84 terms across 10 categories. Every entry answers two things - what it is, and why an interviewer cares. The second is what actually gets scored.
The weight deciding which rule wins: element < class < id < inline, with !important above all.
🎯 Interview angle
Reaching for !important usually signals a specificity problem rather than solving one. Methodologies like BEM exist to keep specificity flat.
A layering scope created by position with z-index, transform, opacity below 1, or filter.
🎯 Interview angle
Why z-index: 9999 sometimes does nothing - the element is trapped inside a context its ancestor created. An opacity of 0.99 is enough to create one.
Content, padding, border and margin. box-sizing decides whether width includes padding and border.
🎯 Interview angle
border-box is what nearly every reset sets, because with the default content-box `width: 100%` plus padding overflows its container.
Adjacent vertical margins combining into the larger of the two rather than summing.
🎯 Interview angle
Surprises everyone once. Flex and grid containers do not collapse margins, which is one reason `gap` is easier to reason about.
em is relative to the element's own font size and compounds when nested; rem is relative to the root.
🎯 Interview angle
Both respect the user's browser font-size setting, unlike px - that is the accessibility argument. rem avoids the compounding surprise.
dvh, svh and lvh, accounting for mobile browser chrome that hides and shows on scroll.
🎯 Interview angle
Explains why height: 100vh overflows on mobile - vh historically ignored the address bar.
An index determining the physical order of rows on disk. One per table.
🎯 Interview angle
In InnoDB the primary key is the clustered index, and every secondary index stores the primary key rather than a row pointer - which is why a wide primary key inflates every other index.
An index containing every column a query needs, so the engine never reads the table itself.
🎯 Interview angle
EXPLAIN shows 'Using index'. The lookup back to the row is often the expensive part, so eliminating it is a bigger win than it sounds.
An index over several columns, usable for queries filtering on a leftmost prefix of them.
🎯 Interview angle
The leftmost-prefix rule is the whole question. An index on (a, b) helps `WHERE a = ?` and `WHERE a = ? AND b = ?`, but not `WHERE b = ?`.
A predicate that can use an index seek - the indexed column appears bare, not wrapped in a function.
🎯 Interview angle
`WHERE YEAR(created) = 2026` scans; the date-range rewrite seeks. Same for a leading-wildcard LIKE. This is the most common accidental full scan.
One query for a list, then one extra query per row when a related field is accessed.
🎯 Interview angle
It looks fine on ten rows and collapses on ten thousand. Django's fix is select_related (JOIN, single-valued) or prefetch_related (second query, multi-valued); catch regressions with assertNumQueries.
How much concurrent transactions can see of each other: READ UNCOMMITTED, READ COMMITTED, REPEATABLE READ, SERIALIZABLE.
🎯 Interview angle
Name the anomaly each one prevents - dirty read, non-repeatable read, phantom - rather than reciting the ladder. Knowing your database's default matters too.
Two transactions each holding a lock the other needs, so neither can proceed.
🎯 Interview angle
The systematic prevention is a consistent global lock ordering, which makes a wait-for cycle impossible. Beyond that: short transactions and retry logic.
The delay before a write on the primary becomes visible on a replica.
🎯 Interview angle
The concrete bug is read-after-write: a user saves and the change appears to vanish. The fix is routing that read to the primary or pinning the session.
Sending writes to a primary and reads to replicas.
🎯 Interview angle
It scales reads only. Once the primary saturates on writes the next step is sharding, which is a far bigger change - saying that shows you know the ceiling.
Splitting data horizontally across databases by a shard key.
🎯 Interview angle
Shard-key choice is the whole game. A key with skewed access creates a hot shard, and cross-shard joins and transactions become application problems.
Organising tables to remove redundancy: 1NF removes repeating groups, 2NF partial dependencies, 3NF transitive ones.
🎯 Interview angle
'The key, the whole key, and nothing but the key.' Then say when you would denormalise - read-heavy paths where the join cost outweighs the duplication risk.
Model-View-Template. Django's View is what other frameworks call a controller; the framework handles URL dispatch.
🎯 Interview angle
Do not claim MVT is fundamentally different from MVC. The honest framing is that Django names the layers differently and owns the routing.
A QuerySet builds a query without executing it until evaluated - iterated, sliced, len(), list() or bool().
🎯 Interview angle
Laziness is why chained filters cost nothing extra, and also why N+1 hides so well: the extra query fires at attribute access, far from where the queryset was defined.
Follows single-valued relations (ForeignKey, OneToOne) with a SQL JOIN in the same query.
🎯 Interview angle
Pair it with prefetch_related in your answer and say why they differ: a JOIN cannot express a multi-valued relation without row multiplication.
Fetches multi-valued relations (ManyToMany, reverse FK) in a second query and joins them in Python.
🎯 Interview angle
Two queries instead of N+1. Prefetch() lets you filter or order the prefetched set, which is the follow-up question.
aget, acreate, asave, acount, afirst and async iteration, added in Django 4.1 and extended to related managers in 5.0.
🎯 Interview angle
Correct the old claim that the ORM is synchronous. Then add the nuance: these give an async-safe interface, but execute on a thread - not native async drivers.
Django 5.0 field whose value the database computes from other columns.
🎯 Interview angle
Better than overriding save() because bulk operations and raw SQL bypass save() entirely. Same argument applies to db_default over default.
Django 5.0 field option applying a default at the database level rather than in Python.
🎯 Interview angle
It covers inserts that never touch the ORM, and lets you use database functions such as Now(). A Python-side default cannot do either.
Hooks processing every request on the way in and every response on the way out.
🎯 Interview angle
Order matters and is testable: AuthenticationMiddleware must follow SessionMiddleware because it reads the session. Describe it as an onion, not a list.
A publish/subscribe mechanism for model and request lifecycle events.
🎯 Interview angle
Say the drawback: implicit coupling that is hard to trace, and bulk_create / queryset.update() bypass save() so post_save never fires. An explicit service function is usually better.
Django 4.2 dict replacing DEFAULT_FILE_STORAGE and STATICFILES_STORAGE.
🎯 Interview angle
A small detail that reliably distinguishes someone on a current Django from someone on 3.2.
Static files ship with the code; media files are uploaded by users at runtime.
🎯 Interview angle
The consequence is deployment: static can be collected and cached hard at build time, media needs writable, backed-up, usually off-server storage.
The async successor to WSGI, supporting long-lived connections and async callables.
🎯 Interview angle
WSGI is one synchronous call per request with no concept of a persistent connection - which is why WebSockets need ASGI rather than being a bolt-on.
Declaring a dependency as `Annotated[Session, Depends(get_db)]` rather than as a default value.
🎯 Interview angle
Say why: the old form burns the default slot on framework metadata and confuses type checkers. Annotated also lets you alias and reuse the dependency across routes.
Declaring what a route needs and letting the framework provide it, with caching and teardown handled.
🎯 Interview angle
The testing payoff is the strongest argument: dependency_overrides swaps a real database for a fake without touching application code.
The Rust-core rewrite of Pydantic, with a renamed public API.
🎯 Interview angle
Know the mapping cold: .dict() to .model_dump(), class Config to model_config = ConfigDict(...), orm_mode to from_attributes, @validator to @field_validator. Using v1 names is the clearest sign of a stale answer.
A Pydantic model declaring exactly what a route returns; fields not declared are stripped.
🎯 Interview angle
The filtering is a security feature - returning an ORM object with a password_hash is harmless if the response model does not declare it.
An async context manager for application startup and shutdown, replacing the deprecated on_event handlers.
🎯 Interview angle
Setup before yield, teardown after. It keeps paired resources together and attaches shared state to the app rather than to globals.
An ASGI server, often run as worker processes managed by Gunicorn.
🎯 Interview angle
They are complementary, not alternatives: Uvicorn serves ASGI, Gunicorn contributes process supervision and graceful restarts.
Running synchronous, long-running code inside an async def route, stalling every concurrent request.
🎯 Interview angle
The single most common FastAPI performance bug. Use plain `def` (FastAPI runs it in a threadpool) or an async driver - `async def` around blocking code is the worst option.
A client-supplied identifier letting the server recognise a retry and return the original result.
🎯 Interview angle
A timeout never tells the client whether the write happened. Without idempotency the choice is duplicate charges or lost orders.
Capping request rate per client to protect availability.
🎯 Interview angle
The distributed catch: an in-memory counter behind four instances enforces four times the intended limit. State belongs in Redis.
Attributes supplying accessibility semantics where native HTML cannot.
🎯 Interview angle
The first rule of ARIA is not to use it. A <button> is focusable and keyboard-activatable for free; role='button' on a div gives you the announcement and none of the behaviour.
Using elements that describe meaning - nav, main, article, header - rather than generic divs.
🎯 Interview angle
Lead with accessibility, which is concrete and testable, rather than vague SEO benefit.
Both download scripts in parallel; async executes as soon as it lands, defer waits for parsing and preserves order.
🎯 Interview angle
defer for application code that depends on the DOM or on ordering; async for independent third-party tags.
The scheduler draining the microtask queue completely between every macrotask.
🎯 Interview angle
The orderable example is the test: promises resolve before setTimeout(0). A microtask that keeps scheduling microtasks starves the loop entirely.
A callback queued by a promise or queueMicrotask, run before the next macrotask.
🎯 Interview angle
Microtasks drain fully, macrotasks one at a time. That asymmetry explains most 'why did this log in that order' questions.
A function plus the lexical environment it captured.
🎯 Interview angle
Behind private state, memoisation and the classic var-in-a-loop bug where every callback shares one binding. let creates a fresh binding per iteration.
The span between a let/const binding entering scope and being initialised, where access throws ReferenceError.
🎯 Interview angle
let and const are hoisted, just not initialised. The TDZ converts a silent undefined into a loud error - that is the improvement over var.
One listener on a parent handling events from many children via bubbling.
🎯 Interview angle
Two wins: far fewer listeners, and it works for elements added after the listener was attached. Pair it with event.target.closest().
An event propagating from the target up through its ancestors, after a capturing phase downward.
🎯 Interview angle
stopPropagation halts the rest of the journey, which silently breaks delegated handlers elsewhere - worth flagging as a cost.
Debounce waits for a quiet period before firing; throttle guarantees a maximum firing rate.
🎯 Interview angle
Match to intent: debounce for 'user finished typing', throttle for 'keep updating while scrolling'. Choosing wrongly is the common error.
A browser mechanism controlling whether script may read a cross-origin response.
🎯 Interview angle
The browser enforces it, not the server - which is why curl is unaffected and the request often runs server-side regardless. Wildcard origin plus credentials is forbidden by spec.
Cookies are sent automatically with matching requests and can be HttpOnly; localStorage is script-only and never transmitted.
🎯 Interview angle
The security trade is the answer: a token in localStorage is readable by any XSS; an HttpOnly cookie is not, but then needs CSRF protection.
Removing unused exports at build time, relying on static ES module analysis.
🎯 Interview angle
It needs ESM because require() can be dynamic. Module side effects also block it - that is what `sideEffects: false` declares.
The JavaScript a browser must download, parse and execute before the page is interactive.
🎯 Interview angle
Usually the largest front-end performance lever, dominating almost any micro-optimisation. Code splitting and lazy loading are the tools.
A lock in standard CPython ensuring only one thread executes Python bytecode at a time.
🎯 Interview angle
Do not stop at 'Python can't do parallelism'. Say: on a default build the GIL applies, so use processes for CPU-bound work. Then add that the free-threaded build (PEP 703) removes it - experimental in 3.13, officially supported in 3.14 - and that removing it does not make your own data structures thread-safe.
A separate CPython build without the GIL, distributed as python3.14t. Threads can execute bytecode in parallel.
🎯 Interview angle
Three things show you have actually followed it: it is a distinct build not a flag, single-threaded code is somewhat slower because refcounting must become thread-safe, and C extensions must opt in.
Writing `def f(items=[])`. The list is created once at definition time and shared across every call.
🎯 Interview angle
A classic screening question. Use `None` as the default and build inside the body. Dataclasses raise at class-creation time instead, which is why they force `field(default_factory=list)`.
A copy of a container whose elements are still references to the same nested objects.
🎯 Interview angle
`a.copy()`, `list(a)` and `{**d}` are all shallow. Mutating a nested list shows through both copies. `copy.deepcopy()` fixes it and is far more expensive - know both facts.
Name resolution order: Local, Enclosing, Global, Built-in.
🎯 Interview angle
The consequence is what gets asked: assigning to a name anywhere in a function makes it local for the whole function, so reading it earlier raises UnboundLocalError rather than falling through to the global.
A function together with the enclosing scope it captured, keeping those variables alive after the outer call returns.
🎯 Interview angle
Behind decorators, memoisation and the late-binding loop bug where every closure sees the final loop value. The fix is a default argument or functools.partial.
A callable that takes a function and returns a replacement, applied with @ syntax.
🎯 Interview angle
Always mention functools.wraps - without it the decorated function loses its name and docstring, breaking introspection and documentation tooling.
A class attribute replacing the per-instance __dict__ with a fixed set of descriptors.
🎯 Interview angle
A memory optimisation for classes instantiated in the millions. The costs: no ad-hoc attributes, and multiple inheritance with slots gets awkward.
The algorithm deciding attribute lookup order across multiple inheritance.
🎯 Interview angle
It guarantees a class precedes its parents and preserves base order. When no consistent order exists Python refuses to create the class - that is the 'cannot create a consistent MRO' error.
An object defining __get__, __set__ or __delete__, controlling attribute access on the owning class.
🎯 Interview angle
The machinery behind property, classmethod, staticmethod and ORM fields. Knowing that property *is* a descriptor is what turns it from magic into mechanism.
A function using yield, producing values lazily and holding its state between calls.
🎯 Interview angle
The memory argument is the point: constant memory regardless of length, which is how you stream a file larger than RAM. The trade is single-consumption and no indexing.
__iter__ returning an iterator and __next__ returning the next value or raising StopIteration.
🎯 Interview angle
Distinguish iterable from iterator. A list is iterable and gives a fresh iterator each time; a generator is its own iterator and exhausts once.
An object implementing __enter__ and __exit__, used with the `with` statement.
🎯 Interview angle
It is try/finally with a name. __exit__ runs even on exception, and returning True from it suppresses the exception - a detail worth knowing but rarely worth using.
Python 3.12 syntax for type parameters: `class Box[T]`, `def f[T](x: T) -> T`, and the `type` alias statement.
🎯 Interview angle
Mentioning it signals you have used a recent Python. The older TypeVar form still works everywhere and is what you will meet in existing codebases.
typing.Protocol - a class matches by having the right methods, without inheriting anything.
🎯 Interview angle
Static duck typing. The contrast with ABC is the answer: ABC requires explicit inheritance and enforces at instantiation; Protocol is checked by the type checker and requires nothing at runtime.
The single-threaded scheduler running coroutines, resuming each when the thing it awaited is ready.
🎯 Interview angle
Concurrency, not parallelism - one thread, one core. The killer detail: one blocking call inside a coroutine stalls every other task on the loop.
A function defined with async def. Calling it returns a coroutine object; nothing runs until it is awaited or scheduled.
🎯 Interview angle
The common bug is forgetting to await, which produces a 'coroutine was never awaited' warning and silently does nothing.
Diffing the new element tree against the previous one to compute minimal DOM updates.
🎯 Interview angle
The virtual DOM is not faster than hand-written DOM code. Its value is that you describe target state declaratively and never manage transitions.
Stable identifiers letting React match elements between renders.
🎯 Interview angle
Index keys break on reorder or insertion: component state follows position, not item, so a checked checkbox jumps rows after a deletion.
An effect or callback capturing values from an earlier render because a dependency was omitted.
🎯 Interview angle
The classic 'why is my counter stuck at 0'. The effect closes over the render that created it; the deps array is what forces recreation.
Comparing by object identity rather than contents - what React.memo and dependency arrays use.
🎯 Interview angle
Explains why memo often does nothing: an inline arrow or object literal is a new reference every render. Also why mutating state in place never re-renders.
Attaching React to server-rendered HTML, reusing the markup rather than recreating it.
🎯 Interview angle
Mismatches come from non-determinism in render: Date.now(), Math.random(), localStorage. Move those into useEffect so the first client render matches the server.
Rendering components to HTML on the server so meaningful markup arrives in the first response.
🎯 Interview angle
Trade both ways: better first paint and crawlability, at the cost of server load and hydration. CSR ships an empty div and a bundle.
Tricking a logged-in user's browser into making an unintended state-changing request.
🎯 Interview angle
It exists because cookies are sent automatically. Token-based auth in a header is not vulnerable in the same way - which is the trade against HttpOnly cookies.
Injecting script into a page so it runs with the site's origin and privileges.
🎯 Interview angle
Context-aware output escaping is the fix, not input filtering. Django and Jinja2 autoescape by default - so the risk lives in |safe and dangerouslySetInnerHTML.
Storing a slow, salted one-way hash - bcrypt, scrypt or argon2 - rather than the password.
🎯 Interview angle
SHA-256 is wrong precisely because it is fast. Password hashes need a tunable work factor so brute force stays impractical.
A signed, self-contained token carrying claims, verifiable without a session lookup.
🎯 Interview angle
State the cost: you cannot easily revoke one before it expires. Short-lived access tokens plus refresh tokens is the standard mitigation.
A Rust-based Python package and project manager from Astral, replacing pip, pip-tools, virtualenv, pyenv and twine.
🎯 Interview angle
The current default answer for dependency management. Say what it consolidates and mention poetry as the common incumbent - that shows landscape awareness rather than tool fashion.
A Rust-based linter and formatter replacing flake8, isort, pyupgrade, bandit and black.
🎯 Interview angle
Know the boundary: Ruff does no type inference, so mypy or pyright stays in the stack. Fast enough to run in a pre-commit hook without friction.
An isolated directory with its own interpreter and site-packages for one project.
🎯 Interview angle
The problem it solves is version conflict between projects, not security or performance. uv manages them without an explicit activate step.
Static type checkers that verify annotations without running the code.
🎯 Interview angle
Python type hints are not enforced at runtime - that is the whole point of a separate checker. Adopting gradually with per-module strictness is the realistic answer.
A function providing test dependencies, requested by naming it as a test parameter.
🎯 Interview angle
Explicit injection over hidden setUp state, plus scopes (function, module, session) so expensive setup is not repeated per test.