Role Pack · Mid to Senior
Full Stack Developer Pack
Spanning the client, the API, the database and the deploy, the questions that test range.
How the layers fit together: browser to API to database to deploy, plus the glue (auth, caching, state) that trips people up.
- Questions
- 360
- Topics
- 20
- Pages
- 233pages
- 360 questions, every one with a model answer
- End-to-end architecture cheat sheet
- Auth & caching patterns
- Deployment & debugging
Get the Full Stack Developer Pack — $9
One-off. Delivered as a PDF by email the moment payment clears.
Prices shown are a USD base. Your local-market price is calculated at checkout in your own currency, plus any local sales tax.
What is inside
20 chapters, in the order the interviews tend to ask them:
- How a web request actually flows
- HTTP semantics and API contract design
- Resource design, compatibility and versioning
- Authentication, sessions and identity
- Authorisation and access control
- Caching strategies across the stack
- Relational data modelling and normalisation
- Query performance and indexing
- Transactions, concurrency and data integrity
- Background jobs and asynchronous processing
- Client side state and data fetching
- Shared contracts, types and validation
- Server rendering, hydration and routing
- Realtime: WebSockets and server sent events
- Observability: logging, tracing and metrics
- Testing strategy across the stack
- Containers, pipelines and deployment
- Configuration, secrets and environment parity
- Web application security
- Scaling under load and debugging production
How the answers are built
Each chapter opens with the checklist the question is really testing. A few from this pack:
- A cold request pays DNS, TCP, TLS, the request, the server work and the response, and only the last is usually measured.
- Safe means no side effect and idempotent means the same effect on repeat, which are two separate properties and not one.
- A resource is a thing, a collection is many things, and a subresource is a thing with its own lifecycle hung off a parent.
- A cookie marked HttpOnly cannot be read by script, which removes the simplest token theft path.
- Authorisation is always enforced server side, because a client side check is a usability affordance rather than a control.
- A private response is for one user and a public one may be stored by any shared cache, so the header is a contract rather than a hint.
Questions this pack covers
- Walk me through what happens between a DNS lookup and the first byte of the response
- How does a browser decide whether to reuse a keep alive connection
- What makes a method safe, and what makes it idempotent
- Why should a POST that creates a resource also return a Location header
- How do you name resources so the URL reads as a hierarchy
- When is a collection action better modelled as a sub resource
- What makes a session cookie safer than a token kept in local storage
- How do the SameSite, HttpOnly and Secure attributes each help
Each one is answered in full in the pack, with the reasoning written out rather than a bullet list.
About this pack
- How many questions?
- 360, spread across 20 topics, written out in full across 233 pages.
- Do the answers just list keywords?
- No. Each answer is written as prose, because that is what you have to reproduce when someone asks you the question.
- How do I get it?
- Pay once and the PDF arrives by email immediately, with a signed download link.
- Can I get it refunded?
- Yes, if it is not what you expected. See the refund policy.
