Microsoft Backend Engineer Interview Questions

I would start by reproducing the failure with a minimal input and checking logs, stack traces, and job payloads. Then I would decide whether the problem is bad data, a code bug, a race condition, or a resource limit. The reason I start there is that worker failures often come from one edge case rather than the whole pipeline design. I would also think about retry limits and whether the failed job should move to a dead-letter queue. Once I know the root cause, I would add validation or safer error handling.

I would separate the file bytes from the metadata. The content would go into object storage, while metadata like owner, name, size, and permissions would live in a database. For large uploads, I would support chunked or resumable transfers so users do not start over if the connection drops. The reason I choose this split is that it keeps the service scalable and makes lookup and authorization simpler. I would also mention signed URLs, antivirus scanning, and CDN support for popular files.

I would assume duplicates can happen because retries and consumer restarts are normal. To make processing safe, I would make the consumer idempotent and keep a record of processed message IDs or results. The reason I choose this direction is that eliminating every duplicate at the transport layer is often harder than making the work safe when duplicates appear. I would also think about how long to keep deduplication records and what to do if a message fails repeatedly. If needed, I would explain the difference between at-least-once and exactly-once processing.

I would first define what counts as activity, because the metric could mean requests, messages, or session time. My design would stream events into an aggregator, keep counts for the current time window, and maintain the top 10 with a small ranking structure. The reason I choose a streaming approach is that it avoids recomputing everything from scratch every minute. I would also talk about sharding, merging partial aggregates, and handling late events. If freshness matters, I would keep the aggregation path low latency.

I would add a rate limiter or gateway protection in front of the API. My first choice would be a token bucket because it allows bursts while still enforcing a long-term limit. The reason I choose this approach is that it protects the backend without punishing normal short spikes too much. I would also discuss whether the limiter state should be shared and whether the system should fail open or fail closed if the limiter store goes down. Related protections like load shedding and circuit breakers would also be worth mentioning.