C# Nullable Reference Type Interview Questions: Flow Analysis, Annotations, and Runtime Gaps

Nullable reference types (NRT) make null intent visible to the C# compiler. They do not create a different runtime System.String, magically validate JSON, or prove that an external library keeps its promise. A clear interview answer explains annotations, flow-state warnings, API contracts, and the specific places where a program can still observe null.

NRT is a static design and diagnostic system whose value depends on honest boundaries and an incremental migration plan.

Establish the evidence boundary before answering

Official or primary-source facts. Microsoft documents NRT as compiler annotations plus null-state analysis; string and string? have the same runtime type. It also documents API attributes for contracts and notes known gaps such as default-initialized structs and arrays of non-nullable references containing runtime nulls. The linked sources at the end support those facts and should take priority if a framework or toolchain changes.

Candidate reports. This is a technical-topic guide, not a company-process guide. I found no reliable, same-cycle candidate-report set that adds a general rule for this topic, so this article makes no claim about a particular employer’s interview format, scoring, or implementation choice.

Reasoned practice guidance. The scenarios, diagnosis order, and acceptance gates below are engineering inferences. They are intentionally framed as things to test in a stated environment, not as universal behavior.

Build the mental model, not a slogan

string? expresses that a reference is intended to allow null; string expresses a non-null intent in an enabled nullable context. Flow analysis refines a value’s state after guards such as if (value is not null). A warning means the code’s use conflicts with declared or inferred intent; it is a diagnostic to understand, not an instruction to add ! everywhere.

Annotations cannot describe every conditional contract with a type alone. Attributes can express relationships such as a return value’s null state depending on an argument or a method guaranteeing a field becomes non-null after success. These contracts help callers, but they become liabilities if implementation changes without tests. Treat them as API behavior that needs review.

Runtime sources still matter: reflection, deserialization, legacy code compiled with nullable disabled, default values, arrays, and untrusted payloads can supply null despite an annotation. Validate boundaries, initialize required state, and test bad inputs. NRT narrows the space of accidental dereferences; it does not replace runtime validation, authorization, or data schema checks.

An interviewer may change one assumption halfway through: distributed workers, a new data slice, a checkpoint resume, a different ABI, or a new attacker capability. Return to the boundary and state which observation would change your answer. That is stronger than defending a memorized rule.

Work a bounded interview exercise

Prompt. A service enables NRT and encounters warnings in a DTO layer, a legacy repository, and a generic helper. A developer applies ! to clear the build. Propose a migration that improves the contract without creating warning fatigue or hiding real nulls.

1. Set the nullable context deliberately at project or file scope, then triage by boundary. Start with new code and public APIs where annotations improve callers immediately. For DTOs, distinguish required values enforced by validation or constructors from optional values that should be ?. For legacy islands, use scoped contexts and adapters rather than pretending uncertain code is fully annotated overnight.

2. Replace a suppression only when there is a concrete invariant close to the code. A null check, constructor initialization, guard method annotated with an appropriate postcondition, or validation result may justify a non-null flow state. A bare ! adds no runtime protection and can tell the compiler a fact that is false. If a framework populates fields later, document and test that lifecycle explicitly.

3. For generics, identify constraints and caller intent. T? has different implications for unconstrained, class-constrained, and struct-constrained type parameters. Keep a small compile-warning test project or representative build in CI, and pair it with runtime tests for JSON, database, and default-value boundaries. The goal is a declining warning backlog with contracts that reflect reality.

The final answer should name a stop condition. For example: roll back a release if a protected slice crosses its error budget; reject a schema change if compatibility tests fail; stop a performance tune if the profile shows the presumed allocation is not material. A decision with a measured exit condition is more useful than an unbounded exploration.

Debug from evidence in this order

• Context: verify whether annotations and warnings are enabled in each project and generated-code boundary.
• Contract: review public annotations and conditional attributes as part of API changes.
• Runtime: test deserialization, default structs, arrays, reflection, and legacy-library paths with null inputs.
• Suppression: inventory !, explain each invariant, and remove suppressions that lack evidence.

This sequence is deliberately conservative. It separates a fact established by a specification or runtime document from a local observation, then asks for the smallest intervention that can disprove the current theory. It also produces artifacts a reviewer can reproduce: an input slice, command line or configuration, before/after measurement, and rollback point.

Turn the explanation into an engineering decision

For C# Nullable Reference Type Interview Questions: Flow Analysis, Annotations, and Runtime Gaps, practice a one-page decision record rather than a stream of concepts. Begin with the user-visible or system-level failure: a bad slice metric, incompatible reader, allocation spike, unsafe data path, or portability assumption. State what must remain true after the change. This is the invariant. Examples include preserving a monetary value’s unit, keeping a request within a latency budget, preventing untrusted data from reaching a sensitive operation, or retaining the behavior promised by an API. An invariant makes it possible to reject an attractive implementation that optimizes the wrong thing.

Next, make the scope testable. Name the build or runtime version, data slice, traffic window, hardware, model checkpoint, compiler target, or security boundary that applies. A concise qualifier is more credible than a universal statement. “Under this ONNX Runtime build on the target CPU,” “for the old writer and new reader compatibility matrix,” or “when this request is reachable without an authorization guard” gives the interviewer a condition they can challenge. If the condition is unknown, say which document, log, experiment, or source inspection would resolve it.

Then compare two or three options against the invariant. For each option, write its mechanism, benefit, failure mode, and proof. A mechanism is not a benefit: a lower quantization range may improve resolution near zero but may saturate a rare activation; a broader CodeQL query may find more paths but can consume triage capacity; a new layout may reduce bytes but create an ABI or alignment cost. The proof should be concrete: a compatibility matrix, fixed-input test, profile, slice evaluation, path trace, or compiler output. It should include the baseline so an apparent improvement has meaning.

Make rollback part of the design. Identify which input, model, schema, configuration, or binary remains available; which metric triggers a stop; and who can act. A rollback plan does not imply the change is unsafe. It demonstrates that the team can learn from a bounded experiment without turning a local defect into unrecoverable history. For a non-reversible boundary, such as schema deletion or a public API contract, replace rollback with a staged migration and an explicit deprecation window.

Finally, communicate uncertainty precisely. Say “the documentation establishes X,” “the trace or benchmark establishes Y in this build,” and “I infer Z, so I would validate it with W.” That separation is especially important for Software Engineer work, where a mechanism may be correct while the proposed operational response is still wrong for the product’s constraints. It also keeps an interview answer honest when the interviewer has intentionally withheld a critical fact.

A five-minute whiteboard drill

Use this repeatable drill before an interview. Spend the first minute drawing the data, object, update, or control-flow boundary relevant to the prompt. Spend the second minute labeling the state that crosses the boundary and the state that must remain local, immutable, compatible, bounded, or trusted. Spend the third minute naming the symptom and listing two competing hypotheses. Spend the fourth minute choosing the cheapest discriminating observation. Spend the final minute proposing a small fix, an acceptance metric, and a rollback or migration path.

This format avoids a common failure mode: changing a configuration while several causes remain plausible. It also prevents a different failure mode: producing a technically elegant design with no evidence it works in the environment. If a panel asks for code, implement a narrow probe that exposes one invariant. If it asks for system design, write the observability and ownership fields next to the component diagram. If it asks for debugging, lead with the evidence you would gather before naming the fix.

Score your own response on five questions. Did it name the boundary? Did it distinguish a documented fact from a local observation? Did it identify an assumption that could reverse the recommendation? Did it specify a measurement that falsifies the current theory? Did it include a safe next action? A “yes” to all five usually signals stronger engineering judgment than adding another unsupported optimization detail.

When the prompt gives incomplete information, say so without stopping. Choose a provisional assumption that minimizes risk, explain why it is provisional, and state the first observation you would request. For example, a performance question may need a profile and workload distribution; a model question may need a protected evaluation slice; a security question may need the actual sink API and route reachability. This is not hedging. It is a way to turn uncertainty into an ordered investigation. A candidate who can do that will usually make better trade-offs after the interview too.

How to answer follow-up questions well

1. Say NRT changes compiler analysis, not runtime reference representation.
2. Show how a guard changes null state.
3. Use attributes for conditional contracts rather than forcing an incorrect non-null type.
4. Name default and external-data gaps.
5. Outline an incremental migration with tests instead of a mass suppression.

Avoid two common interview failures. First, do not make a tool guarantee that its documentation does not make; qualify compiler, hardware, library, and deployment assumptions. Second, do not answer with a bag of keywords. A compact causal chain—input or state, mechanism, observable symptom, verification, reversible fix—lets the interviewer assess your judgment.

Sources and Further Reading

• Microsoft nullable reference types guide
• C# language specification: nullable reference types
• Microsoft null operators documentation