SweatyImposterMid-level track

Mid-level

Interviewing for a mid-level role. Expand pattern coverage, get fluent with the most common system design prompts, know the everyday tradeoffs cold, and have stories that show ownership and scope cuts.

Overall progress
0 / 192
0%

Every pattern interviewers reach for at the mid level.

Sliding Window
Maintain a window of elements over a sequence; expand/shrink to satisfy a constraint while tracking an aggregate.
Two Pointers
Two indices walk a sorted (or paired) structure from different positions to converge on a target.
Fast & Slow Pointers (Floyd's)
Two pointers move at different speeds through a linked structure to detect cycles or find midpoints.
Merge Intervals
Sort intervals by start, then sweep merging overlaps.
Cyclic Sort
Place each number at its index by swapping; O(n) sort when values are a known bounded range like 1..n.
In-Place Reversal of LinkedList
Reverse pointers segment by segment without extra space using prev/curr/next bookkeeping.
Tree BFS
Level-order traversal using a queue; emit one level at a time.
Tree DFS
Recursive or stack-based depth-first traversal; pre/in/post order.
Two Heaps
Maintain a max-heap for the lower half and a min-heap for the upper half of a stream.
Subsets (BFS-style generation)
Iteratively or recursively build all subsets/permutations/combinations by extending prior results.
Modified Binary Search
Binary search on a non-trivial space: rotated arrays, infinite arrays, the answer itself.
Top K Elements
Maintain a heap of size k to track the k largest/smallest/most-frequent elements.
K-Way Merge
Use a min-heap of k pointers (one per list) to merge k sorted sources in O(N log k).
0/1 Knapsack (DP)
Choose/skip decisions over items with capacity; tabulate optimal value for subproblems.
Monotonic Stack/Queue
Stack/deque maintained in increasing or decreasing order to answer next-greater/smaller queries.
Graph BFS/DFS
Explore a graph by levels (BFS) or branches (DFS), tracking visited nodes.
Backtracking
DFS through a decision tree, undoing choices on failure to try alternatives.

The toolbox you'll reach for in design discussions and code reviews.

Exponential Backoff + Jitter
Grow retry intervals exponentially and add randomization so clients don't synchronize their retries.
Idempotency Keys
Caller sends a unique key with each request; server dedupes on it so retries don't double-charge.
Circuit Breaker
Track failures from a dependency; once they exceed a threshold, open the circuit and fail fast for a cool-down period.
Bloom Filter
Probabilistic set membership in tiny memory. No false negatives; tunable false-positive rate.
Token Bucket
Bucket refills at rate R; each request takes one token. Allows controlled bursts up to bucket size.
Leaky Bucket
Requests enter a queue, processed at fixed rate. Smooths out bursts entirely — no spike ever reaches downstream.
Batching
Coalesce many small operations into one large one to amortize fixed per-request overhead.
Debounce
Wait until a flurry of events stops for N ms, then act once. Drops everything in between.
Throttle
Emit at most once per N ms regardless of how often it's called. Unlike debounce, never goes silent.
Snowflake IDs
64-bit unique IDs: [timestamp][machine-id][sequence]. Time-ordered, distributed, no central coordinator.
Leases + TTL
Grant time-bounded exclusive ownership. Holder must renew before expiry; if it dies, the lease auto-releases.
Heartbeats
Periodic 'I'm alive' signal. Absence of N consecutive heartbeats means the peer is presumed dead.
Optimistic Concurrency / CAS
Read a value with its version, send update conditional on version unchanged. Server rejects if someone else wrote in the meantime.

JWT storage, CSRF defenses, IDOR/BOLA, secrets management, OAuth flows.

Practice security
Password storage
You are shipping a brand-new web app and need to pick how to store user passwords. There is no legacy hash format to be compatible with and your servers have modern CPUs. Which approach is the right default in 2025?
JWT
A React SPA talks to a REST (Representational State Transfer) API on the same parent domain. You need to persist the user's session token across page reloads. Where should the access token live?
CSRF
Your app authenticates users with a session cookie and exposes POST /transfer to move money. A user reports that visiting a sketchy site while logged in caused a transfer. You confirm the cookie is Secure and httpOnly. What is the minimum fix?
SQL injection
A search endpoint receives a free-text query and your ORM exposes a raw() escape hatch. A teammate writes db.raw("SELECT * FROM items WHERE name LIKE '%" + q + "%'"). What is the correct fix?
Authorization (BOLA/IDOR)
GET /api/invoices/{id} returns an invoice. The handler looks up the invoice by id and returns it. Audit logs show user 42 successfully fetched invoice 9001, which belongs to user 77. What is missing?
Secrets management
Your service runs on an EC2 instance and needs to read objects from S3. A junior dev plans to bake AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY into the container image as environment variables. What should you do instead?
Logging & PII
A teammate adds middleware that logs every request and response body to make debugging easier in production. Endpoints include /login, /payments, and /users/me. What is your review feedback?
Input validation
An /upload endpoint accepts a file and a JSON metadata blob. The metadata includes a filename, size, and mime_type that the client computes. The server stores the file under filename and trusts mime_type for Content-Type on later downloads. What is the safer design?
Session management
After a user changes their password from the settings page, what should happen to their other active sessions on other devices?

Concurrency, distributed, database internals, networking — the production toolbox every mid-level engineer is expected to recognize.

Open Systems quiz
Read-Write Lock
Allow many concurrent readers OR one exclusive writer, but never both — boosts throughput on read-heavy state.
Condition Variable / Monitor
Wait on a predicate while holding a lock; another thread signals when the predicate may now be true, atomically releasing and re-acquiring the lock.
Thread Pool / Executor
Pre-allocated worker threads pull tasks from a shared queue, so you pay thread-creation cost once and bound concurrency.
Producer-Consumer with Bounded Queue
Producers offer work to a fixed-capacity queue; consumers drain it. Bound provides natural backpressure when consumers fall behind.
Thread-Local Storage
Per-thread variable: every thread sees its own copy, eliminating sharing and therefore eliminating the need to synchronize.
Futures / async-await
Represent an in-flight computation as a value you can compose, chain, and await — no manual callback threading.
Raft Consensus
Leader-based consensus protocol: one elected leader replicates an append-only log to followers; entries commit once a majority quorum acknowledges.
Quorum Reads/Writes (R + W > N)
Tune per-operation consistency by requiring W replicas to ack writes and R replicas to answer reads. If R + W > N, every read overlaps the latest write.
Gossip Protocol
Each node periodically picks a random peer and exchanges state. Information spreads epidemically in O(log n) rounds with bounded per-node bandwidth.
Leader Election via Leases
A would-be leader acquires a time-bounded lease in a consensus store; it must renew before expiry or lose leadership. Bounds split-brain to one lease window.
Two-Phase Commit (2PC)
Coordinator asks all participants to PREPARE; if all vote yes it sends COMMIT, otherwise ABORT. Blocks if the coordinator crashes between phases.
LSM Tree + Compaction
Buffer writes in an in-memory memtable, flush sorted runs (SSTables) to disk, then merge them in background compaction passes.
Covering Index (Index-Only Scan)
Add the columns you SELECT into the index so the query plan never visits the heap. The index alone covers the read.
Multi-Version Concurrency Control (MVCC)
Each write produces a new row version tagged with the transaction id; readers see the version visible to their snapshot. Readers never block writers, writers never block readers.
Write-Ahead Log (WAL)
Append every change to a sequential log and fsync before touching the data pages. On crash, replay the log to recover committed work.
Materialized View
Persist the result of a query as a real table; refresh on schedule, on demand, or incrementally as base tables change.
TLS Handshake (1.2 vs 1.3)
TLS (Transport Layer Security) 1.2 needs 2 round trips before app data flows. TLS 1.3 collapses that to 1 round trip (1-RTT) for new sessions and 0 round trips (0-RTT) for resumed ones using pre-shared keys (PSK).
HTTP/2 Multiplexing
Many concurrent streams over a single TCP (Transmission Control Protocol) connection, each with its own flow control. Fixes HTTP (Hypertext Transfer Protocol) 1.1 head-of-line blocking at the HTTP layer but not at TCP.
Connection Pooling and Keepalive
Reuse TCP (Transmission Control Protocol) and TLS (Transport Layer Security) connections across requests instead of opening a new one each time. Avoids the 3-way handshake plus TLS handshake on every call.
TCP_NODELAY (disable Nagle)
Nagle's algorithm coalesces small writes to reduce tinygrams. Combined with delayed-ACK on the receiver, it can stall small request/response pairs for ~40ms waiting for the next ack.

The systems-level A-vs-B questions that show up nearly every mid-level loop.

Thread-per-request with a large pool vs Async / event-loop with futures
A service makes ~5 downstream HTTP (Hypertext Transfer Protocol) calls per request, 80% of request t
One global lock around the whole map vs Striped locks (e.g., 16 segments, each with its own lock)
You're locking a 1M-entry in-memory map. One big lock is simple but throughput is poor under writes.
Pessimistic: take a row lock for the duration of the edit vs Optimistic: read with version, update conditional on version
Multiple users edit the same record but conflicts are rare. You're choosing the concurrency-control
Synchronous I/O with a large thread pool vs Asynchronous non-blocking I/O with futures/await
Your service issues many DB and HTTP (Hypertext Transfer Protocol) calls per request. You're choosin
Strong consistency (single-region Raft) vs Eventual consistency (multi-master + CRDT merge)
Shopping cart service for a global e-commerce site. Users add items from mobile, web, and tablet; so
Synchronous replication (commit waits for standby ack) vs Asynchronous replication (commit on primary, replicate after)
Primary Postgres in us-east-1 replicating to a us-west-2 standby for DR. Writes are user-facing chec
Two-phase commit across all 5 services vs Saga with compensating actions
Order workflow spans 5 microservices (cart, payment, inventory, shipping, notifications), each with
B-tree / B+tree storage (Postgres, InnoDB style) vs LSM tree (RocksDB, Cassandra style)
Storage engine for a write-heavy time-series ingest service. Reads are mostly recent data; durabilit
READ COMMITTED isolation vs SERIALIZABLE isolation
OLTP service mostly does single-row updates with the occasional multi-row consistency check (e.g., '
Run analytics on the OLTP database directly vs Move analytics to a separate OLAP store (columnar warehouse, replica with column store extension, Snowflake/BigQuery)
A reporting team wants to run hour-long aggregate queries against the same Postgres serving your che
synchronous_commit = on (fsync before ack) vs synchronous_commit = off (ack before fsync)
Postgres `synchronous_commit`: leave it ON (fsync WAL before ack) or set it OFF (ack early, fsync la
Thread-per-connection vs Event loop on epoll / kqueue
Server expected to hold 100k concurrent long-lived connections. Thread-per-connection or event loop?
Separate process vs Separate thread in the same process
Running untrusted plugin code or risky native libraries. Process or thread?
Round robin vs Least connections
Load balancing across backends where request durations vary wildly (some 1ms, some 5s). Round robin

All complexity classes, with the average-vs-worst nuance for hashmaps, quicksort, etc.

Open Big O Quiz