provider instead of @UseGuards on every controller, so protection applies by default. Exceptions are marked with a custom @Public() decorator that sets a flag via SetMetadata. The guard reads it with Reflector.getAllAndOverride on the handler and the class. Payment provider webhooks are also public as far as JWT is concerned, but they must verify the request signature. On top of that you write a test that walks all routes and expects 401 without a token, except for an allowlist.

Question 27

What is a dynamic module in NestJS? How do forRoot, forFeature and register differ, and when is @Global() appropriate?

Accepted Answer

A dynamic module is a module that returns a DynamicModule with providers and exports configured at import time. forRoot is called once at the root for shared configuration, forFeature is used in a feature that relies on an entity already configured by the root, and register gives a separately configured instance for each import. forRootAsync with useFactory and inject is needed when the config depends on other providers, for example ConfigService. @Global() is justified for truly cross-cutting things: config, logger, database connection. In other cases it hides dependencies.

Question 28

OrdersModule imports UsersModule, and UsersModule already imported OrdersModule, and NestJS crashes at startup with an error about undefined in imports. How do you fix it quickly, and how properly?

Accepted Answer

A cycle between modules or between files (often through a barrel index.ts) makes the class undefined at the moment the decorator is applied. The quick fix is forwardRef(() => Module) in both modules and @Inject(forwardRef(...)) for providers. But the creation order in a cycle is undefined, so you cannot rely on a dependency in the constructor. It is better to break the cycle: move shared logic into a third module or reverse the dependency via events. Cycles between files are found with a tool like madge --circular.

Question 29

A money transfer in NestJS "half succeeds": the debit happened, the credit failed, but there is no rollback. Inside dataSource.transaction(...) some queries go through an injected repository. What is the cause?

Accepted Answer

The injected repository works through a different connection from the pool, so its queries run outside the transaction and rollback does not touch them. All operations inside the transaction must go through the manager given by the callback: manager.decrement(...), manager.save(...). Rollback undoes only what went through that manager. In Prisma the rule is the same: queries go through tx in $transaction(async (tx) => ...), not through the global client.

Question 30

Services throw domain errors OrderNotFound and InsufficientFunds, and Prisma throws P2002 on a duplicate. How do you design error handling in NestJS so the client gets correct statuses in a uniform format?

Accepted Answer

Domain errors do not extend HttpException, so the domain layer does not depend on HTTP. One global exception filter maps error types to statuses: OrderNotFound to 404, InsufficientFunds to 422 or 409, Prisma P2002 to 409, P2025 to 404. The response body has a uniform format, for example Problem Details with a requestId. Unknown errors are returned as 500 with a generic text, and the full stack trace goes only to the log. The filter is registered via APP_FILTER so DI works.

Node.js interview questions and answers

Junior questions

1. Why do we need a backend if we already have a frontend?

2. Node.js runs JavaScript in a single thread. How does it serve many requests at once, and what can get in its way?

3. How do CommonJS and ES modules differ in Node.js, and how does Node decide which format a file uses?

4. How should a Node.js app handle configuration and secrets, such as a database connection string?

5. In NestJS with no custom filters, a controller throws a NotFoundException, a plain Error with text about a database password, and an HttpException with an object and status 429. What does the client get in each case?

6. How do you add Swagger (OpenAPI) to NestJS, and how do you avoid writing @ApiProperty on every DTO field?

Middle questions

1. Name the phases of the Node.js event loop in order and say what runs in each. Where do process.nextTick and promises fit in this picture?

2. A CommonJS file calls setTimeout(..., 0), setImmediate, process.nextTick, Promise.resolve().then and a synchronous console.log. What is the output order, and which part of it is guaranteed?

3. What does the false returned by write() on a Writable stream mean, and what happens if you ignore it?

4. Compare cluster, child_process and worker_threads. What would you choose for a CPU-heavy task, and what for using all cores with an HTTP server?

5. Why does --max-old-space-size not protect a Node.js process from a memory blowup when a large Buffer is allocated? Which memory metrics should you watch?

6. Inside try/catch you call [1, 2, 3].forEach(async (id) => { await save(id); }) and save(2) throws. Why does catch not fire, and how do you process the array correctly, sequentially and in parallel?

7. A service calls an external API thousands of times per minute. What do you configure on the HTTP client, and why is a missing timeout dangerous?

8. In CommonJS, module a does require('./b') and b does require('./a'). Why is there no infinite loop or error, and what trap does this create?

9. A module exports a counter n and a function inc that does n++. What does the importer see after calling inc() in CommonJS, and what in ES modules? Why the difference?

10. Where in NestJS do you put JWT and role checks, DTO validation, response time measurement, a uniform error format and response caching? Why might a global guard via useGlobalGuards(new AuthGuard()) not work?

11. In NestJS, UsersService depends on MailService, which is declared in providers of MailModule, and UsersModule has imports: [MailModule]. The app does not start with Nest can't resolve dependencies. Why, and how do you fix it?

12. What kinds of custom providers exist in NestJS and what is each for? What does the entry providers: [UsersService] really mean?

13. In NestJS, CheckoutService depends on the interface PaymentGateway, and providers contains the class LiqPayGateway that implements it. Startup fails with Nest can't resolve dependencies. Why, and how do you fix it while keeping the dependency on an abstraction?

14. In what order are lifecycle hooks called in NestJS at startup and at shutdown? Where is it better to open a database connection: in the constructor or in onModuleInit?

15. Name the full request processing chain in NestJS in the correct order. Where do exception filters work?

16. What do the whitelist, forbidNonWhitelisted and transform options do in the NestJS ValidationPipe? What happens to an extra role field in the body and to page=2 in the query?

17. ValidationPipe is enabled, but POST /orders with items: [{ sku: 5, qty: -1 }] returns 201. CreateOrderDto has only @IsArray(). Why did the ItemDto rules not fire, and what should you add?

18. How do you organize configuration in NestJS so the app does not start without DATABASE_URL instead of failing on the first request?

19. Walk a request through authentication with Passport and JWT in NestJS, from login to req.user in the controller. What must never go into the token?

20. All endpoints of a NestJS API must require a JWT by default, except /health and /auth/login. How do you do this so a new controller cannot be accidentally left open?

21. What is a dynamic module in NestJS? How do forRoot, forFeature and register differ, and when is @Global() appropriate?

22. OrdersModule imports UsersModule, and UsersModule already imported OrdersModule, and NestJS crashes at startup with an error about undefined in imports. How do you fix it quickly, and how properly?

23. A money transfer in NestJS "half succeeds": the debit happened, the credit failed, but there is no rollback. Inside dataSource.transaction(...) some queries go through an injected repository. What is the cause?

24. Services throw domain errors OrderNotFound and InsufficientFunds, and Prisma throws P2002 on a duplicate. How do you design error handling in NestJS so the client gets correct statuses in a uniform format?

25. A colleague says: "JavaScript is an interpreted language, so Node is always slower than Go." What actually happens to a function in V8, from source text to execution on the CPU?

Senior questions

2. A recursive function schedules itself through process.nextTick a million times, and a setTimeout(..., 0) is set before it. When does the timer fire? What changes with setImmediate, and why is this dangerous on a server?

3. A Readable stream with .pipe(dst) fails with an error. What happens to dst, and what is the consequence on a real server? How do you fix it?

4. You need an endpoint that exports 5 million rows from Postgres to CSV. The current code does findAll, map and res.send, and the process dies with OOM. Design a solution. What happens if the client is slow or closes the tab?

5. An API has an endpoint that generates a PDF report and computes statistics: 2 seconds of CPU per request, and other endpoints slow down under load. Design a solution. What happens when there are twice as many requests as the workers can handle?

7. How does the garbage collector in V8 work? Why can a service have pauses of hundreds of milliseconds, and what can you tune?

8. A colleague suggests just logging the error in process.on('uncaughtException') so the service "does not crash". What do you answer, and what is the right error handling strategy for a Node service?

9. Describe graceful shutdown of a Node service in Kubernetes that serves HTTP and processes jobs from a queue. What is the order of actions after SIGTERM, and what happens if something hangs?

10. The SIGTERM handler only does server.close(() => process.exit(0)). During a deploy some requests are cut and some pods are killed with SIGKILL. Why is this not enough, and how do you fix it?

11. You need every log line and every SQL query to know the requestId and tenantId without passing parameters through all functions. How do you do this with AsyncLocalStorage? What goes into the store, and what are the risks?

12. A Node service sits behind an AWS ALB. At low traffic occasional 502s slip through, there is nothing in the application logs, and CPU is low. What mechanism do you suspect first, and how do you verify it?

13. What timeouts does a Node.js HTTP server have by default (keepAliveTimeout, headersTimeout, requestTimeout, server.timeout)? What protection do they give and what not?

14. What scope do NestJS providers have by default, and what does that mean for state in class fields? When is REQUEST scope needed, what does it cost, and what can you use instead?

15. A Nest service hashes passwords with async scrypt, serves files from disk, compresses responses with gzip and calls third-party APIs. At peak, login takes seconds while CPU is not maxed out. What of this goes into the libuv thread pool, and how do you choose UV_THREADPOOL_SIZE?

16. A Node service in Kubernetes sometimes ends as OOMKilled with no JS error and sometimes prints JavaScript heap out of memory, and p99 jumps every few minutes. How does Node pick the heap size in a container, and what would you set?

17. A NestJS latency metrics interceptor always logs took 0ms: it calls next.handle() and logs the difference between Date.now() and start right away, before the result is returned. What is wrong, how do you rewrite it, and which requests will it not see?

Train these questions

Answer out loud and get graded

Other topics

Explore the platform

5. In NestJS with no custom filters, a controller throws a `NotFoundException`, a plain `Error` with text about a database password, and an `HttpException` with an object and status 429. What does the client get in each case?

6. How do you add Swagger (OpenAPI) to NestJS, and how do you avoid writing `@ApiProperty` on every DTO field?

1. Name the phases of the Node.js event loop in order and say what runs in each. Where do `process.nextTick` and promises fit in this picture?

2. A CommonJS file calls `setTimeout(..., 0)`, `setImmediate`, `process.nextTick`, `Promise.resolve().then` and a synchronous `console.log`. What is the output order, and which part of it is guaranteed?

3. What does the `false` returned by `write()` on a Writable stream mean, and what happens if you ignore it?

4. Compare `cluster`, `child_process` and `worker_threads`. What would you choose for a CPU-heavy task, and what for using all cores with an HTTP server?

5. Why does `--max-old-space-size` not protect a Node.js process from a memory blowup when a large `Buffer` is allocated? Which memory metrics should you watch?

6. Inside `try/catch` you call `[1, 2, 3].forEach(async (id) => { await save(id); })` and `save(2)` throws. Why does `catch` not fire, and how do you process the array correctly, sequentially and in parallel?

8. In CommonJS, module `a` does `require('./b')` and `b` does `require('./a')`. Why is there no infinite loop or error, and what trap does this create?

9. A module exports a counter `n` and a function `inc` that does `n++`. What does the importer see after calling `inc()` in CommonJS, and what in ES modules? Why the difference?

10. Where in NestJS do you put JWT and role checks, DTO validation, response time measurement, a uniform error format and response caching? Why might a global guard via `useGlobalGuards(new AuthGuard())` not work?

11. In NestJS, `UsersService` depends on `MailService`, which is declared in `providers` of `MailModule`, and `UsersModule` has `imports: [MailModule]`. The app does not start with `Nest can't resolve dependencies`. Why, and how do you fix it?

12. What kinds of custom providers exist in NestJS and what is each for? What does the entry `providers: [UsersService]` really mean?

13. In NestJS, `CheckoutService` depends on the interface `PaymentGateway`, and `providers` contains the class `LiqPayGateway` that implements it. Startup fails with `Nest can't resolve dependencies`. Why, and how do you fix it while keeping the dependency on an abstraction?

14. In what order are lifecycle hooks called in NestJS at startup and at shutdown? Where is it better to open a database connection: in the constructor or in `onModuleInit`?

16. What do the `whitelist`, `forbidNonWhitelisted` and `transform` options do in the NestJS `ValidationPipe`? What happens to an extra `role` field in the body and to `page=2` in the query?

17. `ValidationPipe` is enabled, but `POST /orders` with `items: [{ sku: 5, qty: -1 }]` returns 201. `CreateOrderDto` has only `@IsArray()`. Why did the `ItemDto` rules not fire, and what should you add?

18. How do you organize configuration in NestJS so the app does not start without `DATABASE_URL` instead of failing on the first request?

19. Walk a request through authentication with Passport and JWT in NestJS, from login to `req.user` in the controller. What must never go into the token?

20. All endpoints of a NestJS API must require a JWT by default, except `/health` and `/auth/login`. How do you do this so a new controller cannot be accidentally left open?

21. What is a dynamic module in NestJS? How do `forRoot`, `forFeature` and `register` differ, and when is `@Global()` appropriate?

22. `OrdersModule` imports `UsersModule`, and `UsersModule` already imported `OrdersModule`, and NestJS crashes at startup with an error about `undefined` in `imports`. How do you fix it quickly, and how properly?

23. A money transfer in NestJS "half succeeds": the debit happened, the credit failed, but there is no rollback. Inside `dataSource.transaction(...)` some queries go through an injected repository. What is the cause?

24. Services throw domain errors `OrderNotFound` and `InsufficientFunds`, and Prisma throws `P2002` on a duplicate. How do you design error handling in NestJS so the client gets correct statuses in a uniform format?

2. A recursive function schedules itself through `process.nextTick` a million times, and a `setTimeout(..., 0)` is set before it. When does the timer fire? What changes with `setImmediate`, and why is this dangerous on a server?

3. A Readable stream with `.pipe(dst)` fails with an error. What happens to `dst`, and what is the consequence on a real server? How do you fix it?

4. You need an endpoint that exports 5 million rows from Postgres to CSV. The current code does `findAll`, `map` and `res.send`, and the process dies with OOM. Design a solution. What happens if the client is slow or closes the tab?

8. A colleague suggests just logging the error in `process.on('uncaughtException')` so the service "does not crash". What do you answer, and what is the right error handling strategy for a Node service?

10. The SIGTERM handler only does `server.close(() => process.exit(0))`. During a deploy some requests are cut and some pods are killed with SIGKILL. Why is this not enough, and how do you fix it?

11. You need every log line and every SQL query to know the `requestId` and `tenantId` without passing parameters through all functions. How do you do this with `AsyncLocalStorage`? What goes into the store, and what are the risks?

13. What timeouts does a Node.js HTTP server have by default (`keepAliveTimeout`, `headersTimeout`, `requestTimeout`, `server.timeout`)? What protection do they give and what not?

14. What scope do NestJS providers have by default, and what does that mean for state in class fields? When is `REQUEST` scope needed, what does it cost, and what can you use instead?

15. A Nest service hashes passwords with async `scrypt`, serves files from disk, compresses responses with `gzip` and calls third-party APIs. At peak, login takes seconds while CPU is not maxed out. What of this goes into the libuv thread pool, and how do you choose `UV_THREADPOOL_SIZE`?

16. A Node service in Kubernetes sometimes ends as `OOMKilled` with no JS error and sometimes prints `JavaScript heap out of memory`, and p99 jumps every few minutes. How does Node pick the heap size in a container, and what would you set?

17. A NestJS latency metrics interceptor always logs `took 0ms`: it calls `next.handle()` and logs the difference between `Date.now()` and `start` right away, before the result is returned. What is wrong, how do you rewrite it, and which requests will it not see?