Cotiviti Software Engineer Interview Guide

The 60-second brief

Cotiviti is described as a healthcare analytics company. Candidates and the role description point to payment accuracy, risk adjustment and quality analytics built on large volumes of healthcare data, delivered to health plans and healthcare providers. The listed engineering stack is Java with Spring Boot and Spring Batch, .NET, Python and Angular on the front end, with relational databases such as SQL Server, PostgreSQL or Oracle underneath. The role description also mentions AI and machine learning components inside the software. A Software Engineer there designs, codes, tests and maintains applications, which can mean batch-processing pipelines, REST services, front-end screens, database modelling and SQL routines, plus code reviews, CI/CD and build automation.

This guide is for candidates interviewing for a Software Engineer role at Cotiviti, whether through a campus or high-volume drive or as a lateral hire. It covers the five reported rounds, the twenty technical questions candidates report (Java and OOP, Spring, SQL and warehousing, algorithms, design and web security), a seven-day plan, and the project and HR conversations that close the loop. Which language you are examined in depends on the team: Java is the most represented in the reports, with .NET and Python also listed.

Candidates report five stages over roughly four to six weeks: an online screening test, a recruiter phone screen, one or two technical interview rounds, a managerial or business analytics round, and a closing HR and leadership round.

Focus areas

• Java
• Object-Oriented Programming (OOP)
• SQL

Overview

The work described for this role is enterprise backend engineering on data-heavy systems: Spring Boot services, Spring Batch jobs that process records in bulk, SQL against a relational store, and Angular screens in front of them. That explains the shape of the reported questions. You are asked how a Spring Batch job moves through its lifecycle, how dependency injection works inside Spring Boot, how to write a join with a subquery, how OLTP differs from OLAP, and what a data mart is. Expect to explain mechanisms, not recite annotation names.

The reported questions fall into four groups. Core Java and OOP covers the principles of object-oriented design, Java 8 lambdas and streams, how parameters are passed for primitives versus wrapper classes and objects, the Spring Batch job lifecycle, and Spring Boot architecture. Databases covers a multi-table aggregate query, OLTP versus OLAP, data marts, the read and write cost of indexes, and normalization versus denormalization. Algorithms covers reversing a string iteratively and then with a lambda, finding contiguous subarrays with a target sum, anagram or longest-palindrome problems, dynamic programming by memoization or tabulation, and measuring Big O. Design and security covers XSS prevention, walking through a system such as a hotel reservation system or workflow engine, web performance under heavy traffic, third-party API integration with build and deployment pipelines, and logging, error handling and transaction boundaries across services.

Prepare in one primary language rather than spreading thin. The requirements candidates describe ask for strength in at least one of Java, C# and .NET, or Python, plus solid SQL on a relational database. Candidates also report that panel members ask project-specific questions based on what the resume claims, so every technology on your resume needs a concrete example you can explain: what you built, what you chose, how it was built and deployed, and what went wrong.

The first and last stages are different in kind. The online screening test is reported to mix logical reasoning, quantitative aptitude, core computer science such as OOP and basic SQL, and a few coding problems on arrays, strings or dynamic programming, so it rewards fast, accurate fundamentals. The managerial or business analytics round and the HR and leadership round are conversational, so prepare scenario reasoning, a project narrative, and a clear account of your career and expectations.

The Cotiviti interview process

Candidates describe five stages. Campus and high-volume pipelines are reported to start with the online test, while lateral pipelines may use or add a recruiter call, so the order and count can differ by office and hiring track.

Online Screening Test

Candidates report an automated online test covering logical reasoning, quantitative aptitude and core computer science, including OOP and basic SQL, followed by two or three hands-on coding problems on arrays, strings or dynamic programming. It is reported most often for campus drives and high-volume hiring, and in lateral pipelines it may be replaced by or paired with the recruiter call. Treat it as a speed-and-accuracy stage: warm up on aptitude-style puzzles, then practise writing correct array and string code without an interviewer to talk to.

What to demonstrate

• Logical reasoning and quantitative aptitude
• Core computer science concepts such as OOP and basic SQL
• Working code for array, string and dynamic programming problems

How to prepare

• Solve the target-sum subarray problem, an anagram check and the longest-palindrome problem in your primary language until each compiles and passes edge cases (empty input, single element, negatives) on the first run.
• Write a memoized and a bottom-up version of one dynamic programming problem, such as climbing stairs, and state the complexity of both.
• Review the OOP pillars and write a basic SQL query with a join and GROUP BY from memory.
• Do a set of logic and quantitative puzzles, including a balance-scale puzzle, and explain each solution step by step.

Recruiter Phone Screen

Candidates describe a call that reviews your resume experience and what the role involves, mainly in lateral hiring. No technical questions are reported for this stage, so the goal is a clear, accurate account of what you have built and what you want next. Because later panels are reported to ask project-specific questions from the resume, whatever you say here sets up what you will be asked to defend.

What to demonstrate

• Resume experience and how clearly you describe it
• Fit between your background and the role's listed stack

How to prepare

• List every technology on your resume (Java, Spring Boot, SQL Server, Angular and so on) and write one sentence on what you built with it; delete anything you cannot defend.
• Prepare a two-minute walk through your recent roles that ends on the stack the role lists: Java or .NET or Python, SQL, and Spring Batch or Angular if you have used them.
• Note your location constraints, notice period and expectations, and ask which rounds follow so you can match your preparation.

Technical Interview Rounds

Candidates report one or two deep-dive technical interviews, run by senior engineers, tech leads or engineering managers over a video platform such as MS Teams or in an onsite panel. The reported content is live coding, core language mechanics (Java runtime behaviour, the Spring frameworks, or .NET fundamentals), database query writing, and discussion of your own projects and their build and deployment pipelines. This is where the Java, Spring, SQL, algorithm and design questions in this guide are practised. Think aloud, clarify inputs and edge cases, state complexity, then code.

What to demonstrate

• Live coding on data structures and algorithms
• Core language mechanics such as Java 8 features, parameter passing and Spring internals
• SQL query writing and database concepts such as indexes and normalization
• How you explain your own projects, builds and deployments

How to prepare

• Rehearse out loud the Java and Spring set: OOP principles, Java 8 streams, pass-by-value, Spring Boot dependency injection and the Spring Batch job lifecycle.
• Write the join-and-subquery aggregate, the second-highest-value query and an index experiment against a real PostgreSQL or SQL Server instance, and keep the results.
• Code the string reversal (loop, then lambda or stream), the target-sum subarray and a dynamic programming problem in a shared editor while narrating.
• Pick two resume projects and prepare a short account of the design, the stack choices, the build and deployment path, and one performance or security issue.

Managerial/Business Analytics Round

Candidates report a scenario-based discussion built around business logic, which some processes include after the technical rounds. It is conversational rather than a coding contest: you are given a situation and expected to reason from it. Practise turning a business rule into data and logic by stating the entities, the rule, the edge cases and how you would check the result. Practising on healthcare-style tables, such as claims, members and providers, is a useful rehearsal for the data this company describes.

What to demonstrate

• Problem-solving on a scenario that rests on business logic
• How you structure and communicate your reasoning

How to prepare

• Invent two scenarios on a claims-style schema, for example flagging duplicate submissions or totalling amounts per provider, and talk through the rule, the SQL and the edge cases in order.
• Be able to explain OLTP versus OLAP and where a data mart fits, so you can say where analytic reporting would live relative to the transactional system.
• State assumptions out loud and ask what an ambiguous rule means before building on it.

HR and Leadership Round

Candidates describe the final stage as covering organizational fit, career background, salary expectations and team alignment. Preparing here is mostly about a coherent story and honest, practical answers. Candidates are also advised to use the managerial and HR conversations to ask about team culture, project roadmaps and on-call rotations.

What to demonstrate

• Organizational fit and team alignment
• Career background and the reasoning behind your moves
• Salary expectations

How to prepare

• Write a short career narrative that explains each move, and why a data-heavy enterprise platform fits where you are heading.
• Settle your salary expectation and its reasoning before the call, and phrase it as a range you can justify.
• Prepare three real questions for the team about culture, roadmap and on-call duties.

Where candidates lose points

Saying Java passes objects by reference when asked about primitives versus wrapper classes and objects

Say that Java always passes by value. For an object, the value copied is the reference, so a method can mutate the caller's object but reassigning the parameter does not affect the caller. Wrapper classes such as Integer are immutable, so changing one inside a method never changes the caller's variable. Back this with a ten-line demonstration you have actually run.

Writing a join-and-aggregate or second-highest query that inflates sums or ignores ties

Name the grain of each table before joining, check which joins are one-to-many, and aggregate before joining when needed. For the second-highest value, decide how duplicates and NULLs should behave and show the DENSE_RANK version and the MAX-below-MAX subquery version, since the question rules out a simple LIMIT.

Solving the target-sum subarray problem with a sliding window, then failing when the array has negative numbers

Ask whether values can be negative or zero first. A window works only for non-negative input; for general input keep a running prefix sum and a hash map of how often each prefix has occurred, looking up current minus target. That gives O(n) time and O(n) space and handles negatives.

Reciting Spring annotations and Spring Batch class names without explaining what happens at runtime

Trace the mechanism: for Spring Boot, component scanning, bean definitions, instantiation, constructor injection and auto-configuration conditions. For Spring Batch, a launcher starts a Job made of Steps, a chunk-oriented step reads, processes and writes items in transactions, and a job repository records execution state so a failed job can restart.

Listing technologies on your resume that you cannot discuss in depth

Candidates report that panel members ask project-specific questions from the CV. Keep only technologies you can explain, and for each one prepare your design choices, how it was built and deployed, and one problem you solved.

Questions & practice

What is the difference between OLTP (Online Transaction Processing) and OLAP (Online Analytical Processing)?

Medium · Databases & Query Optimization

Approach

1. Define OLTP by its workload: many short concurrent transactions that read or write a few rows by key, need ACID guarantees and low latency, and hold the current state of the business (entering or updating a claim, say).
2. Define OLAP by its workload: fewer, heavier queries that scan and aggregate large amounts of historical data for reporting and analysis, where throughput over many rows matters more than single-row latency.
3. Contrast the design choices that follow: OLTP schemas are normalized (around 3NF) with B-tree indexes for point lookups; OLAP schemas are denormalized star or snowflake models, often in columnar storage that reads only the queried columns and compresses well.
4. Explain how they connect: ETL or ELT moves data from the OLTP systems into a warehouse on a schedule or by change data capture, so analytical queries do not compete with transactions for locks and I/O.
5. Answer the partitioning part with a reason: partition large fact tables by date so queries prune to the relevant ranges and old partitions can be archived or dropped cheaply.

Follow-up

• Why not run monthly reports straight on the production OLTP database?
• Why does columnar storage make SUM over one column of a billion-row table fast?
• What problems does partitioning introduce, for example queries that do not filter on the partition key?

How do indexes impact database read and write performance, and when should you avoid creating one?

Medium · Databases & Query Optimization

Approach

1. Explain the read side: a B-tree index turns a full scan into an O(log n) seek plus a range read, and also serves ORDER BY and joins on the indexed columns; a covering index (INCLUDE columns in SQL Server or PostgreSQL) avoids the lookup back to the table.
2. Explain the write side: every INSERT, DELETE and UPDATE of an indexed column must also maintain each index, which adds I/O, page splits and lock time, and indexes cost storage and memory.
3. Know composite index rules: column order matters (the leftmost-prefix rule); put equality columns before the range column, so WHERE a = ? AND b > ? wants (a, b). In SQL Server a table has at most one clustered index, which defines the row order.
4. List when to avoid one: small tables, low-selectivity columns where most rows match, write-heavy tables with rare reads, and predicates the index cannot serve (a function wrapped around the column, LIKE '%term' with a leading wildcard).
5. Verify instead of guessing: read the execution plan (EXPLAIN or the actual plan) to confirm a seek, and drop indexes that monitoring shows are never used.

Follow-up

• The index exists but the plan shows a scan. What are the likely reasons?
• How would you load fifty million rows into an indexed table quickly?
• What is the difference between a clustered and a non-clustered index?

Write a program to reverse a string using standard iterative approaches, and then demonstrate how to achieve i

Medium · Algorithms & Data Structures

Write a program to reverse a string using standard iterative approaches, and then demonstrate how to achieve it using a lambda expression.

Approach

1. Iterative version: convert to a char[] and swap with two pointers from both ends until they meet; O(n) time and O(n) extra space because Java Strings are immutable, so a copy is unavoidable. StringBuilder.reverse() is the one-liner to mention.
2. Lambda or stream version: IntStream.range(0, n).mapToObj(i -> String.valueOf(s.charAt(n - 1 - i))).collect(Collectors.joining()) is O(n); avoid reduce("", (acc, c) -> c + acc) on a large string because each concatenation copies, making it O(n^2).
3. Handle the edge cases: null (return null or throw, and say which), empty string, a single character, and characters outside the Basic Multilingual Plane, since swapping chars splits surrogate pairs while StringBuilder.reverse() keeps them together and s.codePoints() works per code point.
4. Compare the approaches aloud: the loop is clearest and fastest, the stream version mainly shows fluency with functional syntax, and a recursive substring version is O(n^2) and can overflow the stack on long input.

Follow-up

• Reverse the order of the words in a sentence while keeping each word intact.
• Check whether a string is a palindrome without building the reversed copy.
• Why is string concatenation in a loop slow in Java, and what does the compiler do about it?

Given an array of integers, write an algorithm to find contiguous subarrays that meet a specific target sum.

Medium · Algorithms & Data Structures

Approach

1. Clarify the variant first: count the subarrays, return their index ranges, or find the longest one; and whether the array can contain negative numbers, because that decides the algorithm.
2. Brute force: fix each start index and extend a running sum to the right, O(n^2) time and O(1) space; say it out loud as the baseline.
3. All non-negative values: a sliding window that grows the right edge and shrinks the left while the sum exceeds the target gives O(n) time and O(1) space; it breaks with negatives because shrinking no longer reduces the sum.
4. General case: prefix sums with a hash map. Seed the map with {0: 1}, and at each index add map.get(prefix - target) to the count before recording the current prefix; O(n) time and O(n) space. For the longest subarray, store the first index at which each prefix occurs instead of a count.
5. Edge cases: target 0, runs of zeros (many overlapping answers), negative numbers, and overflow (use long for prefix sums). If every range must be returned, the output itself can be O(n^2).

Follow-up

• Return the length of the longest subarray that sums to the target.
• Count subarrays whose sum is divisible by k (prefix sums mod k, normalising negative remainders).
• How would you extend this to submatrices of a 2D grid?

Solve a classic string manipulation problem, such as checking for valid anagrams or finding the longest palind

Medium · Algorithms & Data Structures

Solve a classic string manipulation problem, such as checking for valid anagrams or finding the longest palindrome.

Approach

1. Clarify the variant and the character set: anagram check versus longest palindromic substring, subsequence or the longest palindrome buildable from the letters; case sensitivity, whitespace and whether input is lowercase ASCII or full Unicode.
2. Valid anagram: return false if lengths differ, then count with an int[26] (increment for one string, decrement for the other, all zeros at the end) for O(n) time and O(1) space, or a HashMap for Unicode; sorting both is the O(n log n) alternative.
3. Longest palindromic substring: expand around each of the 2n - 1 centres (single characters and gaps for even lengths), O(n^2) time and O(1) space; the DP table is also O(n^2) time but O(n^2) space, and Manacher's algorithm reaches O(n).
4. Longest palindrome buildable from the letters: add the even part of every character count, then add 1 if any count is odd for the centre; O(n).
5. Test on edge cases aloud: empty string, one character, all identical characters and an even-length palindrome such as abba.

Follow-up

• Group a list of words into anagram groups (key by sorted word or by a character-count signature).
• Find every starting index where an anagram of a pattern occurs in a text (fixed-size sliding window).
• How does the problem change for the longest palindromic subsequence?

Explain how you would approach a dynamic programming problem using memoization or bottom-up tabulation.

Medium · Algorithms & Data Structures

Approach

1. Check the two conditions first: optimal substructure (the answer is built from answers to smaller instances) and overlapping subproblems (the plain recursion recomputes the same states).
2. Define the state precisely, write the recurrence and base cases, then the evaluation order; e.g. for minimum coins, dp[a] = 1 + min(dp[a - c]) over coins c <= a, with dp[0] = 0.
3. Memoization (top-down): keep the natural recursion and cache results by state; it computes only reachable states but uses recursion depth, which can throw StackOverflowError in Java on large inputs.
4. Tabulation (bottom-up): fill the table in dependency order with loops; no recursion, and it allows space optimisation such as keeping only the previous row, or a 1D array iterated from high capacity to low for 0/1 knapsack.
5. State complexity as number of states times the cost of each transition (coin change is O(amount x coins)), and reconstruct the actual solution by storing the choice made at each state.

Follow-up

• Convert your memoized solution into a bottom-up table and reduce its memory.
• How would you return the chosen items, not just the optimal value?
• How do you tell whether a problem needs DP or whether a greedy choice is enough?

How do you measure the time complexity (Big O notation) of a custom sorting or searching algorithm?

Medium · Algorithms & Data Structures

Approach

1. Pick the input-size variable, count the dominant operation as a function of it, then drop constants and lower-order terms: sequential blocks add, nested loops multiply, and a loop that halves its range runs O(log n) times.
2. For recursion, write the recurrence: binary search is T(n) = T(n/2) + O(1), giving O(log n); merge sort is T(n) = 2T(n/2) + O(n), giving O(n log n) by the master theorem.
3. Separate best, average and worst case with examples: quicksort averages O(n log n) but degrades to O(n^2) with consistently bad pivots, while insertion sort is O(n) on nearly sorted input.
4. Count space too, including the recursion stack, and mention amortised cost (ArrayList.add is amortised O(1) despite occasional O(n) resizes) and the Omega(n log n) lower bound for comparison sorts that counting and radix sort avoid.
5. Confirm empirically: time the code while doubling n; roughly double time suggests linear, roughly four times suggests quadratic.

Follow-up

• What is the complexity of naive recursive Fibonacci, and how does memoization change it?
• Why does Java sort objects with a stable algorithm (TimSort) while primitives use dual-pivot quicksort?
• When can an O(n^2) algorithm beat an O(n log n) one in practice?

Write a SQL query using joins and subqueries to retrieve specific aggregated data from multiple tables.

Medium · Databases & Query Optimization

Approach

1. Fix the output grain before writing anything (one row per provider per month, say), then join outward from the table at that grain and GROUP BY exactly the grain columns.
2. Guard against fan-out: when joining two one-to-many tables to the same parent, sums inflate, so pre-aggregate each child in a subquery or CTE and join the aggregates on the key.
3. Use WHERE to filter rows before grouping and HAVING to filter groups after; for comparisons against an aggregate (totals above the overall average) use a scalar subquery or a CTE that computes the benchmark once.
4. Handle non-matching rows: LEFT JOIN plus COALESCE to keep parents with no children, and remember that a WHERE condition on the right table turns the LEFT JOIN back into an inner join, so move it into the ON clause; NOT IN against a subquery that returns a NULL yields no rows, so prefer NOT EXISTS.
5. Close with performance: index the join and filter columns, and know that a correlated subquery may run per outer row unless the optimizer rewrites it as a join.

Follow-up

• Return the second-highest total without LIMIT or TOP, and say how ties are handled (MAX with a subquery versus DENSE_RANK).
• Rewrite your correlated subquery as a join or window function and compare the two.
• How does your query change if a parent can have zero child rows?

Explain the concept of database normalization versus denormalization and the trade-offs involved in each appro

Medium · Databases & Query Optimization

Explain the concept of database normalization versus denormalization and the trade-offs involved in each approach.

Approach

1. Define normalization as removing redundancy by splitting data so each fact lives once: 1NF atomic values, 2NF no attribute depending on part of a composite key, 3NF no attribute depending on another non-key attribute (BCNF tightens this to every determinant being a key).
2. Name the anomalies it prevents with an example: if a patient's address is copied onto every claim row, an address change must update many rows (update anomaly), and deleting the last claim loses the address (delete anomaly).
3. Define denormalization as deliberately duplicating or pre-joining data to make reads cheaper: fewer joins, faster reporting queries, which is why star schemas in warehouses are denormalized.
4. Weigh the trade-offs: normalized schemas favour write integrity and OLTP workloads; denormalized ones favour read speed but make you own consistency through triggers, application code or ETL, and cost storage.
5. Offer the middle ground: keep the source of truth normalized and add materialized or indexed views or summary tables refreshed on a schedule for the hot read paths.

Follow-up

• Give a table that is in 3NF but not in BCNF.
• If you denormalize a customer name onto orders, how do you keep it correct when the name changes?
• When does a join-heavy normalized query become a real problem, and how would you measure it?

Explain the core principles of Object-Oriented Programming (OOP) and how you apply them in real-world software

Medium · Core Java & Object-Oriented Programming

Explain the core principles of Object-Oriented Programming (OOP) and how you apply them in real-world software design.

Approach

1. Name the four principles and give each a one-line mechanism: encapsulation (private state behind methods that enforce invariants), abstraction (callers depend on an interface, not the implementation), inheritance (an is-a relationship that reuses and specialises behaviour), polymorphism (one call site, behaviour chosen by the runtime type).
2. Split polymorphism precisely: overloading is resolved at compile time from the argument types, overriding is resolved at runtime by dynamic dispatch on the object's actual class.
3. Tie each principle to code you wrote, e.g. a PaymentRule interface with several implementations picked by a factory, so adding a rule means adding a class rather than editing an if/else chain (open/closed).
4. Show judgement on inheritance: prefer composition when the subclass would break the parent's contract (Liskov substitution), and keep hierarchies shallow because a base-class change ripples into every subclass.
5. Mention the SOLID principles briefly as the design rules that follow from these four, without reciting them as a list with no example.

Follow-up

• Since Java 8 interfaces can have default methods: when would you still choose an abstract class?
• Give an example where inheritance made a codebase harder to change, and how composition would fix it.
• Can a static method be overridden in Java, and what happens if a subclass declares one with the same signature?

What are the key features introduced in Java 8, and how do lambda functions and streams improve code efficienc

Medium · Core Java & Object-Oriented Programming

What are the key features introduced in Java 8, and how do lambda functions and streams improve code efficiency?

Approach

1. List the main additions: lambda expressions, functional interfaces (Function, Predicate, Supplier, Consumer, @FunctionalInterface), method references, the Stream API, Optional, default and static interface methods, the java.time API and CompletableFuture.
2. Explain streams as a pipeline: lazy intermediate operations (filter, map, sorted) do nothing until a terminal operation (collect, reduce, forEach) runs; some terminals short-circuit (findFirst, anyMatch), and a stream can be consumed only once.
3. Be honest about "efficiency": streams mainly make code shorter and more declarative; they are not automatically faster than a loop, and boxing in Stream<Integer> costs more than IntStream/mapToInt.
4. Cover parallelStream: it splits work on the common ForkJoinPool, so it helps only for large, CPU-bound, stateless work and can hurt with small inputs, blocking I/O or shared mutable state.
5. Show a concrete pipeline, e.g. filtering a list of claims by status, grouping with Collectors.groupingBy and summing amounts with Collectors.summingDouble, then say what the equivalent loop would look like.

Follow-up

• What is the difference between map and flatMap, with an example of each?
• Why can a lambda only capture local variables that are effectively final?
• When would you avoid parallelStream in a web service?

How does parameter passing work in Java for primitive types versus wrapper classes and objects?

Medium · Core Java & Object-Oriented Programming

Approach

1. State the rule first: Java is always pass-by-value. For a primitive the value itself is copied; for an object the value copied is the reference, so caller and callee point at the same object.
2. Show the consequence: mutating the object through the parameter (list.add, setName) is visible to the caller, but reassigning the parameter to a new object is not, which is why a swap(a, b) method cannot swap the caller's variables.
3. Wrapper classes such as Integer and String are immutable, so count++ inside a method unboxes, adds and boxes a new Integer; the caller's variable still points at the old value.
4. Name the wrapper traps: == compares references, and Integer.valueOf caches -128 to 127, so two boxed 127s compare equal with == while two boxed 128s normally do not; unboxing a null Integer throws NullPointerException.
5. Mention where the values live: primitives and references are stack slots in the method frame, objects live on the heap, and that is why the copy is cheap regardless of object size.

Follow-up

• Write a method that tries to swap two Integer arguments and explain the output.
• Why does Integer a = 128, b = 128; a == b usually print false while 127 prints true?
• How would you let a method return two updated values to the caller?

What are the lifecycle phases and execution steps of a Spring Batch job?

Medium · Core Java & Object-Oriented Programming

Approach

1. Name the domain objects: a Job is a sequence of Steps; launching a Job with a set of JobParameters identifies a JobInstance, and each attempt to run it is a JobExecution with one StepExecution per step, all persisted by the JobRepository in the BATCH_ metadata tables.
2. Walk the run: JobLauncher.run(job, params) creates the JobExecution, beforeJob listeners fire, each step executes in order (or by a flow with conditional transitions on ExitStatus), afterJob listeners fire, and the final BatchStatus (COMPLETED, FAILED, STOPPED and so on) is recorded.
3. Explain a chunk-oriented step: ItemReader reads items one at a time, ItemProcessor transforms or filters them (returning null drops an item), and ItemWriter writes the whole chunk; each chunk commits in its own transaction at the configured chunk size. A Tasklet step is the alternative for single actions such as cleaning a directory.
4. Cover restart: reader position is saved in the step's ExecutionContext at every commit, so a FAILED instance relaunched with the same identifying parameters resumes from the last committed chunk; a COMPLETED instance with the same parameters cannot be run again.
5. Add fault tolerance and scale: faultTolerant() with skip and retry policies for bad records or transient errors, and multi-threaded steps, partitioning or remote chunking when one thread is too slow.

Follow-up

• A job fails on chunk 500 of 1,000. What happens when it is restarted, and what must the writer guarantee?
• When would you skip a record versus retry it?
• How would you scale a step that reads ten million rows from one table?

Explain the foundational architecture of Spring Boot and how dependency injection functions under the hood.

Medium · Core Java & Object-Oriented Programming

Approach

1. Unpack @SpringBootApplication: it combines @SpringBootConfiguration (a @Configuration), @EnableAutoConfiguration and @ComponentScan of the class's package and below.
2. Explain auto-configuration: Boot loads candidate configuration classes (listed in META-INF/spring/...AutoConfiguration.imports since 2.7, spring.factories before that) and each applies only when its conditions hold, such as @ConditionalOnClass or @ConditionalOnMissingBean, which is why defining your own bean overrides the default. Starters bring the dependencies and an embedded server such as Tomcat.
3. Describe DI under the hood: the ApplicationContext registers bean definitions, instantiates singletons at startup, resolves each dependency by type (with @Qualifier or @Primary to break ties), and injects through constructors, setters or fields; constructor injection keeps dependencies final and testable.
4. Walk the bean lifecycle: instantiate, inject properties, Aware callbacks, BeanPostProcessor before-init, @PostConstruct or afterPropertiesSet, BeanPostProcessor after-init (where AOP proxies for @Transactional or @Async are created), and @PreDestroy on shutdown.
5. Name the proxy consequence: a @Transactional method called from another method of the same class bypasses the proxy, so no transaction starts; mention bean scopes (singleton by default, prototype, request, session).

Follow-up

• Why does @Transactional not apply when a bean calls its own method, and how do you fix it?
• How do you replace one auto-configured bean, say a DataSource, without disabling the rest?
• What happens with a circular dependency between two beans that use constructor injection?

What is a Data Mart, and how does it fit into enterprise data warehousing architecture?

Medium · Databases & Query Optimization

Approach

1. Define it: a data mart is a subject-oriented subset of warehouse data shaped for one business area or team (finance, claims operations), usually modelled as a star schema of facts and dimensions.
2. Place it in the architecture: sources feed staging, staging feeds the enterprise warehouse, and marts sit between the warehouse and the BI or reporting tools that a department queries.
3. Contrast the build styles: dependent marts are fed from the central warehouse (Inmon, top-down), independent marts load straight from sources and risk two teams reporting different numbers, and Kimball's bus architecture builds marts that share conformed dimensions.
4. Give the trade-offs: smaller, simpler models answer a team's queries faster and allow tighter access control, at the cost of duplicated data, more ETL jobs to maintain and definitions that can drift apart.

Follow-up

• What is a conformed dimension, and what goes wrong without one?
• Star schema versus snowflake: which would you choose for a mart and why?
• How would you track a provider whose address changes over time (slowly changing dimension type 2)?

How do you implement Cross-Site Scripting (XSS) prevention in a web application architecture?

Medium · System Design & Application Security

Approach

1. Name the three types: stored XSS (payload saved and served to other users), reflected XSS (payload echoed from the request) and DOM-based XSS (client-side script writes untrusted data into the page).
2. Make contextual output encoding the primary defence: encode for the exact context (HTML body, attribute, JavaScript, URL) and rely on auto-escaping templates, e.g. Thymeleaf th:text rather than th:utext, and Angular interpolation, which escapes by default.
3. In Angular, [innerHTML] bindings go through the built-in sanitizer, while bypassSecurityTrustHtml and direct DOM access (ElementRef.nativeElement.innerHTML) skip it; for rich text that must allow HTML, sanitize with an allowlist library such as the OWASP Java HTML Sanitizer or DOMPurify.
4. Add defence in depth: a Content-Security-Policy that forbids inline script (nonces or hashes instead of 'unsafe-inline'), HttpOnly and Secure session cookies so injected script cannot read them, and input validation for type and length, which reduces risk but does not replace output encoding.
5. Avoid the dangerous sinks in your own code: eval, document.write, innerHTML with untrusted strings, and javascript: URLs in user-supplied links.

Follow-up

• Why is validating input on the way in not enough to stop XSS?
• How does a CSP nonce work, and what breaks when you turn CSP on for an older app?
• Does an HttpOnly cookie prevent XSS? What does it actually protect?

Walk through the architecture of a real-world system, such as a hotel reservation system or automated workflow

Medium · System Design & Application Security

Walk through the architecture of a real-world system, such as a hotel reservation system or automated workflow engine.

Approach

1. Pin the requirements before drawing boxes: search availability by location and dates, hold a room, book, cancel and pay; then state that bookings need strong consistency while search can tolerate slightly stale data.
2. Model inventory per room type per night (room_type_id, date, total, reserved) plus a reservations table with a status (HELD, CONFIRMED, CANCELLED, EXPIRED), so a multi-night stay is a set of inventory rows.
3. Prevent double booking inside one transaction: UPDATE inventory SET reserved = reserved + 1 WHERE room_type_id = ? AND date BETWEEN ? AND ? AND reserved < total, and commit only if the updated row count equals the number of nights, otherwise roll back; a version column for optimistic locking is the alternative.
4. Make booking retry-safe with an idempotency key from the client, expire unpaid holds with a scheduled job, and route search to a cache or read replica while booking always writes to the primary.
5. If the workflow-engine variant comes up instead: persist each workflow instance and step state, run steps from a queue with retries and backoff, make every step idempotent, and record a compensating action for steps that must be undone.

Follow-up

• Two users try to book the last room at the same moment. Walk through exactly what happens.
• Payment fails after inventory was reserved. How does the system recover?
• How would you support deliberate overbooking for a hotel that wants it?

How do you optimize web application performance when handling high-throughput user traffic?

Medium · System Design & Application Security

Approach

1. Measure before changing anything: p50, p95 and p99 latency, throughput, error rate and saturation per tier, then profile the slowest endpoint to find whether time goes to the database, downstream calls, CPU or the client.
2. Fix the database first, since it is the usual bottleneck: add missing indexes, remove N+1 query patterns (JPA fetch joins or batch fetching), use keyset instead of OFFSET pagination on deep pages, size the connection pool (HikariCP) to what the database can serve, and move reporting reads to a replica.
3. Cache by layer: CDN and HTTP cache headers for static assets, an application cache such as Redis with cache-aside and explicit TTLs for hot reads, and a stated invalidation rule for each cached value.
4. Scale and protect the app tier: keep servers stateless behind a load balancer so you can add instances, move slow work (exports, emails, file processing) to a queue with workers, and add rate limiting and timeouts so one slow dependency cannot exhaust threads.
5. Do not forget the front end: compress responses, shrink and lazy-load bundles (Angular lazy-loaded modules) and cut the number of API calls per page.

Follow-up

• p99 latency doubled while p50 stayed flat. Where do you look first?
• What is a cache stampede and how do you prevent one?
• How do you decide the size of the database connection pool?

What considerations are required when integrating third-party APIs and managing build/deployment pipelines?

Medium · System Design & Application Security

Approach

1. Treat the third-party API as unreliable: set explicit connect and read timeouts, retry only idempotent calls (or calls carrying an idempotency key) with exponential backoff and jitter, honour 429 and Retry-After, and add a circuit breaker (e.g. Resilience4j) so an outage fails fast.
2. Isolate it behind an adapter that maps the vendor's model and errors to your own, so a vendor version change touches one class; pin the API version and add contract tests against recorded responses (WireMock) plus a run against the vendor sandbox.
3. Handle secrets and data carefully: keep credentials in a secrets manager or CI secret store, never in the repository, support key rotation without a redeploy, and never log tokens or personal data in request or response logs.
4. For the pipeline: build once with Maven or Gradle, run unit and integration tests and static analysis on every commit, produce one versioned immutable artifact, and promote that same artifact through test, staging and production with environment-specific configuration.
5. Make deploys reversible: backward-compatible database migrations (Flyway or Liquibase, expand then contract), rolling or blue-green releases with health checks, and a one-step rollback.

Follow-up

• The vendor is down for an hour. What do your users see, and what happens to requests made during that hour?
• How do you rotate the vendor's API key without downtime?
• A schema migration must drop a column that the running version still reads. How do you sequence the release?

How do you structure logging, error handling, and transaction boundaries across microservices or enterprise mo

Medium · System Design & Application Security

How do you structure logging, error handling, and transaction boundaries across microservices or enterprise modules?

Approach

1. Logging: write structured (JSON) logs with a correlation or trace ID generated at the edge, propagated in headers (W3C traceparent) and put in the SLF4J MDC so every line from one request can be joined across services; use levels consistently and keep personal data and secrets out of logs.
2. Error handling: one global handler per service (@ControllerAdvice in Spring) that maps exceptions to a consistent error body and status code, separates client errors from retryable server errors, logs the stack trace once at the boundary and never swallows exceptions.
3. Transaction boundaries inside a service: put @Transactional on service-layer methods that form one unit of work; by default Spring rolls back only on unchecked exceptions (RuntimeException and Error), so checked exceptions need rollbackFor.
4. Across services: avoid distributed two-phase commit; use a saga of local transactions with compensating actions, publish events with the transactional outbox pattern so the database write and the event cannot diverge, and make consumers idempotent because delivery is at-least-once.
5. Close the loop with observability: metrics and distributed tracing (OpenTelemetry) next to the logs, and alerts on error rate and latency rather than on individual log lines.

Follow-up

• A checked exception was thrown inside a @Transactional method and the data was still committed. Why?
• Why is publishing an event right after commit unsafe, and how does the outbox pattern fix it?
• How would you trace one failing request through three services?

Read latency spikes on a sixty-second sawtooth

Medium · cache stampede · single-flight · ttl

The cached listing read path serves about 14k reads/second at an 85% hit rate. p99 sits at 35 ms for 57 seconds, jumps to 900 ms for 3, and repeats. During each spike the primary shows several hundred identical listing queries starting within the same millisecond, all carrying one large tenant's id. Cache entries use a 60-second TTL. Give the mechanism, the ordered checks, the fix, and the correctness hazard your fix must not introduce.

Approach

1. Match the period to a configured number before theorising about load. A spike every 60 seconds against a 60-second TTL is an entry expiring, and you confirm it by correlating spike timestamps with the entry's write time rather than with the traffic curve. If the period had matched a cron or a GC interval instead, this is a different investigation.
2. Establish the concurrency of the miss. Several hundred identical queries in one millisecond means the miss path has no coalescing: every request that arrives between expiry and repopulation recomputes. The herd size is that key's arrival rate times its recompute time, so at 1.2k reads/second for the hot key and a 250 ms recompute you expect about 300 concurrent misses, which matches what is observed.
3. Add single-flight on the miss path so one caller per key recomputes under a short-lived lock while the rest wait for its result. Prefer stale-while-revalidate where the read tolerates it: return the expired value immediately and refresh asynchronously, which removes the latency spike rather than serialising it into a queue of waiters.
4. De-synchronise the keys. Write TTLs with jitter, for example 60 seconds plus or minus 10%, so a deploy or a mass invalidation does not align every key on the same second and turn a per-key herd into a fleet-wide one.

Follow-up

• The same sawtooth appears on a key that is invalidated on write rather than expired. Is that the same bug?
• How does your answer change if the recompute takes 4 seconds instead of 250 ms?

Suggested practice checklist

A seven-day plan that follows the reported question groups: Java and OOP, Spring, SQL and warehousing, algorithms, design and security, then the project and HR conversations. Each day ends with something concrete you can reuse.

Day 1 — Map the five rounds and audit your resume

• Write the reported sequence (Online Screening Test, Recruiter Phone Screen, Technical Interview Rounds, Managerial/Business Analytics Round, HR and Leadership Round) and mark which your track is likely to include.
• Choose your primary language from Java, C#/.NET or Python, and list every technology on your resume with one sentence on what you built with it.
• Take one timed set of aptitude and logic puzzles to see how rusty you are.

Deliverable: A one-page loop map, a resume technology inventory with defensible claims only, and a score from the puzzle set.

Day 2 — Core Java and OOP

• Explain each OOP principle aloud with a concrete example from code you wrote, including where inheritance went wrong and an interface helped.
• Write a Java 8 snippet that filters, maps and collects a list of objects with streams, then write the same logic as a loop and compare readability and behaviour.
• Write a small program showing parameter passing for an int, an Integer and a mutable object, with both mutation and reassignment inside the method.

Deliverable: A runnable Java file with the stream example and the parameter-passing demonstration, plus spoken answers on OOP and Java 8.

Day 3 — Spring Boot and Spring Batch mechanics

• Build a minimal Spring Boot app with constructor injection, then explain component scanning, bean creation and auto-configuration.
• Build a small Spring Batch job with a chunk-oriented step (reader, processor, writer) and read the job repository tables after a successful run and after a forced failure.
• Write the lifecycle from job launch to completion and restart in your own words.

Deliverable: A working Spring Boot and Spring Batch sample plus a half-page lifecycle write-up.

Day 4 — SQL, warehousing, indexes and normalization

• Load a small claims-style schema into PostgreSQL or SQL Server and write a join-and-subquery aggregate, then the second-highest value in two ways.
• Write a one-page comparison of OLTP and OLAP, and sketch where a data mart sits between a warehouse and its reporting users.
• Time a query before and after adding an index, read the execution plan, then measure insert speed with several indexes in place.
• Normalize a flat table to third normal form and name one case where you would denormalize it.

Deliverable: A SQL file with results, the before-and-after plans and timings, the OLTP/OLAP comparison and a normalized schema.

Day 5 — Algorithms and complexity

• Reverse a string with a loop (two pointers on a char array), then with StringBuilder or a stream, and note why in-place reversal needs a mutable array.
• Solve the target-sum subarray problem with brute force, a sliding window for non-negative input and a prefix-sum hash map for general input.
• Solve an anagram check and the longest palindrome by expanding around centres, then write a dynamic programming problem both as memoization and as a table.
• Derive Big O for your own sort or search code, including best, average and worst cases.

Deliverable: A set of tested solutions in your primary language, each with time and space complexity written next to it.

Day 6 — System design, web security and performance

• Prevent XSS in a web app: contextual output encoding, a Content-Security-Policy, input validation and safe templating, and list what each layer does not cover.
• Outline a hotel reservation system (inventory, availability search, booking, double-booking prevention) and a workflow engine, naming components and data models.
• Write how you would raise throughput of a busy web application and structure logging, error handling and transaction boundaries across services.

Deliverable: Two component diagrams, an XSS checklist, a throughput and transaction-boundary list, and a written debugging sequence.

Day 7 — Project narrative, business scenarios and the HR conversation

• Write and rehearse a project walk-through for two resume projects: design, stack choices, build and deployment, one performance or security problem.
• Talk through a business-logic scenario on a claims-style table out loud, stating assumptions and edge cases.
• Prepare your career story, salary expectation and three questions for the team.

Deliverable: Two rehearsed project narratives, a scenario walk-through, a one-minute career story, and written answers to the practice behavioral prompts.

Behavioural preparation

No specific behavioral questions are reported for this loop. The managerial or business analytics round and the HR and leadership round are described as covering scenario reasoning, career background, organizational fit, salary expectations and team alignment, and technical panels are reported to ask about your projects. Rehearse these prompts with real examples.

1. Walk me through a project on your resume: the design decisions you personally made, the stack you chose, how it was built and deployed, and one performance or security problem you handled.
2. Describe a time you turned an unclear business rule into code or a query, and how you confirmed the result with a business analyst or product owner.
3. Tell me about a defect that passed review and tests but showed up in production or in a data load. How did you find it, and what changed afterwards?
4. Describe a disagreement with a QA engineer, a reviewer or a teammate about quality, scope or a deadline, and how it was settled.
5. Why this role and this team, and how does your career so far lead to it?
6. Give your salary expectation and the reasoning behind it in two sentences.

Ship under a deadline and bound the debt you chose

Medium · pagination · technical debt · tradeoffs

You have four days to ship a tenant-facing listing endpoint. The version you would defend uses keyset pagination over (tenant_id, status, updated_at DESC, resource_id DESC); the version you can finish uses LIMIT/OFFSET with no matching index. Describe a deadline call you actually made of this shape: what you shipped, what you knowingly deferred, how you bounded the damage with a mechanism rather than an intention, and the specific numeric condition that would force the follow-up. Name who you told and where you wrote it down.

Approach

1. Name the deferred failure precisely instead of calling it slow. OFFSET n makes the database produce and discard n rows, so cost grows with page depth; without an index matching the sort, every matching row is read and sorted before the limit applies; and rows inserted between two page fetches shift across the boundary so items are skipped or repeated with nothing in the response to signal it.
2. Bound the blast radius with something mechanical rather than a promise: cap maximum page depth, cap page size, restrict the endpoint to one internal caller, or keep it behind a flag. State which failure each cap removes and which it leaves standing.
3. Attach a number to the trigger and wire it to an alarm: the first tenant crossing N resources, or the endpoint's p99 crossing its share of the 400 ms budget, so the debt announces itself instead of waiting to be remembered.
4. Write it where the next engineer looks, which is the code and the ticket, not a chat message: what was deferred, why, the cap, and the trigger.

Follow-up

• At what page depth does the offset version breach your latency budget, given your page size and row counts?
• What breaks first when you switch to keyset pagination later, and what does a client holding an old page token see?

Argue against a design, lose, and commit anyway

Medium · disagreement · service boundaries · decision records

Describe a design you argued against and lost. State the failure you predicted as a named mechanism, not a feeling about complexity: two services that would need one transaction, a projection with no rebuild path, a write path with no idempotency key. Say what evidence you brought, what the decision maker weighed instead, and what you did after the decision was made: what you instrumented, what you wrote down, and whether the prediction came true. Five minutes.

Approach

1. State the prediction in falsifiable form up front: the mechanism, the condition that triggers it, and the observable outcome. A prediction that cannot be checked also cannot be credited to you later.
2. Show the evidence you had at the time and label each piece honestly as measured, analogous, or intuition. Keeping the intuition is fine; disguising it as data is the thing that erodes your standing in the next argument.
3. Represent the opposing case at full strength, including the constraint you did not control: a fixed date, a team boundary, or the fact that the decision was cheap to reverse and yours was not.
4. Make disagree-and-commit concrete. Name the artefact you left behind so the prediction could be settled without you: the alert and its threshold, the counter on the dashboard, the decision note that recorded the trade-off and the condition that would revisit it.

Follow-up

• What threshold on that alert would have proved you right, and did anyone ever look at it?
• If the same proposal arrived tomorrow with the same deadline, would you argue it the same way?

Turn a code review disagreement into a decision

Easy · code review · optimistic concurrency · communication

A colleague's change updates a row with UPDATE resource SET version = version + 1 WHERE resource_id = $1 AND version = $2 and treats an affected-row count of zero as a successful no-op. You read that as a silently lost update; they think returning 200 is friendlier to clients than returning a conflict. Describe how you have handled a review disagreement of this shape: what goes in the comment, when you leave the thread, and who decides. Then write the comment you would leave here, in under 80 words.

Approach

1. Sort the disagreement before writing anything. A silently discarded write is a correctness claim about data; the choice between 409 and 412 is taste. Only the first justifies blocking a merge, and saying which one you are doing is most of the value of the comment.
2. Make the claim reproducible in the comment itself with an interleaving rather than a principle: A reads version 7, B reads version 7, B commits version 8, A's predicate matches zero rows, A is told it succeeded and A's edit is gone.
3. Offer the alternative with its cost attached: return 409 carrying the current version and the revision that won, so the client can re-read and re-apply. Note that automatic retry is not the fix, because a retry re-reads the winner's state and reapplies an intent formed against data that no longer exists.
4. Apply an escalation rule you can state: two round trips on the thread, then a call, and the service's owner decides rather than the reviewer. A reviewer who cannot be overruled is a bottleneck with extra steps.

Follow-up

• Where would you put the test that fails if someone reintroduces the swallowed zero rowcount?
• The author says clients cannot handle a 409. How do you check whether that is true?