Candidate profile: Computer Science undergraduate, graduating July
2026
Target: Medium-to-hard fresher / entry-level software engineering and
SecOps interviews
EM easy-medium foundation questions in
each topic, then move to the original medium-to-hard Q
set.Python; JavaScript; TypeScript; Rust; React; Vite; Tailwind CSS; Flask; Tauri; n8n; NocoDB; webhooks; APIs; Generative AI; Perplexity AI; OpenAI text and image generation; RAG; Ollama; FAISS; Llama 3 8B; React Three Fiber / Drei; cloud computing; GCP SecOps; Chronicle SIEM; Unified Data Model (UDM); YARA-L; security telemetry; Looker; BigQuery; SOAR; threat intelligence; AWS; OCI; Oracle C2M; OOP; data structures; web technologies; gravitational attraction; collision physics; simulation presets.
REST and HTTP; asynchronous programming; type systems; memory safety; component state; frontend performance; accessibility; backend validation; authentication and authorization; inter-process communication; desktop security; file-system operations; downloads and archive extraction; transactional installation and rollback; cross-platform packaging; cloud IAM; shared-responsibility model; observability; log schemas; parsing and normalization; detection tuning; false-positive control; incident response; enrichment; rate limits and retries; SQL; data partitioning and clustering; dashboard design; workflow idempotency; prompt engineering; grounding and hallucination control; embeddings; vector similarity; chunking; retrieval evaluation; local model inference; scene graphs; render loops; numerical integration; collision detection; persistence and schema migration; scalability; release engineering; testing; CI/CD; Git; privacy and secrets management; product metrics and community feedback.
Easy-medium foundation questions
A list is mutable, so elements can be added, removed, or replaced. A tuple is immutable and can be used as a dictionary key when all of its elements are hashable. Use a tuple for a fixed record and a list for a collection that changes.
A dictionary stores key-value pairs and normally provides average O(1) lookup, insertion, and deletion by key. Its keys must be hashable, while its values can be of any type.
A list comprehension creates a list from an iterable using a compact
expression, with an optional filter. For example,
[x * x for x in numbers if x > 0] produces the squares
of positive values. A normal loop is clearer when the transformation has
several steps or side effects.
== and is?== tests whether two values are equal, while
is tests whether two references point to the same object.
Use is for singleton checks such as
value is None, not for comparing strings or numbers.
*args and **kwargs do in a function
definition?*args collects extra positional arguments into a tuple,
and **kwargs collects extra named arguments into a
dictionary. They are useful for flexible wrappers, but explicit
parameters are usually easier to understand and validate.
A virtual environment gives a project an isolated Python interpreter context and package installation directory. It prevents dependencies from different projects from interfering with one another and supports reproducible setup when paired with a locked dependency file.
if __name__ == "__main__"?Code inside that block runs when the file is executed directly, but not when it is imported as a module. This allows a file to expose reusable functions while also providing a command-line entry point or demonstration.
An instance method receives self and works with one
object. A class method receives cls and is often used for
alternative constructors, while a static method receives neither
automatically and is simply namespaced inside the class.
The form sequence[start:stop:step] selects items from
start up to, but not including, stop. Omitted
bounds use sensible defaults, and a negative step can reverse a
sequence. Normal list slicing creates a shallow copy.
A set stores unique hashable values and supports fast average membership tests. It is useful for removing duplicates and for union, intersection, and difference operations, but it does not support indexing.
Default arguments are evaluated once when the function is defined,
not on every call. A list or dictionary default is therefore shared
across calls. Use None as the default and create the
mutable object inside the function.
In CPython, the Global Interpreter Lock permits only one thread to execute Python bytecode at a time. Threads still help with I/O-bound work because the GIL is released during many blocking I/O operations. For CPU-bound Python code, multiprocessing, native extensions, or external workers are usually better.
An iterator implements __iter__() and
__next__(). A generator is a convenient iterator created by
a function containing yield; it suspends and resumes local
state automatically. Both support lazy processing, which is useful for
large telemetry streams.
Read it line by line or in bounded chunks, parse each record, and
emit or batch normalized events incrementally. Avoid read()
on the whole file, cap batch sizes, handle malformed records separately,
and apply backpressure if the destination is slower than the source.
A shallow copy creates a new outer container but keeps references to nested objects. A deep copy recursively copies nested objects. Deep copying can be expensive and may be inappropriate for shared resources, so immutable data or explicit reconstruction is often clearer.
Exceptions separate the normal path from exceptional failures and
carry type and stack information. Catch only errors you can handle, add
context, and avoid a broad except Exception that silently
hides defects. At API boundaries, translate internal exceptions into
stable external error responses.
A decorator wraps a callable to add behavior without changing its core implementation. It can consistently add retries, timing, authentication, tracing, or rate-limit handling to integration functions. The decorator must preserve metadata and should not retry non-transient failures.
A context manager guarantees setup and cleanup around a block through
__enter__ and __exit__, usually used via
with. It is ideal for files, database transactions, locks,
and temporary resources because cleanup occurs even if an exception is
raised.
Use explicit timeouts, authentication kept outside source code,
schema validation, pagination, bounded retries with exponential backoff
and jitter, and respect Retry-After. Cache suitable
results, make writes idempotent, log correlation IDs without secrets,
and expose useful metrics.
Use table-driven unit tests for valid, missing, malformed, boundary, and unknown fields. Add golden fixtures for representative vendor logs, property-based tests for parser invariants, and integration tests for the target schema. Assert both mapped values and deliberate non-mappings.
Easy-medium foundation questions
The primitive types are string, number, bigint, boolean, undefined, symbol, and null. Primitives are immutable values; objects, arrays, and functions are reference types.
null and
undefined?undefined commonly means a value has not been assigned
or a property is missing. null is an explicit value
typically used to represent an intentional absence. A codebase should
choose and document consistent conventions for both.
== and === in
JavaScript?== may convert operands before comparing them, which can
produce surprising results. === compares without type
coercion and is the normal choice unless coercive comparison is
deliberately required.
Destructuring extracts values from arrays or properties from objects
into variables. For example, const { id, name } = user
reads two properties and makes data dependencies visible.
Spread expands an iterable or object into another expression, such as
{ ...defaults, ...options }. Rest gathers remaining values,
such as function sum(...values). Both use ...,
but their meaning depends on position.
Optional chaining, written ?., stops property access or
a call when the value to its left is null or
undefined. It returns undefined instead of
throwing, but it should not hide a missing value that the application
considers an error.
An interface names the required shape of an object and can be extended or implemented by classes. It exists only during type checking, so runtime input still needs validation.
A union such as string | number says a value may be one
of several types. Code must narrow the value before using operations
that are valid for only one member of the union.
map, filter, and reduce
differ?map transforms every array element, filter
retains elements that pass a test, and reduce combines
elements into one accumulated result. They return new results and should
generally not be used just to perform side effects.
Synchronous code completes one operation before moving to the next. Asynchronous code allows other work to continue while an operation such as a network request is pending, with its eventual result represented by a promise or callback.
Synchronous code runs on the call stack. Completed asynchronous operations enqueue tasks; promise callbacks use the microtask queue, which is drained before the next task such as a timer callback. Long synchronous work still blocks rendering and event handling.
var, let, and
const?var is function-scoped and hoisted with an initial value
of undefined; it can also be redeclared. let
and const are block-scoped and remain in the temporal dead
zone until initialized. const prevents reassignment of the
binding, not mutation of an object it references.
TypeScript catches many invalid operations and documents contracts at compile time, improving refactoring and editor support. Its types are erased at runtime, so external data is still untrusted. API responses, local files, and IPC payloads require runtime validation.
any,
unknown, and never.any disables type checking for a value.
unknown accepts any input but requires narrowing before
use, so it is appropriate at trust boundaries. never
represents values that cannot occur and is useful for exhaustive checks
and functions that never return.
Use a discriminated union such as
queued | downloading | extracting | installed | failed,
with state-specific fields. A switch on the discriminator can be
exhaustively checked, preventing code from reading progress or error
data in an invalid state.
TypeScript checks whether a value has the required shape rather than
requiring an explicit declared relationship. This is flexible for
composition, but two semantically different values can be structurally
compatible. Branded types can distinguish identifiers such as
ModId and UserId.
A closure retains access to variables from its lexical scope after the outer function returns. Closures are useful for encapsulation and callbacks, but stale captured state can cause bugs in asynchronous code or React effects. Correct dependencies or functional state updates avoid many such issues.
Promise.all be unsafe?It launches all supplied promises and rejects as soon as one rejects.
That can overload an API, waste work, or hide other results. Use bounded
concurrency, Promise.allSettled, cancellation, or
sequential execution when limits, partial success, or ordering
matter.
Type narrowing refines a broad type through checks such as
typeof, in, equality, discriminants, or
user-defined type guards. It lets code safely operate on unions. A type
assertion is not narrowing because it provides no runtime evidence.
Define meaningful error categories, preserve the original cause, and
catch failures at a layer that can recover or present them. Use
try/finally for cleanup, abort signals for cancellation,
and avoid unhandled promises. Translate low-level errors into stable
domain errors at boundaries.
Easy-medium foundation questions
Variables declared with let cannot be reassigned unless
they include mut. This makes changes to state explicit and
helps both the compiler and the reader reason about the program.
A variable is declared with let, may be mutable, and can
receive a value computed at runtime. A constant uses const,
requires an explicit type and a compile-time expression, and cannot be
made mutable.
A struct defines a custom data type by grouping related fields.
Methods and associated functions can be added in an impl
block, keeping data and behavior organized without requiring a class
hierarchy.
An enum defines a value that can be one of several variants, and each variant may carry different data. Pattern matching makes callers handle the variants explicitly, which is useful for states, messages, and errors.
match
work?match compares a value against patterns and evaluates
the first matching arm. Matches must be exhaustive, so every possible
case must be handled directly or by a catch-all pattern.
Cargo is Rust's build tool and package manager. It creates projects,
resolves dependencies from Cargo.toml, builds code, runs
tests, and produces documentation.
A crate is Rust's compilation and packaging unit. A binary crate produces an executable, while a library crate exposes reusable functionality; a Cargo package can contain multiple related crate targets.
Copy and Clone?Copy types are duplicated implicitly during assignment
because copying them is cheap and safe. Clone performs an
explicit duplication through .clone() and may involve
allocations or other work.
References let a function access a value without taking ownership of
it. An immutable reference is written &T, while
&mut T permits mutation subject to Rust's exclusive
borrowing rule.
A slice is a borrowed view into a contiguous sequence, such as
&[i32] or &str. It carries a pointer
and length but does not own the underlying data, making it a flexible
function parameter.
Each Rust value has one owner, and the value is dropped when that owner leaves scope. Code can temporarily borrow a value through references; many immutable references or one mutable reference may exist at a time. These rules prevent use-after-free and data races at compile time.
String and
&str?String is an owned, growable UTF-8 buffer.
&str is a borrowed view into valid UTF-8 data, often
used for function parameters to avoid ownership transfer. Accepting
&str is more flexible when mutation or ownership is
unnecessary.
Option<T> and Result<T, E>.Option<T> represents presence or absence without
explaining why a value is absent. Result<T, E>
represents success or a failure with details. Both force callers to
handle cases explicitly through matching or combinators.
?
operator do?It unwraps a successful Result or Option;
on failure or absence, it returns early from the current function after
applying the appropriate conversion. It makes error propagation concise
while retaining typed errors. It is not a replacement for adding useful
context.
Ownership rules prevent unsynchronized mutable aliasing, while
Send and Sync traits constrain what can cross
or be shared between threads. Shared mutation normally requires
synchronization types such as Mutex or RwLock.
Deadlocks remain possible, so logical concurrency design still
matters.
Arc<Mutex<T>>?Use it when multiple threads need shared ownership of mutable state:
Arc provides atomic reference counting and
Mutex provides exclusive access. It is often better to
reduce shared state or use channels, because contention and lock-order
bugs can still occur.
Traits define shared behavior that types can implement. They support static dispatch through generics or dynamic dispatch through trait objects, without inheriting fields or creating class hierarchies. This encourages composition and explicit capabilities.
Use structured error enums for expected domain failures and attach sources for lower-level causes. Convert internal errors into serializable, user-safe IPC errors at the Tauri boundary. Do not expose filesystem paths, secrets, or raw internal traces to the UI.
Rust abstractions such as iterators and generics are commonly compiled into code comparable to hand-written low-level loops, without mandatory runtime overhead. The phrase does not mean every abstraction is free; allocations, dynamic dispatch, and synchronization still have costs.
Archive extraction is CPU- and disk-intensive synchronous work, so run it in a dedicated blocking task or worker thread. Bound concurrency, report progress through a channel, support cancellation, and avoid holding async locks across the blocking operation.
Easy-medium foundation questions
Big O describes how an algorithm's time or space requirement grows with input size, usually as an upper bound. It helps compare scalability while ignoring constant factors and machine-specific timing.
An array stores elements contiguously and offers O(1) index access, but insertion in the middle usually requires shifting elements. A linked list follows pointers between nodes, making indexed access O(n) while allowing constant-time insertion when the target node is already known.
A stack follows last-in, first-out order through push and pop operations. It is used for function calls, undo history, expression evaluation, and depth-first search.
A queue normally follows first-in, first-out order through enqueue and dequeue operations. It is useful for task scheduling, buffering, request processing, and breadth-first search.
Binary search repeatedly halves a sorted search range by comparing its middle element with the target. It runs in O(log n) time, but it requires ordered data and careful boundary handling.
A binary tree is a hierarchical structure in which each node has at most two children. It is not automatically ordered; a binary search tree additionally keeps smaller and larger keys on defined sides.
Recursion occurs when a function solves a problem by calling itself on a smaller case. It needs a base case and must make progress toward it; deep recursion can overflow the call stack.
An O(n) algorithm performs work proportional to the number of inputs. An O(log n) algorithm reduces the remaining problem by a constant factor at each step, so its work grows much more slowly.
A graph consists of vertices connected by edges. Edges may be directed or undirected and weighted or unweighted, allowing graphs to represent networks, dependencies, routes, and relationships.
The data structure determines the cost and clarity of common operations such as lookup, insertion, ordering, and traversal. The best choice follows the workload: for example, a set suits membership tests while a heap suits repeated priority removal.
A hash map gives expected O(1) lookup and is preferable when key ordering is unnecessary. A balanced tree gives O(log n) worst-case operations, ordered traversal, and range queries. Hash quality, collision attacks, and memory overhead can change the practical choice.
Model mods as a directed graph and run DFS with unvisited, visiting, and visited states, or use Kahn's topological sort. Encountering a visiting node in DFS or processing fewer than all nodes in Kahn's algorithm proves a cycle. Time complexity is O(V + E).
BFS finds shortest paths in an unweighted graph but may retain a wide frontier in memory. DFS is useful for reachability, cycle detection, and topological reasoning and typically stores only the current path plus bookkeeping. Neither alone handles weighted shortest paths.
Count alerts with a hash map, then keep a min-heap of size K keyed by frequency. Building counts is O(n), and maintaining the heap is O(m log K) for m unique alerts. For streams, approximate algorithms may be needed when the key space is too large.
It averages the cost of operations over a sequence rather than relying on probability. Appending to a dynamic array is O(1) amortized because occasional O(n) resizes are spread across many cheap appends. One individual append may still be expensive.
Use a hash map from keys to nodes and a doubly linked list ordered by recency. The map locates a node in O(1), while list removal, insertion, and eviction are O(1). Capacity and concurrency behavior must be defined explicitly.
Many collisions can place multiple keys in the same bucket, increasing lookup cost toward O(n), depending on implementation. Poor hash functions, adversarial inputs, or high load factors contribute. Resizing and collision-resistant hashing mitigate the risk.
Sort intervals by start position, then scan while extending the current interval when the next start is no greater than the current end. Otherwise, emit the current interval and start a new one. Sorting dominates at O(n log n).
An adjacency matrix uses O(V squared) space and provides O(1) edge checks, making it suitable for dense graphs. An adjacency list uses O(V + E) space and efficiently iterates neighbors, making it better for sparse dependency graphs.
A stable sort preserves the relative order of elements whose keys compare equal. This matters when performing multiple sorts or preserving an earlier priority, such as ordering equal-severity alerts by arrival time.
Easy-medium foundation questions
A class defines a type's data and behavior, while an object is a concrete instance of that type. Not every design needs classes; simple values and composed functions can be clearer for data without identity or lifecycle.
Abstraction exposes the operations a caller needs while hiding irrelevant implementation detail. A good abstraction makes common use simple without concealing behavior that affects correctness or performance.
Polymorphism lets different types be used through a common contract.
For example, several storage implementations can satisfy the same
interface while callers depend only on save and
load operations.
Inheritance lets a derived class reuse or specialize behavior from a base class. It can model a genuine substitutable relationship, but composition is often easier to change and test than a deep inheritance tree.
An interface defines a contract of operations without fixing one implementation. It separates callers from concrete dependencies and enables alternate implementations, including test doubles.
A module should have one focused reason to change. This does not mean every class needs only one method; it means related behavior should stay together while unrelated policy is separated.
Dependency injection supplies an object's collaborators from the outside instead of constructing them internally. It reduces coupling and makes dependencies replaceable in tests or different environments.
Coupling is the degree to which one component depends on details of another. Lower coupling generally makes change easier, but eliminating all dependencies is neither possible nor desirable; the goal is clear, stable boundaries.
Cohesion describes how strongly the responsibilities within a component relate to one another. High cohesion makes a module easier to name, understand, test, and change.
An entity has identity that persists as its attributes change, such as a user identified by an ID. A value object is defined by its values, is commonly immutable, and can be replaced as a whole, such as a money amount and currency.
Encapsulation protects invariants by exposing operations rather than raw representation. A mod object should not allow arbitrary state changes; methods should enforce valid transitions. Private fields alone do not help if setters permit every invalid value.
Composition assembles behavior from smaller components and usually creates looser coupling. Inheritance is appropriate for a genuine substitutable is-a relationship, but deep hierarchies become fragile. Traits, interfaces, and dependency injection often provide cleaner reuse.
A subtype must be usable wherever its base type is expected without violating the caller's assumptions. It must not strengthen preconditions, weaken postconditions, or break invariants. Merely sharing method names does not guarantee substitutability.
High-level policy should depend on abstractions rather than concrete
infrastructure. For example, installation logic can depend on a
Downloader interface while HTTP and test implementations
sit behind it. This improves testability and isolates vendor-specific
changes.
Separate orchestration from download, verification, extraction, filesystem, metadata, and platform adapters. Represent installation as explicit states and use a transaction-like staging directory before an atomic commit. This makes failures testable and rollback practical.
Strategy encapsulates interchangeable algorithms behind one interface. Different archive formats, game-specific installation layouts, or content-generation providers can be strategies selected at runtime. It avoids condition-heavy orchestration code.
Observers subscribe to events from a subject, which suits download progress and workflow updates. Hidden subscription chains can make ordering and failure behavior difficult to reason about. Unsubscribe correctly and define whether delivery is synchronous, buffered, or lossy.
A cohesive interface groups operations required by one clear responsibility. Small consumer-oriented interfaces reduce coupling and simplify tests. Splitting an interface too aggressively can create needless indirection, so boundaries should reflect real variation.
Validate at construction, expose intent-specific methods, restrict direct mutation, and represent mutually exclusive states with enums or tagged unions. When possible, make invalid states unrepresentable in the type system.
A pattern is harmful when introduced without the problem it solves, adding layers and indirection to simple code. Patterns are vocabulary for recurring trade-offs, not goals. Prefer the smallest design that preserves the required invariants and likely change points.
Easy-medium foundation questions
The browser parses the URL, resolves the domain through DNS, establishes a connection, and sends an HTTP request. It then processes the response, fetches referenced resources, builds the page, and renders it; caches and service workers may shorten this path.
HTTP is an application-layer request-response protocol used to transfer resources and API messages. A request includes a method, target, headers, and sometimes a body; a response includes a status code, headers, and sometimes a body.
HTTPS is HTTP carried over TLS. TLS encrypts traffic in transit, detects tampering, and authenticates the server certificate, but it does not make application logic or stored data automatically secure.
The Domain Name System maps names such as example.com to
network information such as IP addresses. Resolvers cache answers for
their time-to-live, so record changes may take time to appear
everywhere.
A REST-style API models resources through URLs and uses standard HTTP semantics for operations and responses. Useful REST APIs are stateless, expose consistent representations, and apply methods and status codes predictably.
Headers carry metadata such as content type, accepted formats, authentication credentials, caching rules, and tracing identifiers. Sensitive headers must be protected in logs and sent only over secure transport.
JSON is a text format containing objects, arrays, strings, numbers, booleans, and null. It is common in APIs because it is widely supported, but parsed JSON still requires schema and business validation.
A path parameter usually identifies a resource, as in
/users/42. A query parameter modifies a request with
filtering, sorting, pagination, or optional behavior, as in
/users?active=true.
A cookie is a small value a server asks a browser to store and return
on matching requests. A session commonly keeps user state on the server
and places only an opaque session identifier in a secure,
HttpOnly, appropriately scoped cookie.
HTTP caching lets browsers and intermediaries reuse responses
according to headers such as Cache-Control,
ETag, and Last-Modified. Correct caching
reduces latency and load, while incorrect caching can expose private
data or serve stale results.
A safe method is intended not to change server state;
GET and HEAD are examples. An idempotent
method has the same intended effect whether applied once or multiple
times; PUT and DELETE should be idempotent.
POST is not inherently idempotent but can use an
idempotency key.
PUT and
PATCH.PUT conventionally replaces the complete resource
representation at a known URI and is idempotent. PATCH
applies a partial update and is idempotent only if the patch semantics
make it so. APIs must document whether omitted fields are preserved or
cleared.
CORS is a browser policy that controls whether frontend JavaScript may read responses from another origin. The server opts into permitted origins, methods, and headers. It is not authentication and does not stop non-browser clients from calling the API.
Require HTTPS, verify an HMAC signature over the raw request body, check timestamps to limit replay, validate the schema, and enforce a body-size limit. Acknowledge quickly, process asynchronously, deduplicate event IDs, and rotate secrets safely.
Authentication establishes who or what the caller is. Authorization decides whether that identity may perform a specific action on a resource. A valid login must not imply access to every object or operation.
Cursor pagination is stable for frequently changing data and avoids the growing scan cost of high offsets. The cursor should be opaque and ordering deterministic. Responses should state limits and return a next cursor without exposing internal assumptions.
Use 400 for malformed input, 401 for
missing or invalid authentication, 403 for authenticated
but forbidden access, 404 for absence, 409 for
state conflicts, 422 for semantically invalid data,
429 for rate limits, and 5xx for server
failures.
Without a timeout, one unavailable dependency can hold resources indefinitely and create cascading failure. Set connection and response deadlines based on an end-to-end latency budget. Combine them with cancellation, bounded retries, and circuit breaking where appropriate.
Retry transient failures such as some timeouts, 429, and
selected 5xx responses. Use exponential backoff with
jitter, a retry limit, and the server's Retry-After value.
Retry non-idempotent requests only with a mechanism that prevents
duplicate effects.
First prefer backward-compatible additive changes. For breaking changes, use a clear version boundary such as a URL, header, or media type, publish migration guidance, and support an explicit deprecation window. Version behavior contracts, not every implementation change.
Easy-medium foundation questions
A React component is a function or class that describes part of the interface from inputs and state. Modern React normally uses function components that return elements expressed with JSX.
Props are read-only inputs passed from a parent component to a child. They configure the child and may include data, callbacks, or nested content.
State is data owned by a component whose changes should update the rendered interface. State should be treated as immutable and updated through React's state APIs rather than mutated directly.
useState hook do?useState adds a state value and an updater function to a
function component. Calling the updater schedules a render; when the new
value depends on the old value, a functional update avoids stale
state.
useEffect used for?useEffect synchronizes a component with systems outside
React, such as subscriptions, timers, or network state. The effect can
return a cleanup function, and its dependency list should include every
reactive value it reads.
JSX is syntax that resembles HTML and compiles to JavaScript element creation. Expressions appear inside braces, attributes generally use camelCase, and components must return a single enclosing tree or fragment.
Lifting state up moves shared state to the nearest common ancestor of the components that need it. The ancestor passes values and update callbacks downward, keeping one source of truth.
Client-side routing maps URL locations to interface views without requesting a full new document for every navigation. It must still support browser history, direct links, not-found states, and server fallback configuration.
Tailwind is a utility-first CSS framework whose classes apply small styling rules directly in markup. Its design tokens and build-time class generation support consistency, while reusable components prevent repeated combinations from drifting.
Hot module replacement updates changed modules in the running development page without a full reload when possible. It shortens feedback time and can preserve component state, but production behavior must still be tested in a real build.
A component re-renders when its state changes, its parent renders, a consumed context value changes, or an external store subscription signals an update. React may skip work when values are unchanged or memoization applies. A render does not necessarily mean the DOM changes.
Keys let React match items between renders and preserve the correct component state. Array indices are risky when items can move, be inserted, or be removed because state may attach to the wrong item. Use a stable identity from the data.
An effect or callback can capture state from the render in which it was created, then run later with that old value. Correct dependency arrays, functional state updates, or refs for carefully chosen mutable values address it. Omitting dependencies just to silence linting usually hides the problem.
useMemo or useCallback?Use them when referential stability avoids meaningful child work or when a computation is measurably expensive. They add comparison and memory costs and can obscure dependencies, so they should follow profiling rather than habit.
A controlled input stores its value in React state, enabling immediate validation and coordinated UI but causing more render work. An uncontrolled input leaves state in the DOM and is accessed through refs or form submission. Large forms often use a hybrid or specialized form library.
Throttle or batch progress updates instead of committing React state for every byte event. Keep rapidly changing transport data outside broad context, update only the affected row, and memoize where profiling shows benefit. Preserve accessibility with meaningful, not excessively noisy, announcements.
It compares the new element tree with the previous one to determine the minimal host updates. Element type and key strongly affect whether a subtree is preserved or remounted. Reconciliation is an implementation optimization, not a license to mutate state.
Vite serves source modules through native ESM during development for fast startup and targeted hot updates. Production builds use an optimized bundling pipeline. It improves tooling speed but does not automatically solve application performance or code splitting decisions.
Utility classes make styling local, constrained, and easy to purge or generate, while reducing naming debates. Long class lists can hurt readability and repeated combinations can drift. Extract actual reusable components or variants, not a custom class for every element.
Start with semantic HTML, keyboard-operable controls, visible focus, associated labels, correct headings, sufficient contrast, and useful error messages. Manage focus for dialogs and dynamic workflows. Test with the keyboard and a screen reader; ARIA should supplement rather than replace native semantics.
Easy-medium foundation questions
Flask is a lightweight Python web framework built around WSGI. It provides routing, request and response handling, templating, and extension points while leaving many architecture choices to the application.
A route associates a URL pattern and HTTP methods with a view
function, commonly through @app.route or a blueprint
decorator. The function returns a response value that Flask converts
into an HTTP response.
A route can include typed placeholders such as
/users/<int:user_id>. Flask converts the matching
segment and passes it to the view function, while invalid converter
values do not match the route.
Return a JSON-serializable value according to the supported Flask
version or use jsonify, along with an appropriate status
code. Keep the response schema consistent and avoid serializing secrets
or internal exception details.
A blueprint groups related routes, error handlers, and other registration behavior. It helps split a growing application by feature and can be mounted with a URL prefix.
WSGI is the standard interface between synchronous Python web applications and web servers. It lets Flask run behind production servers without coupling the framework to one network implementation.
The request context makes objects such as request and
session refer to the active request without passing them
through every function. These proxies are valid only while the relevant
context is active.
It should return a suitable 4xx status and a stable
error body that identifies actionable validation problems. The response
should not include a stack trace or internal implementation details.
Thin route handlers can focus on HTTP parsing, authorization, and response mapping while services implement domain behavior. This makes the logic reusable, easier to unit test, and less coupled to Flask.
Middleware wraps request handling to apply cross-cutting behavior such as logging, authentication, or response headers. In a WSGI application it can wrap the whole app, while Flask hooks provide framework-level alternatives.
The WSGI server receives the HTTP request, Flask creates request and application contexts, matches a route, runs hooks and the view, converts the return value into a response, then performs teardown. Context-local proxies expose request-specific data safely within that lifecycle.
It is designed for convenience and debugging, not robust concurrency, security, or process supervision. Production typically uses a WSGI server such as Gunicorn behind a reverse proxy, with appropriate workers, timeouts, TLS termination, and observability.
Use an application factory, blueprints for bounded route groups, configuration by environment, and services separated from transport logic. Keep database or model clients injectable. This prevents import-time side effects and makes testing easier.
Parse into an explicit schema, reject unknown or invalid values according to policy, and return stable field-level errors. Validation must occur server-side even if the frontend also validates. Put limits on payload size, strings, arrays, and uploaded files.
It can return a generator-backed streaming response or use Server-Sent Events, emitting small chunks while the model produces tokens. The design must handle client disconnects, proxy buffering, timeouts, cancellation, and errors after headers have already been sent.
Use parameterized queries or a correctly used ORM; never concatenate untrusted input into SQL. Validate identifiers separately because parameters generally represent values, not table or column names. Least-privileged database credentials limit impact.
Accept the request, validate it, enqueue a background job, and return a job identifier. A worker performs extraction and indexing while the API exposes status and cancellation. Make the job idempotent and store checkpoints so retries do not duplicate data.
Load configuration from the environment or a secret manager, separate it by deployment environment, and never commit secrets. Validate required settings at startup, restrict access, rotate credentials, and ensure logs and error responses do not leak them.
Use structured logs with request and correlation IDs, metrics for latency, traffic, errors, saturation, and domain events, plus distributed traces across model and retrieval calls. Define alerts from user impact and service objectives rather than logging everything.
Use the Flask test client for routing, validation, authentication, and response contracts while injecting fake external dependencies. Add integration tests for storage and vector systems, and a small end-to-end suite for critical flows. Test timeouts and error paths, not only success.
Easy-medium foundation questions
Tauri is a framework for building desktop applications with a web frontend and a Rust-based native backend. It uses the operating system's webview rather than bundling a full browser engine on each platform.
A webview is an embedded browser surface provided by the platform for rendering HTML, CSS, and JavaScript inside a native application. Its engine and supported behavior can vary across operating systems.
A Tauri command is a Rust function deliberately exposed for frontend invocation. Its arguments are deserialized across the IPC boundary, so the backend must validate them before performing privileged work.
Rust provides native performance, explicit error handling, and compile-time memory and concurrency safety without garbage collection. It also offers access to operating-system APIs and a broad package ecosystem.
It should use the operating system's designated per-user application-data or configuration directory. Hard-coded working-directory paths are unreliable and can violate permissions or platform conventions.
Inter-process communication is a mechanism for exchanging messages across process or trust boundaries. In Tauri, frontend-to-Rust invocation behaves like such a boundary even when implementation details vary, so messages need narrow schemas and authorization.
Web content can be affected by injection bugs or compromised dependencies. Restricting file operations to narrow backend commands limits what an attacker can read, overwrite, or execute.
A content security policy restricts where a webview may load scripts, styles, images, and other resources from. A strict policy reduces the impact of injection vulnerabilities, especially when unsafe inline scripts and unexpected remote origins are disallowed.
Code signing uses a platform-trusted identity to bind a publisher to an application artifact and detect modification. It improves installation trust and update integrity, but the signing key must be strongly protected.
Operating systems differ in webviews, paths, permissions, file locking, installers, and security prompts. Compilation success on one platform does not verify runtime behavior or packaging on another.
Tauri uses the operating system's webview and a native Rust backend, often producing smaller binaries and lower idle memory use. Electron bundles Chromium and Node.js, giving a more uniform runtime and a larger ecosystem. The right choice depends on compatibility, security, and deployment needs.
The frontend invokes explicitly exposed commands or listens for application events across Tauri's IPC boundary. Inputs should be deserialized into typed structures, validated in Rust, and authorized by capability. The frontend must be treated as untrusted.
The webview renders UI, while the Rust process has privileged native access. Expose the smallest possible command surface, restrict capabilities and navigation, apply a content security policy, and never allow arbitrary paths or shell commands from UI input.
Canonicalize and validate the destination, reject absolute paths and
.. traversal, and verify every extracted entry remains
inside a dedicated staging root. Treat symlinks and platform-specific
path forms explicitly. Do not trust archive entry names.
Run work outside the UI thread, identify each operation, and emit throttled progress events. Associate a cancellation token with the operation and check it at safe points. Cancellation must clean staging data without corrupting an existing installation.
Use a versioned schema, write to the platform's application-data directory, and perform atomic replace through a temporary file. Validate data on load, preserve recoverable defaults, and implement migrations when the schema changes.
Fetch an authenticated update manifest over TLS, verify a digital signature before installation, and use the platform's safe updater flow. Protect signing keys, support staged rollout and rollback, and never rely only on a checksum downloaded beside the artifact.
Path separators, case sensitivity, permissions, executable bits, symlink behavior, file locking, webview differences, code signing, and installer formats vary. Hide these behind platform adapters and test on each supported operating system.
Keep network, extraction, hashing, and large filesystem scans off the UI thread. Perform them in async tasks or workers, send bounded progress events, and virtualize large lists. Profile to distinguish frontend rendering cost from backend blocking.
The Rust side should retain detailed typed errors for logs but return stable, serializable codes and safe messages to the frontend. The UI maps codes to recovery actions. Include an operation or correlation ID so a user-visible failure can be traced.
Easy-medium foundation questions
A path is a name used to locate a filesystem entry, while an open handle refers to a resource the process has already opened. Handles reduce repeated lookup and can help avoid some path races, but they must be closed reliably.
An absolute path identifies a location from a filesystem root. A relative path is interpreted from a base such as the current working directory, so applications should make that base explicit rather than assume it.
A file extension is a naming convention such as .zip or
.json that suggests a format. It is not trustworthy
validation; software should inspect expected structure or signatures and
safely parse the content.
An archive packages multiple files and their metadata into one file, often with compression. Extractors must treat entry names and sizes as untrusted because archives can contain traversal paths, links, or expansion bombs.
Streaming processes bounded chunks instead of keeping the entire file in memory. It limits memory use and allows incremental hashing, progress reporting, cancellation, and resume support.
A checksum is a value derived from file contents and used to detect changes or corruption. Cryptographic hashes such as SHA-256 are preferable for integrity checks, but authenticity also requires a trusted source or signature.
An atomic write typically creates and flushes a temporary file in the same filesystem and then renames it over the destination. Readers see either the old complete file or the new complete file rather than partial content.
A staging directory isolates incomplete downloads and extraction from the active installation. The app can validate the staged result and commit it only when every required step succeeds.
File permissions control which identities may read, write, or execute a filesystem object. Installers should request only needed access, preserve appropriate permissions, and report permission failures clearly.
It should track a stable mod identifier, version, source, installed files and hashes, dependencies, enabled state, and installation status. Versioning this metadata supports upgrades, conflict detection, recovery, and migrations.
Download and extract into a unique staging directory, verify everything, then rename or swap it into the final location in one filesystem operation where supported. Keep metadata changes in the same commit protocol and restore the previous version if the swap fails.
For every archive entry, normalize its path and verify the resolved output remains within the intended extraction root. Reject absolute paths, parent traversal, unsafe symlinks, and special files. Apply limits to entry count and expanded size as well.
Check the expected content length when available and compute a cryptographic digest such as SHA-256 while streaming. Compare it with trusted signed metadata, not an untrusted value from the same compromised source. A checksum detects corruption; authenticity requires a signature or trusted channel.
Store partial data and metadata such as URL, expected size,
validator, and completed byte ranges. Request the remaining range and
verify that ETag or Last-Modified still
matches. If the server does not honor ranges or content changed, restart
safely.
Prefer reversible metadata or a controlled rename/move rather than deletion. Record original and active paths transactionally, detect collisions, and recover from partial operations on startup. Game-specific configuration may require an adapter rather than generic file movement.
Maintain an ownership manifest mapping installed files to mods and hashes. Detect conflicts before commit, expose a deterministic priority or user decision, and retain enough information to restore the previous owner when a mod is disabled.
Time-of-check to time-of-use occurs when a validated resource changes before it is used. An attacker might replace a checked path with a symlink. Reduce the gap, operate through already-open handles where possible, and revalidate at the privileged operation.
Set maximum compressed size, expanded size, entry count, path length, per-entry size, nesting, and extraction time. Stream rather than buffer large entries, enforce available-space checks, and abort cleanly when limits are exceeded.
Validate names and collisions, keep the source and target on the same filesystem when atomic rename is needed, and update metadata only as part of a recoverable transaction. On Windows, account for locks and reserved names; never silently overwrite unrelated files.
On startup, inspect a journal or staging markers to determine the last completed step. Resume an idempotent operation or roll it back, remove only verified temporary artifacts, and leave the last known-good installation intact. Crash recovery should be tested with fault injection.
Easy-medium foundation questions
Cloud computing provides computing, storage, networking, and managed services on demand over provider infrastructure. It replaces some upfront ownership with metered usage, automation, and the ability to change capacity quickly.
IaaS exposes infrastructure such as virtual machines and networks, PaaS manages more of the runtime and deployment platform, and SaaS provides a complete application. As the provider manages more layers, the customer gains convenience but gives up some control.
A virtual machine emulates a computer with virtual CPU, memory, storage, and networking while sharing physical hardware through a hypervisor. It includes a guest operating system and normally has stronger isolation but more overhead than a container.
A container packages an application and its user-space dependencies while sharing the host kernel. Containers start quickly and deploy consistently, but images, runtime privileges, secrets, and orchestration still require security controls.
Identity and Access Management defines identities and the actions they may perform on resources. Good IAM uses least privilege, short-lived credentials, separate roles, and auditable policy changes.
A virtual private cloud is a logically isolated cloud network containing subnets, routes, gateways, and security controls. Public and private reachability depend on routing and firewall configuration, not simply on a subnet's name.
Serverless services run code or workloads without requiring the customer to manage individual servers. They can scale automatically and charge by usage, but introduce limits, startup latency, provider-specific behavior, and external state requirements.
Object storage keeps data as objects addressed by keys in buckets. It suits logs, media, backups, and build artifacts, but does not provide the same update and locking semantics as a local filesystem.
High availability is the ability to continue serving through expected component failures. It usually requires redundancy across failure domains, health checks, automated failover, and removal of single points of failure.
Tags or labels attach metadata such as owner, environment, application, and cost center to resources. Consistent tagging supports inventory, access policy, automation, incident response, and cost allocation.
The provider secures the underlying facilities, hardware, and managed-service infrastructure; the customer secures identities, data, configuration, and workloads. The boundary changes by service model: customers manage more in IaaS than in SaaS. Misconfigured IAM remains the customer's responsibility.
Vertical scaling gives one instance more CPU, memory, or storage but has a ceiling and can require interruption. Horizontal scaling adds instances and improves elasticity and fault tolerance, but requires stateless services or coordinated state management.
A region is a geographic area; an availability zone is an isolated failure domain within it. Deploying across zones protects against a data-center failure, while multi-region design can handle regional outages and reduce global latency at higher complexity and cost.
Identify the exact resources and actions the workload needs, grant narrow roles at the lowest practical scope, and avoid long-lived user-managed keys. Use workload identity, short-lived credentials, audit logs, periodic review, and separation between environments.
Object storage holds immutable-like objects addressed by key and scales well for artifacts and logs. Block storage exposes volumes suited to databases and filesystems. File storage provides shared hierarchical filesystem semantics, usually with different latency and consistency trade-offs.
Recovery Time Objective is the maximum acceptable time to restore service. Recovery Point Objective is the maximum acceptable data loss measured in time. These business targets determine replication, backup frequency, failover automation, and cost.
The load balancer distributes requests among healthy instances, while the autoscaler changes instance count based on signals such as CPU, concurrency, queue depth, or latency. Health checks, warm-up time, cooldown behavior, and connection draining prevent unstable scaling.
Replicas may temporarily return different values after a write but converge if no new updates occur. It improves availability and distribution but requires conflict handling, monotonic identifiers, or user experience that tolerates stale reads. Not every cloud service uses the same consistency model.
Set retention by value, filter noisy data before storage, compress and tier old logs, partition and cluster query tables, cap query bytes, and monitor cost per source or tenant. Cost controls must preserve legal, forensic, and detection requirements.
Infrastructure as code declares cloud resources in version-controlled definitions, enabling review, repeatability, testing, and drift detection. State and secrets still require protection, and changes need staged plans and rollback procedures.
Easy-medium foundation questions
A SOC is the people, processes, and technology responsible for monitoring, investigating, and responding to security threats. It may be an internal team, a managed service, or a hybrid operation.
SecOps integrates security work with IT and operational practices so detection and response are part of normal system operation. It emphasizes collaboration, automation, shared telemetry, and measurable response processes.
A log is a time-stamped record emitted by a system, application, or device about an event or state change. Useful logs include reliable time, source identity, action, result, and relevant context.
An indicator of compromise is observable data associated with malicious activity, such as a file hash, domain, or IP address. Indicators need context, confidence, and freshness because infrastructure can be shared or reused.
A threat can cause harm, a vulnerability is a weakness that could be exploited, and risk combines likelihood with impact. A vulnerability is not automatically the highest risk if it is unreachable or affects a low-value asset.
Confidentiality prevents unauthorized disclosure, integrity prevents unauthorized or undetected modification, and availability keeps systems and data accessible when needed. Security decisions often balance all three objectives.
Least privilege gives an identity only the access required for its current task and for no longer than needed. It reduces both accidental damage and the impact of account compromise.
Phishing uses deceptive messages or sites to persuade people to reveal information, execute content, or authorize an action. Defenses include user reporting, email controls, strong authentication, endpoint protection, and rapid response.
EDR collects endpoint activity, detects suspicious behavior, supports investigation, and may enable containment actions. Its data complements network, identity, cloud, and application telemetry.
The analyst validates the alert, gathers context, assesses scope and impact, documents evidence, and decides whether to close, escalate, or contain it. The exact action follows the organization's playbook and authority model.
A SIEM centralizes security-relevant telemetry, normalizes and correlates events, runs detections, supports investigation, and provides retention and reporting. It does not create security by itself; source quality, detection logic, triage, and response processes determine value.
An event is an observed occurrence in telemetry. A detection turns one or more suspicious events into an alert for review. An incident is a confirmed or sufficiently credible security situation managed through a coordinated response process.
A false positive flags benign activity; a false negative misses malicious activity. Tuning one can worsen the other, so detections should be evaluated against threat risk, analyst capacity, and expected base rates rather than accuracy alone.
ATT&CK organizes adversary tactics and techniques using observed behavior. Teams use it to map detections, identify coverage gaps, structure threat hunting, and communicate behavior. A mapped technique does not prove the detection is effective; validation is still required.
Defense in depth uses independent preventive, detective, and responsive controls across identity, endpoint, network, application, and data layers. If one control fails, others reduce likelihood or impact. Redundant tools without different failure modes do not necessarily add depth.
It needs relevant events, accurate timestamps, stable identifiers, sufficient context, known semantics, and dependable delivery. Coverage, latency, duplication, clock skew, and parse failure should be monitored. More log volume is not automatically more security value.
Combine detection confidence with asset criticality, user privilege, threat severity, exposure, supporting evidence, and potential blast radius. Severity from a tool is an input, not the final decision. The process should be explainable and continuously calibrated.
Threat hunting is a hypothesis-driven search for malicious behavior not already handled by alerts. A hunt states assumptions, selects relevant data, tests patterns, records findings, and may produce new detections or telemetry requirements.
Alert fatigue occurs when excessive low-value alerts reduce analyst attention and response quality. Measure alert volume, false-positive rate, duplication, time to triage, and actionability; then tune logic, aggregate related events, add context, and retire detections that no longer justify cost.
Define expected malicious and benign cases, replay representative telemetry or run controlled simulations, verify field mappings and timing, and measure precision and recall where labels exist. Monitor production drift and get analyst feedback after deployment.
Easy-medium foundation questions
Security telemetry is event and measurement data used to understand activity and detect threats. Examples include authentication records, process launches, DNS queries, network flows, and cloud audit events.
Log ingestion collects events from sources and transports them into a storage or analytics platform. A reliable pipeline tracks lag, failures, duplicates, source health, and the point at which data becomes queryable.
A parser interprets raw input and extracts fields according to a defined format. It should handle valid variations, reject or quarantine malformed data, and avoid silently inventing missing meaning.
Google Security Operations' Unified Data Model is a common schema for normalized security events and entities. It lets searches and detections operate consistently across data from different vendors.
Timestamps establish event order and allow correlation within windows. Pipelines should preserve the source event time, record ingestion time separately, and normalize time zones without losing the original context.
Field mapping connects a source field to the corresponding normalized schema field. A correct mapping preserves semantics, types, units, and context rather than matching fields only because their names look similar.
Structured logs follow a machine-readable schema such as JSON with named fields. Unstructured logs are primarily free text and need more parsing, making changes and ambiguous values harder to manage.
It is a separate destination for records that cannot be processed successfully. Keeping the raw record, error reason, source, and attempt metadata allows investigation and replay without blocking good events.
The raw event supports auditing, parser debugging, remapping, and recovery of information not captured by the current schema. Access and retention should be limited because raw logs may contain sensitive data.
Monitor event volume, freshness, parse success, field completeness, and expected source coverage against a baseline. Alert on meaningful gaps or changes while accounting for normal schedules and maintenance.
Normalization maps vendor-specific formats into consistent fields and semantics. Detections and dashboards can then work across sources without duplicating logic. Raw events should remain available because normalization can lose details or contain mapping errors.
Parsing extracts structure from raw bytes or text. Normalization maps extracted values into canonical fields, types, taxonomies, and meanings. A log can parse successfully yet be normalized incorrectly.
Detect versions or optional shapes, keep backward-compatible mappings where possible, and route unknown variants to measurable fallback handling. Use versioned fixtures and contract tests. Never silently reinterpret a changed field with different semantics.
Patterns can become brittle, unreadable, and vulnerable to catastrophic backtracking. Prefer structured parsers for JSON, CSV, syslog, and key-value formats; anchor and bound unavoidable regexes. Track unmatched and partially matched input.
First identify event type and actor, target, action, result, timestamp, and network or identity context. Map only semantically equivalent values, normalize types and enumerations, preserve vendor fields in designated extensions, and validate required fields using representative samples.
Sources may use local time, different precision, delayed delivery, or incorrect clocks. Parse the original timezone explicitly, normalize to UTC, retain ingestion time separately, and monitor skew. Event-time windows should account for realistic lateness without becoming excessively broad.
Do not let one bad record stop the pipeline. Quarantine or dead-letter it with a safe reason, source, and correlation metadata; increment metrics and retain enough raw data for diagnosis. Define thresholds that alert on systemic parse failure.
Track parse success, full versus partial normalization, unknown fields or enum values, event latency, duplicate rate, volume changes, required-field completeness, and distribution shifts. Break metrics down by source and version so aggregate success does not hide a broken feed.
Use sanitized production-like fixtures, golden expected UDM output, negative cases, property-based invariants, and regression tests for every fixed bug. Validate semantic meaning, not just field presence, and run downstream detection tests against the normalized events.
Collect only what detection and compliance require, classify fields, restrict access, encrypt data, define retention, and redact or tokenize values where possible. Debug logs and dead-letter queues need the same controls as the main store.
Easy-medium foundation questions
A detection rule describes telemetry conditions that may indicate suspicious behavior and produces an alert or result when they match. It should document intent, required data, severity, limitations, and response guidance.
YARA-L is Google Security Operations' rule language for searching and detecting patterns in normalized security telemetry. It can express event filters, correlations, time windows, outcomes, and conditions over UDM fields.
A single-event detection evaluates one event against suspicious conditions, such as a disabled account performing a login. It is simpler than correlation but depends heavily on the quality and specificity of the individual event.
A correlation detection combines multiple related events, often by user, host, IP, or another entity within a time window. It can identify behavior that no single event proves on its own.
A rule condition specifies when the matched events are sufficient to produce a result. It may require an event to exist, a count to cross a threshold, or a relationship among several event groups.
Severity communicates the expected impact or urgency of the detected behavior and helps triage. It should reflect context and confidence rather than simply label every security match as critical.
A false positive is benign activity incorrectly identified as suspicious. Analysts reduce it by validating assumptions, adding reliable context, tuning thresholds, and documenting legitimate exceptions narrowly.
A false negative is malicious activity the detection fails to identify. It can result from missing telemetry, overly narrow logic, evasion, parsing errors, or untested assumptions.
ATT&CK mappings communicate the adversary behavior a rule is intended to detect and help assess coverage. A mapping should follow the actual logic and evidence rather than being added only for reporting.
A threshold requires a count, rate, or score to reach a defined level before alerting. It can reduce noise but may miss low-and-slow activity, so it should be based on baseline data and tested against realistic attacks.
Traditional YARA primarily matches patterns in files or memory artifacts. YARA-L is designed for event-based detection over normalized telemetry, supporting conditions, grouping, joins, and time windows. They share a name but address different data and execution models.
It targets a meaningful threat behavior with reliable fields, sufficient context, explicit exclusions, and a clear response path. High fidelity means useful precision at an acceptable recall, validated against malicious and representative benign data.
Group authentication events by a meaningful identity and possibly source within a bounded time window. Require several failures followed by a success and enrich with location, device, privilege, and baseline context. Account for shared proxies, service accounts, and normal password mistakes.
They encode how close events must be to support one hypothesis. Too short misses slow activity or late logs; too long joins unrelated events and raises cost and false positives. Choose windows from attacker behavior, telemetry latency, and measured background rates.
Suppression reduces repeated alerts for a known entity or pattern during a period. It controls duplication but may conceal continued compromise or attacks affecting new assets. Suppress presentation when possible while retaining events and tracking counts.
Review labeled alerts with analysts, identify benign clusters, verify mappings, and add behavioral or contextual constraints that reflect the threat hypothesis. Avoid broad allowlists that attackers can exploit. Re-test recall using positive cases after every tuning change.
Detection rules, tests, metadata, and deployment configuration live in version control and move through review and automated validation. This provides change history, reproducibility, staged rollout, and rollback. Production outcomes still need monitoring.
Create positive, negative, edge, out-of-order, late-arrival, and duplicate-event cases. Replay historical data to estimate volume and cost, validate entity grouping, and compare alerts with known outcomes. Deploy in monitor-only mode before paging analysts.
When malicious activity is extremely rare, even a rule with good sensitivity and specificity can produce mostly false alerts. Narrower hypotheses, stronger context, multi-signal correlation, and risk-based prioritization improve positive predictive value.
Include purpose, threat hypothesis, data dependencies, ATT&CK mapping, severity rationale, owner, version, test cases, known false positives, triage steps, response guidance, and expected alert volume. This turns a query into an operable control.
Easy-medium foundation questions
Security Orchestration, Automation, and Response platforms connect security tools, coordinate workflows, and automate repeatable investigation or response steps. Automation should preserve approvals for high-impact actions.
A playbook is a documented sequence of steps for handling a security scenario. In SOAR it may be executable and contain triggers, enrichment, decisions, assignments, notifications, and response actions.
Triage quickly assesses whether an alert is credible, how severe it may be, what assets or users are involved, and what should happen next. Consistent triage criteria reduce arbitrary prioritization.
Containment limits an incident's spread or impact, for example by isolating a host or disabling a compromised credential. The team should consider business impact, evidence preservation, authorization, and reversibility before acting.
Threat intelligence is analyzed information about threats that supports decisions. It includes more than indicator lists: source reliability, context, relevance, confidence, and time sensitivity determine whether it is useful.
Enrichment adds context to an alert, such as asset ownership, user role, indicator reputation, geolocation, or related events. Useful enrichment answers a triage question rather than adding unbounded data.
An API integration lets one system request data or actions from another through a defined contract. It needs authentication, validation, timeouts, error handling, rate-limit awareness, observability, and version management.
A case-management system records incidents, evidence, tasks, owners, decisions, and timelines. It provides a durable coordination and audit trail across analysts and response teams.
Evidence may be needed to establish scope, find root cause, meet legal obligations, or improve defenses. Responders should collect it with documented timing and handling while avoiding unnecessary changes to the affected system.
A post-incident review reconstructs what happened, how the organization responded, what worked, and what should change. It should create owned, prioritized improvements rather than focus on individual blame.
Start with reversible, low-risk steps such as deduplication, enrichment, evidence collection, ticket creation, and routing. Containment actions like disabling users or isolating hosts need stronger confidence, approval gates, scoped permissions, and rollback.
Repeating the same playbook or step does not create duplicate tickets, comments, blocks, or messages. Use stable incident and action keys, check current state before mutation, and persist step results so retries resume safely.
Preparation; detection and analysis; containment; eradication; recovery; and post-incident learning. Real incidents may loop between phases. Evidence preservation, communication, ownership, and decision logs span the entire process.
Consider source reliability, confidence, recency, context, indicator type, prevalence, and relevance to the organization. An IP address is often less durable and more shared than a malware hash or behavior. Intelligence should inform a decision, not automatically become a permanent block.
Use centralized throttling, bounded concurrency, caching, batching,
exponential backoff with jitter, and Retry-After.
Prioritize urgent cases and expose queue age. Retrying each alert
independently can amplify overload.
Store them in a managed secret store, grant access only to the playbook identity, use short-lived credentials where possible, rotate them, and never print them in logs or error payloads. Audit access and isolate development from production secrets.
Use timeouts and a circuit breaker, mark the enrichment as unavailable rather than benign, continue with other evidence when policy permits, and queue a bounded retry. The playbook should communicate reduced confidence and avoid blocking all triage indefinitely.
Define a stable deduplication key from the rule, affected entity, and bounded episode, then enforce uniqueness atomically in the case system or orchestration store. Update the existing incident with new evidence and reopen it only under documented conditions.
Record relevant events, analyst and automated actions, evidence sources, decisions and rationales, containment changes, timestamps, owners, and communications. Preserve original time and ingestion time where they differ, and make the log tamper-evident according to policy.
Measure success and failure rate, time saved, mean time to triage and respond, enrichment latency, retry rate, manual handoffs, false containment, and analyst satisfaction. Automation volume alone is a vanity metric if outcomes do not improve.
Easy-medium foundation questions
BigQuery is Google Cloud's managed, serverless analytical data warehouse. It is designed for SQL queries over large datasets and separates much of storage management from query compute.
A dataset is a top-level container for tables, views, routines, and access controls within a project and location. It helps organize related data and establish ownership, retention, and permissions.
A schema defines a table's columns, data types, and modes such as nullable or repeated. A deliberate schema improves validation, query correctness, and cost compared with storing every field as unstructured text.
An operational database is optimized for frequent, small transactions that run an application. An analytical database is optimized for scans, aggregations, and reporting across large historical datasets.
An aggregate function summarizes multiple rows, for example with
COUNT, SUM, AVG,
MIN, or MAX. GROUP BY defines the
dimensions for which separate summaries are produced.
A join combines rows from tables using a relationship between their columns. The join type determines whether unmatched rows are discarded or retained, and unintended many-to-many matches can multiply results.
A view is a stored query presented like a table. It can centralize reusable logic and limit exposed columns, though querying it still executes the underlying work unless results are materialized or cached.
Looker is a business intelligence platform for modeling governed metrics and building explores, dashboards, and reports. Its semantic layer helps multiple users apply consistent definitions to warehouse data.
A dashboard filter lets a viewer constrain results by dimensions such as time, environment, severity, or team. Filters need clear defaults and scope so users understand which tiles they affect.
Freshness shows whether the dashboard reflects current telemetry or a delayed pipeline. Without it, a quiet chart can be mistaken for a healthy environment when data has actually stopped arriving.
It is a managed, columnar analytical warehouse that can scan and aggregate large datasets without provisioning database servers. It works well for append-heavy event data and parallel analytical queries. Query design and bytes scanned still determine latency and cost.
Partitioning divides a table by a coarse key such as event date so queries can skip entire partitions. Clustering organizes data within partitions by selected columns, improving pruning for common filters. Queries must filter on those fields to benefit.
SELECT *?In a columnar warehouse, reading unnecessary columns increases bytes
scanned, cost, transfer, and cognitive noise. Select only required
fields and filter partitions early. A LIMIT usually does
not guarantee reduced bytes scanned.
Define a stable event identity or a composite key, then use
ROW_NUMBER() over that key ordered by trusted ingestion or
version time and retain row one. The choice of key and winning record
must match source semantics; identical-looking events may be legitimate
repeats.
Event time is when activity occurred at the source; ingestion time is when the platform received it. Event time is usually right for investigations, while ingestion time reveals pipeline latency and can support partition management. Keep both because late arrival and clock skew are common.
It answers a defined operational question, shows trends and denominators, supports drill-down, communicates freshness, and avoids misleading aggregation. Different views serve executives, SOC managers, and analysts; one crowded dashboard should not attempt all three.
Raw alert count, alerts closed, and mean response time can reward superficial closure or hide severity. Pair volume with precision, backlog age, coverage, business impact, percentile times, reopen rate, and data quality. Define when each timer starts and stops.
Centralize business definitions, joins, dimensions, measures, access rules, and time semantics so dashboards calculate metrics consistently. Prevent fan-out errors, document fields, test critical measures, and keep raw sensitive columns out of broad explores.
Inspect generated SQL and bytes scanned, prune partitions, reduce unnecessary fields and joins, fix fan-out, pre-aggregate expensive repeated logic, cache where freshness permits, and limit high-cardinality visualizations. Measure improvement rather than guessing.
Map the authenticated viewer to authorized data scopes and enforce the rule in the governed data or semantic layer, not only with hidden UI filters. Test denied paths, derived content, exports, caches, and service accounts to avoid accidental cross-tenant exposure.
Easy-medium foundation questions
n8n is a workflow automation platform that connects triggers, application integrations, transformations, and control-flow nodes. It is useful for integrating services quickly while keeping execution logic visible.
A trigger starts a workflow in response to an event, schedule, webhook, or manual action. Its payload and delivery guarantees determine how the workflow should validate and deduplicate input.
A node is one step in a workflow, such as calling an API, transforming data, branching, or writing a record. Each node receives input items and produces output for connected nodes.
A webhook is an HTTP callback sent when an event occurs. The receiving endpoint should authenticate the sender, validate the payload, respond promptly, and handle duplicate or out-of-order delivery.
NocoDB provides a spreadsheet-like interface and APIs over structured database data. It can serve as a lightweight operational store or review interface, but the underlying schema and access policy still need deliberate design.
Use n8n's credential management or an integrated secret store rather than placing keys directly in node fields, expressions, or exported workflow JSON. Restrict credential access and rotate exposed values.
A conditional branch sends an item down different paths based on a stated rule, such as approval status or content type. Conditions should handle missing and unexpected values explicitly.
It should apply a bounded retry policy with backoff and jitter when the operation is safe to repeat. Exhausted attempts should preserve context in an error path or queue for review instead of silently losing the item.
It should include a workflow and execution ID, start and finish times, step status, retry count, and a safe error summary. Sensitive payloads and credentials should be redacted or excluded.
Separation prevents test data, credentials, and side effects from reaching real users or systems. Environment-specific endpoints and secrets should be configured outside shared workflow logic where possible.
It coordinates multiple steps, dependencies, data transformations, retries, and external systems toward a business outcome. The orchestrator should make state and failure visible. It does not remove the distributed-systems problems of partial failure and duplicate delivery.
Assign each request a stable ID, store its current stage and artifact versions, and check before creating external side effects. Use the same ID as an idempotency key where APIs support it. A retry should resume or reproduce the same result, not create duplicate posts.
Providers often impose short timeouts and retry when acknowledgement is missing. Validate and authenticate the request, persist or enqueue it durably, then return success. Long model calls inside the request increase duplicate delivery and resource exhaustion.
The system retries until delivery is acknowledged, so an event should arrive but may arrive multiple times. Consumers must deduplicate or make processing idempotent. Exactly-once effects generally require carefully coordinated state, not just an exactly-once label.
Track each platform as a separate state, retry only transient failed steps, and retain successful results. Provide a compensating action when possible, such as removing a partially published post, but do not assume every external side effect can be rolled back.
It can provide forms and a relational data interface for input, status, approvals, and generated artifacts. Treat it as a real data store: define ownership, constraints, access control, backups, schema migration, and a stable workflow identifier.
Validate length, format, allowed platforms, URL schemes, ownership, and content constraints on the server-side workflow boundary. Sanitize content for its output context and reject unexpectedly large data. Frontend form validation alone is not a security control.
Persist generated drafts with a version and status, notify an authorized reviewer, and resume only when an authenticated approval references that exact version. Editing after approval must invalidate the approval. Record reviewer, timestamp, and final content.
Use a correlation ID across nodes and providers, structured step logs, duration and failure metrics, queue age, retry count, and a dead-letter view. Redact prompts or generated content when they may contain sensitive information.
Consider custom code when complexity, scale, latency, testing needs, security boundaries, version-control limitations, or reusable domain logic exceed what the workflow remains clear and reliable at. A hybrid often works: orchestration in n8n and complex logic in tested services.
Easy-medium foundation questions
Generative AI models produce new content such as text, images, audio, or code from input instructions and context. Their output is probabilistic and must be validated for the application's accuracy and safety requirements.
A prompt is the input that instructs or provides context to a generative model. Effective prompts state the task, relevant constraints, source material, and expected output format without mixing trusted instructions with untrusted content.
A token is a unit of text processed by a language model, often a word fragment rather than a whole word. Input and output tokens affect context limits, latency, and API cost.
The context window is the maximum amount of tokenized input and generated output a model can consider in one request. Larger context is not automatically better because irrelevant content can increase cost and distract the model.
A hallucination is generated content presented as plausible despite lacking support or being false. Grounding, retrieval, constrained outputs, verification, and abstention reduce risk but do not eliminate it.
Prompt templating combines stable instructions with runtime variables in a consistent structure. Variables must be delimited and escaped appropriately so user or retrieved content is treated as data rather than higher-priority instruction.
A defined JSON or schema-shaped response is easier to validate and pass to downstream systems than free-form prose. The application must still parse defensively and reject missing, invalid, or unsafe values.
Streaming delivers partial output as the model generates it instead of waiting for the complete response. It can improve perceived latency, but clients must handle interruption, partial content, moderation, and final-state errors.
Model latency includes request setup, queueing, time to the first output token, and generation time. Prompt length, output length, model size, provider load, and network distance can all affect it.
Reviewers can check factual accuracy, brand fit, copyright concerns, unsafe content, and context the model lacks. Approval state and edits should be recorded so publishing is intentional and evaluation can improve.
Temperature reshapes token probabilities: lower values generally make output more deterministic and focused; higher values increase diversity and risk. It does not guarantee factuality. Some tasks benefit more from schema constraints and retrieval than temperature changes.
Ground claims in retrieved sources, require citations tied to source passages, separate research from writing, constrain the output, and run verification checks. A fluent citation can still be false, so validate source existence and claim support before publishing.
External pages may contain instructions that attempt to override the workflow, reveal secrets, or trigger actions. Treat retrieved text as untrusted data, separate instructions from content, restrict tools and credentials, validate outputs, and require approval for consequential actions.
A validated schema makes downstream automation more reliable than parsing free-form prose. Constrain expected fields and enums, reject invalid responses, and retry with bounded repair logic. Schema validity still does not prove factual correctness.
Choose the smallest capable model, cap context and output, cache stable research, batch suitable calls, parallelize only independent work, and skip regeneration of unchanged stages. Track cost and latency per article and provider, including retries.
Use deadlines, bounded retries for transient failures, circuit breakers, and durable job state. A fallback model needs compatibility testing because output style, safety, context window, and schema adherence differ. Surface degraded quality instead of silently hiding it.
System or developer instructions define the application's higher-priority behavior, while user content supplies the task. In a pipeline, retrieved pages and form fields should be explicitly delimited as untrusted content. The application must enforce permissions outside the model.
Use a rubric for factual support, platform constraints, brand voice, clarity, safety, duplication, and call-to-action quality. Combine deterministic checks with human review and blind comparative evaluation. Engagement alone can reward sensational or inaccurate output.
Carry a shared creative brief and factual constraints into both stages, validate prompts and outputs, respect intellectual-property and safety policies, and attach provenance. Require human review before publication, especially for people, brands, or factual diagrams.
Prompts may contain personal, proprietary, or regulated data. Minimize and redact input, understand retention and training terms, select the correct region and account controls, encrypt transport, restrict logging, and obtain required consent or agreements.
Easy-medium foundation questions
A knowledge base is the controlled collection of documents or records the system may retrieve from. Its quality depends on source authority, freshness, metadata, access rules, and successful extraction.
Chunks create retrieval units small enough to embed, search, and fit into a model's context. Good boundaries preserve the meaning needed to answer a question and retain a link to the source.
Semantic search compares vector representations to find content with similar meaning even when wording differs. It improves conceptual matching but may perform poorly on exact identifiers or rare terms.
Lexical search ranks documents using matching words or tokens, often with an algorithm such as BM25. It is strong for names, codes, and exact phrases but may miss paraphrases.
A vector database stores embeddings and supports nearest-neighbor search plus metadata filtering. The surrounding system must keep vectors synchronized with source content and enforce access controls before returning results.
Top K is the number of highest-ranked candidates returned by a retrieval step. Too small a value can omit evidence, while too large a value adds noise and consumes context space.
Metadata such as document ID, title, section, version, date, and permission scope supports filtering, citations, updates, and debugging. It should be derived reliably rather than guessed by the model.
Grounding requires an answer to rely on provided, verifiable evidence rather than only the model's learned patterns. A grounded response should distinguish supported claims, uncertainty, and information absent from the sources.
Citations let users inspect evidence and help evaluators detect unsupported claims. Each citation should point to the source passage that actually supports the nearby statement.
Ingestion collects a source, extracts and cleans its content, divides it into chunks, adds metadata, computes representations, and updates the search index. It should be repeatable, observable, and able to remove superseded material.
RAG retrieves relevant external knowledge and supplies it to a model at query time. It helps with private or frequently changing information and can ground responses in sources. It does not guarantee retrieval quality or prevent the model from misusing context.
Ingestion extracts and cleans documents, splits them into chunks, creates embeddings, and indexes metadata and vectors. At query time, the system transforms the question, retrieves candidates, optionally reranks them, builds context, generates an answer, and returns evidence.
Small chunks are precise but may lose context and increase index entries. Large chunks preserve context but may dilute relevance and consume the model's context window. Use document structure and evaluate chunk size and overlap on representative questions.
Hybrid search combines semantic vector retrieval with lexical methods such as BM25. Vector search captures meaning, while lexical search excels at exact identifiers, error codes, and rare terms. Scores need normalization or fusion, followed by optional reranking.
A reranker applies a more accurate but expensive relevance model to a small initial candidate set. It improves ordering before context construction. It cannot recover a relevant passage that the first-stage retriever never returned.
Build a labeled query set with relevant passages and measure recall at K, precision at K, mean reciprocal rank, or nDCG. Then evaluate answer correctness, faithfulness, citation support, and abstention separately. This identifies whether failures come from retrieval or generation.
Enforce authorization during retrieval using trusted identity and document ACL metadata, not after generation. Filter before context reaches the model, isolate tenants, and re-check access when permissions change. Cached answers and embeddings also need access controls.
It inserts excessive retrieved material in the hope that the answer is present. This raises cost and latency, may distract the model, and can bury relevant evidence. Better retrieval, deduplication, reranking, and context compression produce a smaller, stronger context.
Abstain when retrieval confidence or evidence coverage is below a calibrated threshold, sources conflict, required authorization is absent, or the question lies outside scope. The response should explain the limitation and, when possible, request clarification or offer sources.
Use stable document and chunk IDs, detect created, changed, and deleted content, and update only affected chunks. Version embeddings and preprocessing, process changes idempotently, and monitor freshness lag. Remove stale chunks when source documents are deleted or permissions change.
Easy-medium foundation questions
A large language model learns statistical patterns in token sequences and generates or scores text conditioned on context. It can perform many language tasks, but it does not guarantee factual knowledge or deterministic reasoning.
Tokenization converts text into model-specific integer units and converts generated units back into text. Token counts differ by language, formatting, and tokenizer, so character length is only a rough estimate.
Inference is using a trained model to produce predictions or generated output. It consumes compute and memory but does not normally update the model's learned weights.
Parameters are learned numeric weights that shape a model's output. Parameter count influences capacity and resource needs, but architecture, training data, optimization, and task fit also determine quality.
A transformer processes token representations using attention and feed-forward layers. Attention lets the model weigh relationships among positions in its context, while positional information represents order.
An embedding model converts input into a vector useful for comparison or classification. A generative model predicts output tokens; some systems use separate models optimized for retrieval and answer generation.
Ollama is a tool for downloading, configuring, and running supported language models locally through a command-line interface and API. Local execution improves control but still requires resource planning, updates, and application-level security.
Llama 3 8B refers to an approximately eight-billion-parameter member of Meta's Llama 3 model family. Its actual behavior depends on the exact model variant, prompt format, quantization, runtime, and available hardware.
A similarity score estimates how close two embeddings are under a metric such as cosine similarity or dot product. The number is model- and index-dependent, so thresholds should be calibrated with representative evaluation data.
A FAISS index is a data structure used to search dense vectors efficiently. Different index types trade memory, build time, search speed, and recall, and the application separately stores the source text and metadata associated with vector IDs.
An embedding is a dense numeric representation learned so semantically related inputs tend to be near each other in vector space. Its meaning is model-specific; vectors from different models or versions are generally not directly comparable.
Cosine measures angle and ignores magnitude, dot product includes magnitude, and Euclidean measures straight-line distance. For normalized vectors, ranking by cosine, dot product, and squared Euclidean distance is closely related. Match the metric to how the embedding model was trained.
FAISS is a library for efficient similarity search and clustering over dense vectors. It offers exact and approximate indexes with trade-offs among recall, query speed, memory, build time, and update support. It is not by itself a complete multi-user database with authentication and durable metadata workflows.
Exact search checks enough data to guarantee the nearest results but becomes expensive at scale. Approximate indexes search a smaller candidate space, greatly improving speed and memory efficiency while accepting some recall loss. Measure recall and latency on your real corpus.
The new model defines a different vector space, dimensionality, or normalization. Old document vectors and new query vectors would not have meaningful comparable geometry. Version the model and index together and migrate in a controlled way.
Local inference can improve privacy, offline availability, control, and marginal cost at sufficient utilization. Trade-offs include hardware limits, slower generation, operational ownership, model updates, and sometimes lower quality than hosted models. Measure tokens per second and end-to-end task quality.
Model parameter count, numeric precision or quantization, context length, key-value cache, batch size, and runtime overhead are major factors. Quantization reduces memory and may increase speed but can reduce quality. Long context can make the KV cache substantial even with a quantized model.
Quantization stores or computes model values at lower precision, such as 8-bit or 4-bit rather than 16-bit. It reduces memory and may improve throughput, making local deployment practical. The quality impact depends on method, model, hardware, and task.
Evaluate language and domain coverage, retrieval quality on a labeled dataset, vector size, latency, license, privacy, maximum input, and deployment constraints. Public benchmarks are a filter, not a substitute for evaluation on Oracle C2M questions and documents.
Trace the query transformation, retrieved candidates and scores, filters, reranker, final context, prompt, and generated citations. Classify the failure as corpus, chunking, embedding, retrieval, ranking, context, or generation. Fix and add the case to a regression set.
Easy-medium foundation questions
Three.js is a JavaScript library that provides higher-level objects for rendering 3D graphics with WebGL. It manages scenes, cameras, geometry, materials, lighting, animation, and resource loading.
WebGL is a browser API for GPU-accelerated 2D and 3D rendering through a canvas. It is low level, so libraries such as Three.js commonly manage shaders, buffers, transforms, and draw calls.
A mesh is a renderable object that combines geometry with a material. The geometry defines vertices and surfaces, while the material defines how those surfaces appear under rendering and lighting.
A camera defines the viewpoint and projection used to render the scene. A perspective camera makes distant objects appear smaller, while an orthographic camera preserves object size regardless of depth.
Local coordinates describe a point relative to an object's parent, while world coordinates describe it relative to the scene root. Parent transforms affect a child's world position, rotation, and scale.
The render loop updates animation or simulation state and draws
frames repeatedly, commonly through requestAnimationFrame.
Work inside it must stay bounded because expensive computation or
allocation causes dropped frames.
Delta time is the elapsed time since the previous update. Multiplying rates by delta time makes motion less dependent on frame rate, though stable physics may still require fixed time steps.
A collider is a simplified shape used by a physics engine to detect contact. Simple spheres, boxes, or capsules are faster and often more stable than matching a detailed visible mesh exactly.
A dynamic body responds to forces, impulses, and collisions, while a static body does not move during simulation. Static bodies commonly represent floors, walls, or fixed obstacles.
GPU resources such as geometries, materials, and textures may remain allocated after JavaScript objects are no longer used. Disposing of resources when scenes or assets are replaced prevents memory growth and performance degradation.
A scene graph is a hierarchy of objects with transforms, geometry, materials, lights, and cameras. Child transforms are evaluated relative to parents, simplifying grouped motion. Deep or frequently changing hierarchies can add update cost.
React Three Fiber is a React renderer for Three.js, letting components declaratively describe a Three.js scene and use React state and lifecycle. It does not replace Three.js concepts such as cameras, materials, buffers, render loops, and GPU performance.
Drei supplies reusable helpers and abstractions for React Three Fiber, such as controls, loaders, environment helpers, and useful scene components. These speed development, but their behavior and performance cost still need to be understood.
Frame rates vary across devices. Updating position by a fixed amount per frame makes the simulation run faster at high FPS. Integrating with a time delta, ideally through a fixed physics timestep, makes behavior much more consistent.
Accumulate real elapsed time and execute zero or more physics steps of a constant duration, retaining any remainder for the next frame. Rendered transforms can interpolate between states. Cap catch-up work to avoid a spiral of death after a long stall.
Explicit Euler updates position using old velocity and is simple but unstable for many orbital systems. Semi-implicit Euler updates velocity before position and usually preserves energy better. Verlet variants often provide good stability for position-based motion; no integrator removes the need for appropriate step size.
For bodies with masses m1 and m2, force
magnitude is G*m1*m2/r^2 along their connecting direction.
In vector form, normalize displacement and apply equal and opposite
forces. Avoid division by zero with collision handling or a documented
softening term.
Detect contact, calculate relative velocity along the collision normal, and apply an impulse based on inverse masses and coefficient of restitution. Correct positional overlap separately to prevent sinking. Apply no separating impulse when bodies are already moving apart.
Direct pairwise force calculation is O(n squared) and can be parallelized but still scales poorly. Barnes-Hut uses a spatial tree to approximate distant groups, typically approaching O(n log n), with an accuracy controlled by an opening threshold.
Store a versioned, validated schema containing bodies, physical constants, and relevant view settings; do not serialize runtime objects. Use stable units, reject non-finite or unsafe values, migrate older versions, and make loading transactional so invalid presets do not corrupt current state.
Easy-medium foundation questions
Scalability is a system's ability to handle growth in load, data, or users without unacceptable performance or cost. It depends on identifying the resource that becomes constrained rather than adding capacity blindly.
Reliability is the probability that a system performs its intended function correctly over a defined period and conditions. It includes failure prevention, detection, recovery, and safe degradation.
Availability is the proportion of time a service is usable as expected. It is influenced by failure frequency and recovery time, and must be measured from a user-relevant boundary.
A unit test verifies a small piece of behavior in isolation and should be fast and deterministic. It is most valuable when it tests observable outcomes and important edge cases rather than internal implementation steps.
An integration test verifies that components work together across a real boundary such as a database, filesystem, or API contract. It catches configuration and interaction problems that isolated tests cannot.
An end-to-end test exercises a complete user workflow through the deployed or packaged system. It gives broad confidence but is slower and more fragile, so a focused set should cover critical journeys.
Continuous integration automatically builds and checks changes as they are merged or proposed. Fast, repeatable tests and static checks expose integration problems early and keep the main branch releasable.
A regression test captures behavior that previously failed or must remain stable. Adding one with a bug fix helps ensure later changes do not reintroduce the same defect.
A rollback restores a previously known-good application or configuration after a bad release. It must be planned and tested, especially when a release changes persistent data in a non-backward-compatible way.
Observability is the ability to understand a system's internal state from outputs such as metrics, logs, traces, and domain events. Useful signals should support concrete questions about user impact and failure causes.
It proves meaningful adoption if the figure is measured accurately. It does not by itself prove concurrency, retention, reliability, or backend scale, especially for a mostly local desktop app. Be precise about downloads, active users, measurement period, and telemetry source.
With informed consent, collect version, OS, success and failure counts, crash reports, latency, and coarse feature use. Minimize identifiers and content, publish a privacy policy, support opt-out, protect the data, and never collect game files or paths unnecessarily.
Use automated tests and signed artifacts, then a staged or canary rollout to a small cohort. Monitor crashes and critical workflows, pause on thresholds, and retain a tested rollback path. Schema changes must remain backward-compatible during the rollout.
Use many fast unit tests, fewer integration tests across real boundaries, and a small set of end-to-end tests for critical user journeys. The exact shape depends on risk; filesystem and updater integrations deserve realistic tests even if they are slower.
Run against isolated temporary directories with synthetic archives and a fake or local HTTP server. Test permissions, locks, traversal, corruption, insufficient space, cancellation, and injected crashes. Assert both final files and cleanup or rollback invariants.
Formatting, linting, type checking, unit and integration tests, dependency and secret scans, reproducible builds, and platform-specific packaging. Protect signing credentials in a restricted release job. Keep feedback fast by parallelizing independent checks and caching safely.
Conventionally, major versions contain incompatible changes, minor versions add backward-compatible features, and patches contain backward-compatible fixes. Pre-1.0 projects often evolve more freely, so publish the compatibility policy rather than relying on numbers alone.
An SLI is a measured indicator such as successful installation rate. An SLO is an internal target for that indicator. An SLA is an external commitment with defined consequences; desktop projects may use SLOs without offering a formal SLA.
Capture reproducible steps, version, OS, expected and actual behavior, logs with consent, frequency, and impact. Deduplicate reports, prioritize severity and affected users, communicate workarounds, and close the loop after release. Treat uploaded files and logs as untrusted and potentially sensitive.
Start with versioned telemetry, crash traces, correlation IDs, environment differences, and a precise timeline. Reproduce in an isolated matching environment, narrow with hypotheses or added safe instrumentation, and ship the smallest verified fix through staged rollout. Add a regression test afterward.
Easy-medium foundation questions
A customer information system manages customer accounts, service agreements, billing, payments, and related interactions for a utility. Its records and workflows often connect to metering, field service, finance, and regulatory processes.
A smart meter measures consumption and can communicate readings or events electronically. Its interval data can support billing and operations, but it also requires validation, privacy controls, and handling for communication gaps.
Meter data management collects, validates, estimates, edits, and stores meter readings for downstream uses. It reconciles raw device data with quality rules before billing or analytics rely on it.
A service agreement represents the terms under which a customer receives and is billed for a service at a premise or account. Exact terminology and relationships depend on the configured product and organization.
A billing cycle is the recurring schedule on which accounts are selected, usage is calculated, charges are produced, and bills are issued. Exceptions such as missing reads or account changes must be handled according to business rules.
A domain-specific assistant can retrieve controlled product documentation, preserve specialized terminology, enforce domain permissions, and follow tailored escalation rules. It still needs expert evaluation because fluent output does not establish correctness.
The frontend collects the user's question and relevant context, displays streamed answers and citations, and supports feedback or escalation. It should expose uncertainty clearly and avoid placing sensitive authorization logic only in the browser.
The backend authenticates requests, validates input, applies access rules, performs retrieval and model calls, and records safe operational telemetry. It shields credentials and privileged data sources from the frontend.
Role-based access control limits features and data according to job responsibilities. It helps prevent a broadly useful assistant from revealing customer, billing, configuration, or operational information to unauthorized users.
An audit trail records who asked, what authorized sources were used, what answer or action was produced, and when it occurred. With suitable redaction and retention, it supports incident review, compliance, debugging, and quality improvement.
C2M supports utility customer and meter operations, bringing customer care and billing together with meter-data-related processes. In an interview, describe only the modules and workflows you actually encountered rather than implying full product expertise.
C2M troubleshooting spans product documentation, configurations, error messages, business processes, and organization-specific runbooks. RAG can retrieve relevant procedures and evidence faster, but access control and expert validation are essential because incorrect guidance can affect billing or customer operations.
It contains acronyms, version-specific behavior, tables, screenshots, code values, duplicated pages, and local customizations. Extraction must preserve structure and metadata such as module, version, environment, and effective date. Exact lexical retrieval is valuable for error codes.
Tag every document and chunk with product version and validity dates, obtain the user's target environment, and filter retrieval before ranking. If version is unknown or evidence conflicts, ask for clarification and state the uncertainty.
State the likely interpretation, cite the exact supporting sources, list safe diagnostic steps, distinguish read-only checks from changes, note prerequisites and rollback, and specify when to escalate. Do not invent commands or configuration values absent from trusted evidence.
Apply least privilege, tenant and environment isolation, encryption, audit trails, retention limits, and redaction of account and personal data. Enforce authorization before retrieval and prevent sensitive prompts or documents from entering uncontrolled logs or external models.
Create representative questions with domain experts, expected evidence, acceptable answers, and dangerous failure cases. Measure retrieval recall, answer correctness, faithfulness, citation validity, abstention, latency, and task completion. Segment results by module and version.
Capture structured reasons such as wrong source, outdated version, missing step, or unclear wording, linked to the trace and permissions. Review feedback rather than training directly on it, fix corpus or pipeline causes, and add confirmed cases to regression tests.
Escalate when evidence is missing or conflicting, the request requires unauthorized data, a change is high-impact, or diagnosis depends on live system state the assistant cannot verify. Provide the retrieved evidence and next diagnostic information needed instead of bluffing.
Use a precise STAR answer: the C2M support problem, your responsibility in the React/Tailwind and Flask/RAG system, a technical decision you personally made, how you tested it, and the observed outcome. Separate team architecture from your own code and state one improvement you would make now.
| Interview direction | Prepare first |
|---|---|
| General software engineer | DSA; OOP/design; JavaScript/TypeScript; React; web/API; testing and reliability |
| Python/backend engineer | Python; Flask; web/API; data structures; cloud; RAG |
| Security/SecOps engineer | SOC/SIEM; UDM parsing; YARA-L; SOAR/IR; BigQuery/Looker; cloud IAM |
| AI/RAG engineer | RAG; embeddings/FAISS; LLM inference; Python/Flask; evaluation; security |
| Rust/Tauri engineer | Rust; Tauri; file/archive safety; TypeScript/React; release engineering |
| Frontend/3D engineer | React; JavaScript/TypeScript; React Three Fiber/Drei; physics; performance |