Microsoft Java Developer Interview Questions & Answers

At a high level, I would build one metadata API that lets clients create, read, update, delete, and search application records. Requests enter through REST endpoints, then YAML or JSON content is parsed and validated before the Metadata Service applies business rules. The Repository handles persistence and transactions, and results return through the same application layers. I would use strict validation and clear HTTP errors as the main reliability decision. The trade-off is that supporting both YAML and JSON is convenient for clients, but adds parsing, validation, and testing complexity.

The goal is to give teams one simple place to save and find information about their applications. A client should be able to add a record, look it up, change it, remove it, or search using common fields. The server must also reject bad input clearly so incorrect information does not reach storage. The design keeps each job separate. One part receives requests, one checks the data, one applies the rules, and one saves or reads records. I would explain the solution by following that same path from the client to storage and then back to the client.

• Which metadata fields are required for every application?
• Should metadata have a uniqueness rule, such as a unique name within an environment?
• Do clients need both YAML and JSON responses, or only YAML and JSON request support?

I would expose the API through the REST Endpoints component. The diagram shows POST /metadata to create metadata, GET /metadata/{id} to read one record, PUT /metadata/{id} to update it, and DELETE /metadata/{id} to remove it. Search uses GET /metadata?name=&owner=&tag=&environment=. These query parameters let clients filter by name, owner, tag, and environment. The API Client / Consumer sends an HTTPS request to these endpoints. A successful response returns from the REST Endpoints to the client as 200/201 with JSON or YAML.

The REST Endpoints pass the request body plus path or query parameters to the YAML / JSON Parser + Validator. This component checks the content type, parses YAML, validates the schema, checks required fields, and normalizes fields. The diagram also shows a sample YAML document with fields such as appId, name, version, owner, tags, and environment. This validation step keeps malformed or incomplete data away from the business logic. Malformed YAML or missing or invalid fields produce 400 Bad Request. An unsupported payload format produces 415 Unsupported Media Type.

After validation, the parser sends a validated command or query to the Metadata Service. This service coordinates create, read, update, delete, and search behavior. It handles search, filtering, and sorting. It also owns the uniqueness rules shown in the diagram and maps results into the response form. If a requested metadata id does not exist, the API returns 404 Not Found. If a create or update conflicts with a uniqueness rule, it returns 409 Conflict.

The Metadata Service sends a CRUD or search request to the Repository. The Repository builds queries, performs persistence work, and handles transactions. It sends a read or write query to the Metadata Store. The database stores fields including appId, name, version, owner, tags, environment, createdAt, and updatedAt. The Metadata Store returns a record or result set to the Repository. The Repository then returns a domain result to the Metadata Service.

The Metadata Service maps the domain result to the response. The diagram shows that result moving back through the YAML / JSON Parser + Validator as a validation status or result, and then to the REST Endpoints as an HTTP response. The REST Endpoints finally return 200/201 JSON or YAML to the API Client / Consumer. The database never responds directly to the client. Each component returns information to the component that called it.

Logging / Audit is a supporting flow, not part of the main business response path. The REST Endpoints send request events to it. The Metadata Service sends mutation and error events. The logs include request details, validation failures, not-found and conflict errors, and create, update, or delete audit activity. Testing covers unit tests for the service, validator, and utilities; API tests for endpoints, scenarios, and errors; and repository integration tests for queries and transactions. This keeps HTTP handling, validation, business logic, persistence, observability, and testing clearly separated.

The benefit of this design is that each layer has one clear job. REST Endpoints handle HTTP requests. The parser and validator protect the service from bad YAML, JSON, or missing fields. The Metadata Service owns business rules. The Repository owns database access and transactions. Supporting both YAML and JSON is useful for different clients, but every accepted format needs parsing and test coverage. Query parameters make simple searches easy, but more filter combinations can make repository queries harder to maintain. Clear 400, 404, 409, and 415 responses help clients understand failures. Logging gives useful request and change history, but creates more operational data to manage. We accept that extra complexity because the separation makes the API easier to test and change safely.

At a high level, I would make the API predictable by choosing the HTTP verb from the kind of change the client wants. POST /resources creates a new resource, the server assigns its ID, and success returns 201 Created with a Location header. PUT /resources/{id} replaces the complete resource and is idempotent. PATCH /resources/{id} changes only selected fields. Each operation writes to the Resource Store, then the Java REST API returns a clear status and error body. The main trade-off is simpler full replacement with PUT versus smaller but more complex partial updates with PATCH.

This question is about making an API easy for clients to understand and use correctly. A client needs one action for creating something, another for replacing everything, and another for changing only a few fields. The API must also clearly say whether each request worked or failed. The diagram uses a Client App, a Java REST API, and a Resource Store. I would explain how the client chooses the action, how the API changes stored data, and how the result returns to the client.

• Should the server always assign the ID for a newly created resource?
• For PUT, should the client always send the complete resource representation?
• For PATCH, what validation rules should apply to the changed fields?

I would first decide what the client is trying to do. The Client App sends an API request. If it wants to create a new resource, I use POST. If it wants to replace the full resource, I use PUT. If it wants to update only selected fields, I use PATCH. This keeps the contract predictable because the HTTP method tells the client what kind of change will happen.

For creation, the diagram uses POST /resources. The Java REST API creates a new resource, and the server assigns the ID. POST is not idempotent in this design. Repeating the same create request may therefore create another resource. The API sends a create operation to the Resource Store. On success, it returns 201 Created with a Location header. The shown POST failures are 400 Bad Request and 409 Conflict.

For a complete replacement, I use PUT /resources/{id}. The client sends the complete representation of the resource. The Java REST API sends a replace operation to the Resource Store. PUT is idempotent here, which means repeating the same request produces the same final stored state. On success, the API returns 200 OK or 204 No Content. The shown PUT failures are 400 Bad Request and 404 Not Found.

For a smaller change, I use PATCH /resources/{id}. The client sends only the fields that need to change. The Java REST API sends a partial update to the Resource Store. This is useful when replacing the complete representation would be unnecessary. On success, the API returns 200 OK or 204 No Content. The shown PATCH failures are 400 Bad Request, 404 Not Found, and 422 Unprocessable Entity.

The request moves from the Client App to the HTTP verb decision and then to the matching Java REST API operation. POST creates, PUT replaces, and PATCH performs a partial update in the Resource Store. The response is a separate flow in the opposite direction. It returns from the Java REST API to the Client App with the status that describes the result.

I would use consistent JSON validation and error bodies so clients can understand failures. The diagram also shows 401 Unauthorized and 403 Forbidden for authentication or authorization problems. It shows 429 Too Many Requests for rate limiting or throttling. A 5xx response represents a server-side failure. These codes should be returned only when the matching condition actually occurs.

PUT is simple because the client sends one complete representation, and its idempotent behavior is easy to reason about. The downside is that the client may send more data than necessary. PATCH sends only selected fields, so it can be smaller and more focused. The downside is that partial-update validation is usually more complicated. POST fits resource creation well, but repeated POST requests may create more than one resource because POST is not idempotent in this design.

The benefit of this design is that each HTTP method has a clear purpose. POST creates a resource, PUT replaces the complete resource, and PATCH changes selected fields. PUT is idempotent, so repeating the same request leaves the same final state. POST is not idempotent here, so repeating a creation request may create another resource. PATCH can send less data than PUT, but validating partial changes can be more complicated. Clear status codes make the API easier for clients to handle. Consistent JSON validation and error bodies also make failures easier to understand. The downside is that the API team must keep these rules consistent across every operation. We accept that discipline because predictable APIs are easier to integrate with and troubleshoot.

At a high level, I would place a small BetterApi interface in front of the existing UnderlyingApiClient. The caller works with typed request and response DTOs, while DefaultBetterApi centralizes validation, token injection, retry and timeout policy, error mapping, logging, and async execution. UnderlyingApiAdapter translates between the clean API model and the lower-level client. Responses return through the same layers and become domain responses. This improves usability and maintainability. The trade-off is extra wrapper, adapter, and policy code that must be tested and maintained.

The existing API class may work, but it may expose too many low-level details. That makes every caller harder to write and maintain. The goal is to put a simpler API in front of it. Callers should use clear request and response objects and should not depend on transport details or raw callbacks. The new design should also handle common rules in one place. The attached diagram does this with BetterApi, DefaultBetterApi, an adapter, the existing client, and supporting validation, retry, logging, and asynchronous components.

• Should BetterApi provide both synchronous and asynchronous methods?
• Must UnderlyingApiClient remain unchanged?
• Which retry and timeout options should callers be allowed to configure?
• Should low-level exceptions ever be exposed to advanced callers?

I would start with BetterApi as the public interface. The Application / Service Caller sends a typed API request to it and receives an API response back. BetterApi uses an Immutable Request DTO and a Domain Response DTO. Builder / Options provides controlled configuration. The interface stays small and supports synchronous and asynchronous methods. This gives callers a stable API and prevents transport details from leaking into application code.

BetterApi passes the command to DefaultBetterApi, which is the main implementation and orchestration point. It coordinates Validation and receives a validation result. It also uses Auth Injection to attach the token required by the lower-level request. Keeping these concerns in DefaultBetterApi avoids making every caller repeat the same work. It also gives one place to change these policies later.

DefaultBetterApi applies the Retry / Timeout Policy and receives the policy result. Error Mapping converts low-level failures into errors that fit the better API instead of exposing raw exceptions. Logging / Metrics receives logs and metrics from the implementation and sends telemetry to Observability. Observability is a side flow. It does not own or change the business response.

DefaultBetterApi sends the translated request to UnderlyingApiAdapter. The adapter is the single place for translation between the clean BetterApi model and the format expected by UnderlyingApiClient. It also hides low-level callbacks and raw exceptions. This is an important maintainability boundary because changes in the lower-level API can usually be isolated inside the adapter.

UnderlyingApiAdapter sends an HTTP / SDK request to UnderlyingApiClient. That client sends the HTTP / SDK request to the Remote Service. The response follows separate arrows in reverse. Remote Service returns an HTTP / SDK response to UnderlyingApiClient. The client returns the response to UnderlyingApiAdapter. The adapter sends the raw response back to DefaultBetterApi. DefaultBetterApi maps it into a domain response, BetterApi returns the API response, and the Application / Service Caller receives it.

The facade is thread-safe and uses immutable DTOs. The diagram also shows a shared ExecutorService. DefaultBetterApi schedules async work there and receives a completion callback. Async methods return CompletableFuture<Response>, so callers do not need to work directly with low-level callbacks. Immutable DTOs are safe to share between threads in the same JVM because their state does not change. The main trade-off is that this cleaner API adds another layer that must be tested and maintained.

The benefit is that application developers work with a small, stable interface instead of a verbose lower-level client. Immutable DTOs and Builder / Options make requests easier to understand. DefaultBetterApi keeps validation, token injection, retry and timeout policy, error mapping, logging, and async execution in one place. UnderlyingApiAdapter reduces coupling by isolating translation and low-level callback behavior. The downside is extra code and more tests. Retry and timeout rules also need careful configuration because bad policies can make failures worse. A shared ExecutorService must be managed so async work does not grow without control. We accept these costs because the public API becomes easier to use, easier to change, and less dependent on UnderlyingApiClient.

At a high level, I would design this as a local search API that finds plumbers near a place and returns a ranked list quickly. I would route the request through the client, edge security, and a Java Spring Boot search service, then use the search platform, cache, and geo lookup to answer it. The main security decision is to validate, rate limit, and authorize at the edge before the request reaches the service. The main trade-off is that indexing and caching make search fast, but they add ingestion and freshness complexity.

This question asks for a local search API for plumbers near a place, like Kondapur. The main goal is to take one search request and return nearby plumbers fast, with the right distance, rating, open status, and basic details. The hard part is that search must be quick, but the data must also stay fresh when plumbers update their profile or location. I will explain the design in the same order as the diagram, from the client request through the Java search service and search platform, and then through the ingestion flow that keeps the index updated.

• Should the API support only nearby search, or also filters like rating, price, and open now?
• How fresh must updates be after a plumber changes location, hours, or photos?
• Do we need tenant-specific ranking or business rules?

At a high level, I would keep the API focused on one job: search for plumbers near a place and return a ranked list. The visible example is GET /v1/search/plumbers with query parameters like near=Kondapur, radius=5km, filters, page, and size. The response is 200 OK with JSON that includes results, page, size, and total. This boundary matters because the caller should see one simple contract, while the search index stays hidden behind it.

The request first goes through DNS or anycast, WAF or DDoS protection, and the API gateway. The gateway handles authN and authZ, rate limiting, quotas, and request validation. In simple words, it checks who the caller is, whether they are allowed, and whether the request is valid. The cross-cutting services here are Auth Service (OAuth2 / JWT), User & Tenant Service, Rate Limiter Service, Config Service, Observability, and Alerting. If the request fails at the edge, it should not reach the Java service.

The Search API Service is a Spring Boot REST controller. It parses the query, validates it again, and builds the search DSL. The Query Orchestrator Service geocodes the place name, expands synonyms, applies filters, and routes the query to the right index. The Search Service then executes the search, handles pagination, and asks for aggregations when needed. The search platform is OpenSearch or Elasticsearch, and it uses both a primary index for plumbers and a geo-spatial index for nearby lookup. This is the main business path.

The Ranking Service scores results with text relevance, distance, business rules, and freshness boost. The Response Builder shapes the final JSON, enriches the results, and redacts fields that should not leave the service. The caching layer uses Caffeine or Redis for query result cache, location cache, and popular queries. That helps common searches stay fast, especially for hot places like Kondapur. The response then returns through the gateway to the client as normal HTTPS JSON.

Freshness comes from the ingestion pipeline. The Plumber App or Partner Portal sends create or update changes to the Ingestion API in Java. That service validates and persists the change in PostgreSQL, then emits a change event to Kafka. The Indexer Service consumes those events and updates the search documents, the geo-spatial index, and the synonym or suggester data when needed. This keeps the search index fresh without slowing down user reads.

The supporting data stores are PostgreSQL for operational data, Redis for cache and sessions, and blob storage for images or documents. The data model keeps fields like name, categories, location, address, open hours, rating, reviews, verification, photos, and last updated time. The main trade-off is speed versus freshness. Caching and indexing make reads fast, but they add sync work, reindexing, and event handling. I accept that trade-off because local search must stay fast and still feel current.

The benefit of this design is fast local search with clear ownership. The edge blocks bad traffic early, and the Java service keeps the search logic simple. The search platform and cache make common queries very fast. Geo lookup makes the results useful because the user cares about distance. The downside is operational complexity. We now need ingestion, Kafka, an indexer, cache invalidation, and freshness checks. We accept that because a local search API must return good nearby results under load. Another trade-off is that a response can be very fast, but a new update may take a short time to appear in search.

At a high level, I would separate maintainable backend logic from safe public API evolution. Clients send HTTPS requests through the API gateway, which handles authentication, rate limiting, and routing. Inside the Java application, the controller maps requests, the application service coordinates the use case, the domain model holds business rules, and the repository abstracts persistence. For API changes, I prefer backward-compatible additions, versioning only for breaking changes, strong compatibility testing, gradual rollout, monitoring, and clear client communication. The trade-off is more release and migration work in exchange for lower client risk.

This question asks how I would keep backend code easy to understand while changing a public API safely. We want developers to change business logic without mixing every responsibility together. We also want existing web, mobile, and partner clients to keep working when the API evolves. The main challenge is balancing clean internal design with safe external change. I would explain the backend layers first. Then I would explain the API contract, versioning, testing, rollout, monitoring, and client communication shown in the diagram.

• How many external clients depend on this public API?
• How long must an older API version remain supported?
• What backward-compatibility promise do we make to existing clients?

I would start by defining a stable public API contract. The diagram shows stable DTOs, additive fields, defaults, and tolerant readers. A DTO is simply the data shape passed between parts of the system. Additive changes are safer because existing fields keep their meaning. Optional fields and sensible defaults also help older clients continue working. Tolerant readers mean a client can ignore fields it does not understand.

The clients are web, mobile, and partner applications. They send an HTTPS request to the API gateway. The gateway owns authentication, rate limiting, and routing. The response returns through the gateway and then back to the client.

Inside the Java application boundary, I would keep each responsibility small and clear. The Controller / resource handles request validation and response mapping. It passes a DTO or command to the Application service. The Application service coordinates the use case.

The Application service then invokes the Domain model. The Domain model contains entities, value objects, and business rules. This is where the important business behavior lives instead of placing it inside the transport layer.

The diagram shows the Domain model loading or saving an aggregate through the Repository. An aggregate is a related group of domain objects treated as one business unit. The Repository provides a persistence abstraction and reads or writes data in the Database. The returned domain data moves back through the domain and application layers. This separation makes the backend easier to test and change.

For API evolution, I would prefer non-breaking changes whenever possible. The diagram shows an evolution policy where compatible changes stay in the current version. Examples include additive fields, optional values, and defaults that do not change existing behavior.

When a change is truly breaking, I would move it to v2 instead of silently changing v1. During migration, I would support v1 and v2 in parallel. This gives existing clients time to migrate while new clients can use the newer contract.

Before rollout, I would use several levels of testing. Unit tests verify small pieces of logic. Integration tests verify components working together. Consumer contract tests check that the API still matches client expectations. Backward-compatibility tests protect existing behavior.

These tests form the release gate shown in the diagram. They reduce the chance that a backend refactor or API change breaks an existing client before deployment.

After the release gate passes, the Rollout strategy deploys the application. The diagram shows a feature flag, canary release, gradual traffic shift, full rollout, and rollback.

A feature flag lets us control when new behavior becomes active. A canary exposes the change to a small amount of traffic first. If production signals remain healthy, we gradually increase traffic. Then we move to full rollout. If monitoring shows a serious problem, the rollout process can use the rollback step instead of continuing.

The Java application sends metrics and logs to Monitoring. The diagram specifically tracks latency, 4xx and 5xx responses, schema failures, and client usage by version. Monitoring then provides a go or rollback signal to the Rollout strategy.

Client usage by version is especially useful during migration. It tells us whether clients are still using v1 before we consider ending support.

Safe API evolution is not only a coding problem. Clients need enough information and time to migrate. The Versioning flow leads to a deprecation plan and then to Client communication.

The diagram shows an OpenAPI update, changelog, deprecation notice, migration guide, and sunset date. Those changes are announced to clients. This makes the migration predictable instead of surprising users when an old version disappears.

The main trade-off is extra operational work. We may temporarily support multiple versions, maintain more tests, run staged deployments, monitor version usage, and communicate migrations. I accept that cost because it greatly reduces the risk of breaking public clients.

The benefit of this design is clear ownership. The gateway handles authentication, rate limiting, and routing. The controller handles request and response mapping. The application service coordinates the use case. The domain model contains business rules, and the repository hides database details. This makes changes easier to test and understand. For the public API, additive changes reduce breakage, while a new version handles changes that cannot stay compatible. The downside is extra work. We may support v1 and v2 together, maintain contract tests, manage feature flags, watch production metrics, and publish migration information. Canary releases also make deployment more controlled but slower than sending all traffic to a new release immediately. We accept this operational cost because it lowers the chance of breaking many clients at once.