Csharp System Design Questions

C# and System Design Interview Question Bank

Use this sheet for rapid-fire practice. Aim to answer each question out loud with concise bullet points and relevant examples from your experience. Sample answers are included to self-check coverage; adapt wording to your own experience.

C# Language & Runtime

• Question: Explain the difference between value types and reference types. How do ref, out, and in parameters influence behavior?
• Answer: Value types live inline and copy by value; reference types live on the managed heap and are passed by reference to objects. ref passes a variable by reference for both read/write, out requires assignment inside the method, and in passes by readonly reference to avoid copies for large structs.
• Question: How does the garbage collector work (generations, LOH, GC modes), and when would you use GC.TryStartNoGCRegion?
• Answer: .NET uses generational GC (0/1/2) plus the Large Object Heap; short-lived objects stay in gen0/1, long-lived survive to gen2/LOH. Workstation vs server modes tune throughput/latency. Use GC.TryStartNoGCRegion for short, allocation-free critical windows (e.g., low-latency operations) and call EndNoGCRegion afterward.
• Question: Describe how IDisposable and the using/await using patterns work. When do you need a finalizer?
• Answer: IDisposable.Dispose releases unmanaged resources deterministically via using/await using to ensure disposal on success or exception. Finalizers are a safety net for unmanaged handles when Dispose is missed; combine with SafeHandle and GC.SuppressFinalize after successful disposal.
• Question: Compare struct vs class trade-offs. When is readonly struct appropriate?
• Answer: Structs avoid heap allocations and have value semantics but can copy frequently and suffer boxing; classes allow inheritance, reference semantics, and polymorphism. Use readonly struct for small immutable value objects (e.g., coordinates, money types) to prevent defensive copies.
• Question: How do you design immutable types in C#? What are common pitfalls when exposing collections?
• Answer: Make fields private, set via constructor, expose get-only properties, avoid setters/mutable state, and return defensive copies or IReadOnlyCollection<T>/ImmutableArray<T>. Avoid exposing mutable lists or arrays directly to prevent external mutation.
• Question: Explain covariance and contravariance in generics. How do in and out keywords affect interfaces and delegates?
• Answer: Covariance (out) lets you use a more derived return type (e.g., IEnumerable<Derived> as IEnumerable<Base>); contravariance (in) allows consuming base types (e.g., IComparer<Base> for Derived). Delegates/interfaces marked out support producing types; in supports consuming types; both restrict usage (no in params on out types).
• Question: When would you use Span<T>/Memory<T>? What are their constraints in async and iterator methods?
• Answer: Use for high-performance, allocation-free slicing over contiguous memory (stackalloc, arrays, native buffers). Span<T> is stack-only and cannot escape to async/iterator state machines; use Memory<T>/ReadOnlyMemory<T> for heap-backed, async-friendly scenarios.
• Question: How do nullable reference types work? How do you enable them and handle warnings effectively?
• Answer: Enable via #nullable enable or <Nullable>enable</Nullable> to distinguish nullable vs non-nullable references. The compiler tracks null flow and issues warnings; address via proper initialization, null checks (! sparingly), and annotations (?, [NotNull], [MaybeNull]).
• Question: What are the differences between dynamic dispatch (virtual/override), explicit interface implementation, and pattern matching dispatch?
• Answer: Virtual/override uses v-table dispatch on runtime type; explicit interface implementation hides members unless accessed through the interface; pattern matching dispatch uses switch expressions/is checks to branch on types/shapes at runtime without inheritance.
• Question: How do records differ from classes and structs? When would you choose each?
• Answer: Records prioritize value-based equality and with-expressions; record class is reference-based, record struct is value-based. Use records for immutable data models/DTOs with equality semantics; use classes for behavior-heavy types; structs for small value types where copying is cheap.

Async, Parallelism & Concurrency

• Question: Describe the async/await state machine and how the SynchronizationContext affects continuations.
• Answer: The compiler rewrites async methods into state machines that schedule continuations on await completion. SynchronizationContext (or TaskScheduler) determines where continuations run; in ASP.NET Core the context is minimal so continuations may hop threads, while UI contexts marshal back to the UI thread unless ConfigureAwait(false) is used.
• Question: When would you use Task.Run versus async I/O? How do you avoid thread pool starvation?
• Answer: Use Task.Run for CPU-bound work; prefer async I/O to avoid blocking threads for I/O. Avoid starvation by keeping synchronous blocking off async paths, using ConfigureAwait(false) where appropriate, and measuring thread pool queues (EventCounters/PerfView) to detect exhaustion.
• Question: How do you handle cancellation and timeouts cooperatively? Show how to link multiple CancellationTokenSource instances.
• Answer: Pass CancellationToken through APIs, check ThrowIfCancellationRequested, and use using var cts = CancellationTokenSource.CreateLinkedTokenSource(token1, token2); combined with CancelAfter for timeouts. Ensure resources are disposed and operations honor the token.
• Question: Compare SemaphoreSlim, lock, Monitor, and ReaderWriterLockSlim. When is each appropriate?
• Answer: lock/Monitor provide mutual exclusion within a process; Monitor offers advanced features (pulse/wait). SemaphoreSlim supports async waiting and limited concurrency; ReaderWriterLockSlim allows multiple readers/single writer. Choose based on async support and contention patterns.
• Question: How do you design a producer/consumer pipeline in C#? When would you pick System.Threading.Channels over TPL Dataflow or Reactive Extensions?
• Answer: Use bounded/unbounded channels, async readers/writers, and background consumers with cancellation and backpressure. Channels give low-overhead primitives; TPL Dataflow adds richer blocks/linking; Rx suits push-based composable queries. Use channels for lightweight server pipelines with tight control.
• Question: Explain the difference between IAsyncEnumerable<T> and IEnumerable<T>. How do you cancel async streams?
• Answer: IEnumerable<T> is synchronous pull; IAsyncEnumerable<T> is async pull with await foreach. Cancel via await foreach (var item in source.WithCancellation(token)) or pass tokens into producers; dispose async enumerators to stop work.
• Question: How do you detect and mitigate deadlocks in async code (e.g., ConfigureAwait(false), avoiding .Result/.Wait(), using timeouts)?
• Answer: Avoid blocking on async (.Result/.Wait()), use ConfigureAwait(false) to prevent context captures where safe, add timeouts and cancellation, use async all the way. Detect via dump analysis (Sync-over-async stacks), ETW traces, and logging of pending tasks.
• Question: What tools and techniques do you use for profiling and diagnosing performance issues in async-heavy services?
• Answer: Use dotnet-trace/dotnet-counters, PerfView, EventPipe, Application Insights/OpenTelemetry traces, and BenchmarkDotNet for microbenchmarks. Correlate spans/logs and sample flame graphs to find hotspots/allocations.

Collections, LINQ & Data Access

• Question: How do IEnumerable<T>, IQueryable<T>, and IAsyncEnumerable<T> differ? When is deferred execution helpful or harmful?
• Answer: IEnumerable<T> is in-memory synchronous enumeration; IQueryable<T> builds expression trees for remote providers; IAsyncEnumerable<T> streams asynchronously. Deferred execution enables composability and avoids work until iteration but can surprise with repeated queries or side effects; materialize when needed.
• Question: Explain how LINQ query operators translate to SQL in EF Core. What are common pitfalls (client eval, N+1 queries, Include vs projection)?
• Answer: EF Core converts expression trees to SQL; unsupported methods fall back to client eval (often disabled). Avoid N+1 by using projections or Include judiciously; prefer shape-specific projections for performance and to reduce payloads.
• Question: How do you design efficient pagination and filtering for large datasets? Compare keyset pagination to offset/limit.
• Answer: Use indexed filters, stable sort keys, and limit projections. Offset/limit is simple but slow at high offsets; keyset (seek) pagination uses WHERE key > lastKey ORDER BY key for faster scans and consistent latency.
• Question: What strategies help manage memory when processing large collections (buffering, streaming, batching)?
• Answer: Stream results with AsAsyncEnumerable, process in batches, use pagination, avoid materializing large lists, and use ArrayPool<T>/MemoryPool<T> when appropriate.
• Question: How do you model relationships in EF Core (owned types, value objects, many-to-many) and enforce invariants?
• Answer: Use owned types/value objects for aggregate-internal concepts, configure many-to-many with join entities when extra data is needed, and enforce invariants in the domain layer (constructors/factories) with validation in DbContext configurations.
• Question: Describe optimistic concurrency control in EF Core. How do you detect and resolve conflicts?
• Answer: Use concurrency tokens (rowversion/timestamps) so EF includes them in WHERE clauses; conflicts throw DbUpdateConcurrencyException. Resolve by refreshing values, client- Question: or store-wins policies, or merging changes before retrying.

APIs & ASP.NET Core

• Question: Walk through the ASP.NET Core middleware pipeline. How do you add global exception handling and request logging?
• Answer: Requests flow through middleware in order. Add early middleware for correlation IDs and logging, use UseExceptionHandler/UseDeveloperExceptionPage for global handling, and UseSerilogRequestLogging or custom middleware for structured logs before routing.
• Question: How do you implement authentication and authorization (JWT, cookies, policies, claims transformations)?
• Answer: Configure authentication schemes (JWT bearer, cookies, OAuth/OIDC). Add authorization policies with requirements/handlers, use [Authorize(Policy="name")], and add claims transformation for enrichment after authentication.
• Question: Compare minimal APIs, traditional controllers, and gRPC services. When would you choose each?
• Answer: Minimal APIs are lightweight for small services/HTTP endpoints; controllers provide structure, filters, and model binding for larger REST APIs; gRPC offers strongly-typed, high-performance contracts for service-to-service communication.
• Question: How do you version APIs and deprecate endpoints gracefully? What contract testing approaches do you use?
• Answer: Use URL or header-based versioning, maintain parallel controllers/handlers, document deprecations, and add Sunset headers. Use consumer-driven contract tests (e.g., Pact), OpenAPI-based validation, and integration tests to guard contracts.
• Question: How do you secure APIs against common attacks (CSRF, SSRF, SQL injection, deserialization issues, header validation)?
• Answer: Enable antiforgery for cookie-authenticated state-changing actions, validate/whitelist outbound URLs, use parameterized queries/EF Core to avoid injection, restrict JSON options (known types, max depth), validate headers, and apply input validation.
• Question: Describe strategies for rate limiting, throttling, and backpressure in APIs.
• Answer: Use fixed/windowed/token-bucket rate limiting per client/API key, return 429 with Retry-After, apply circuit breakers and queue bounds, and shed load with graceful degradation or priority queues.

Testing, Quality & Observability

• Question: How do you structure unit, integration, and contract tests in a .NET solution? What belongs in each layer?
• Answer: Unit tests target pure logic with mocks; integration tests cover real infrastructure (DB, messaging) and API endpoints; contract tests validate external contracts/consumers. Organize by project with parallel test assemblies and shared fixtures.
• Question: When should you use test doubles (mocks/stubs/fakes) versus in-memory providers? What are the trade-offs of using TestServer or WebApplicationFactory?
• Answer: Use mocks/stubs for isolated logic; in-memory providers can mask behavior differences (e.g., EF in-memory vs SQL). TestServer/WebApplicationFactory enable end-to-end HTTP tests without network; trade-offs are slower execution but higher fidelity.
• Question: How do you test async code and ensure deterministic timing (e.g., virtual time, Task.Delay wrappers)?
• Answer: Avoid real sleeps; abstract timers/delays, use virtual schedulers (Rx TestScheduler), and assert with Task.WhenAny plus timeouts. Use FakeTimeProvider in .NET 8 for deterministic time.
• Question: What metrics, logs, and traces do you collect in production services? How do you correlate them (structured logging, OpenTelemetry)?
• Answer: Collect request rates/latency, error rates, resource utilization, and domain KPIs. Use structured logging with correlation IDs/trace IDs; emit OTLP traces/metrics and link logs via trace context.
• Question: How do you design feature flags and configuration rollouts? How do you test them safely?
• Answer: Use centralized flag service with targeting and audit trails; default to safe values; wrap features with guard rails. Test via dark launches, A/B cohorts, and staged rollouts; implement kill switches and config validation on startup.

Security & Performance

• Question: How do you handle secrets in .NET apps (user secrets, Key Vault, environment variables, Kubernetes secrets)?
• Answer: Store secrets outside code in user secrets for local dev, environment variables for simple deployments, managed secret stores (Azure Key Vault, AWS Secrets Manager), or Kubernetes secrets mounted/injected. Use IConfiguration binding and rotation-friendly design.
• Question: What are common pitfalls with HttpClient? When would you use HttpClientFactory and why?
• Answer: Creating per-request clients causes socket exhaustion; forgetting timeouts leads to hung calls. HttpClientFactory manages handler lifetimes, pooling, Polly policies, and typed/named clients for configuration reuse.
• Question: How do you cache effectively in .NET (MemoryCache, distributed cache, cache invalidation strategies, cache stampede prevention)?
• Answer: Choose MemoryCache for single-instance, distributed cache (Redis) for multi-instance. Set TTLs, use versioned keys, and handle stampedes with locks/async initialization. Implement cache-aside or write-through/write-behind depending on consistency needs.
• Question: How do you approach performance tuning (benchmarking with BenchmarkDotNet, profiling allocations, minimizing boxing)?
• Answer: Benchmark critical code with BenchmarkDotNet, profile CPU/allocations with PerfView/dotnet-trace, reduce allocations/boxing, pool objects, and measure before/after with metrics.
• Question: Describe strategies for minimizing locking and contention in high-throughput services.
• Answer: Prefer lock-free/low-contention structures (Concurrent collections, channels), shard state, reduce shared mutable data, use async I/O to free threads, and batch work.
• Question: How do you approach secure serialization/deserialization (System.Text.Json settings, preserving type safety, limiting payload size)?
• Answer: Restrict known types, set max depth/buffer size, validate input, avoid polymorphic deserialization of untrusted data, and use JsonSerializerOptions with safe defaults (ignore comments, forbid trailing commas if needed).

System Design Fundamentals

• Question: How do you clarify functional and non-functional requirements before proposing an architecture?
• Answer: Elicit user journeys, data flows, SLAs (latency, availability), throughput goals, compliance, and constraints. Confirm priorities and success metrics before sketching architecture.
• Question: Compare monolith, modular monolith, and microservices. What criteria drive the choice?
• Answer: Monolith is simplest to deploy; modular monolith enforces boundaries while staying single-deployable; microservices enable independent scaling and team autonomy but add ops/observability overhead. Choose based on team size, domain complexity, deployment independence, and reliability needs.
• Question: How do you approach capacity planning and load estimation? What metrics do you need before sizing components?
• Answer: Gather QPS/RPS targets, payload sizes, P99 latency goals, growth rates, and traffic patterns. Model peak vs average, back-of-envelope compute/storage estimates, and validate with load tests.
• Question: How do you design for elasticity and fault isolation? When do you use horizontal vs vertical scaling?
• Answer: Use stateless services with autoscaling, bulkheads per resource, and isolation per tenant/feature. Prefer horizontal scaling for resilience and elasticity; vertical scaling for quick wins or stateful components when horizontal is hard.
• Question: Explain consistency models (strong vs eventual). When is each acceptable? How would you implement them?
• Answer: Strong consistency guarantees immediate visibility; eventual allows stale reads for availability/latency. Use strong for critical invariants (payments, inventory) and eventual for read-heavy, latency-sensitive scenarios via async replication, caches, or queues.
• Question: How would you handle schema evolution and backward compatibility in distributed systems?
• Answer: Use additive changes first, versioned contracts/schemas, tolerant readers, feature flags, and dual-write/read paths during migrations. Maintain backward compatibility until all consumers upgrade; use blue/green migrations and data backfills.

Data, Storage & Caching

• Question: How do you choose between relational and NoSQL stores for a given workload? When would you pair them (polyglot persistence)?
• Answer: Relational offers strong consistency and rich queries; NoSQL offers scalability and flexible schemas. Use polyglot when different workloads need different guarantees (e.g., SQL for transactions, NoSQL for analytics/search or high-velocity writes).
• Question: How do you design read/write paths for high-traffic services (CQRS, read replicas, write-through vs write-behind caching)?
• Answer: Separate reads/writes with CQRS, use read replicas for scale, and apply caching. Write-through updates cache synchronously; write-behind buffers writes for throughput but risks loss—guard with durable queues/outbox.
• Question: How would you design a multi-tenant data model? What isolation strategies do you consider?
• Answer: Options: shared schema with tenant keys, separate schemas, or separate databases. Consider noisy-neighbor isolation, encryption per tenant, throttling, and routing based on tenant metadata.
• Question: What strategies ensure data durability and disaster recovery (backups, snapshots, multi-region replication, RPO/RTO)?
• Answer: Automate backups with tested restores, snapshots for speed, multi-AZ/region replication, and define RPO/RTO targets with failover runbooks and chaos drills.
• Question: How do you design cache invalidation and freshness policies (TTL, versioned keys, soft expiration, cache warming)?
• Answer: Use TTLs with jitter, version keys on schema changes, apply soft expiration with background refresh, and warm caches on deploy/scale events for consistent latency.

Messaging, Eventing & Streaming

• Question: Compare message brokers (RabbitMQ, Kafka, Azure Service Bus). How do you choose among them?
• Answer: RabbitMQ excels at flexible routing/low latency; Kafka offers high-throughput ordered logs and retention; Service Bus provides managed queues/topics with dead-lettering. Choose based on throughput, ordering, retention, and operational preferences.
• Question: How do you design at-least-once, at-most-once, and exactly-once processing semantics? What trade-offs exist?
• Answer: At-least-once retries can duplicate work—requires idempotency. At-most-once avoids duplicates but risks loss. Exactly-once is approximated via idempotent writes/transactions; increases complexity and latency.
• Question: How would you implement the outbox pattern? When is it necessary?
• Answer: Store outgoing events in the same DB transaction as state changes, then relay via background publisher to the broker, marking sent messages. Necessary when bridging DB and message broker to avoid lost/duplicated events.
• Question: How do you design idempotent consumers and handle poison messages? What is a dead-letter queue strategy?
• Answer: Use idempotency keys, dedup tables, or UPSERTs; make handlers side-effect-safe. Send repeatedly failing messages to DLQ with metadata, alert, and provide replay/fix workflow.
• Question: How do you handle ordering guarantees in distributed event streams? When do you shard by key vs use single partitions?
• Answer: Preserve order per key by routing to the same partition; single partition guarantees order globally but limits throughput. Shard by key for scalability while maintaining per-entity ordering; include sequence checks to detect gaps.
• Question: How would you build a real-time streaming pipeline for pricing or telemetry data? How do you manage backpressure?
• Answer: Ingest via Kafka/Event Hubs, process with streaming processors, and serve via caches/WebSockets. Manage backpressure with bounded queues, rate limits, scaling consumers, and dropping/aggregating non-critical data when overloaded.

Reliability, Resilience & Operations

• Question: How do you design circuit breakers, retries with jitter, and bulkheads? When should retries be disabled?
• Answer: Circuit breakers open on failure thresholds to stop thundering herds; retries with jitter spread load; bulkheads isolate resources (connection pools, queues). Disable retries for non-idempotent operations or when failures are persistent (e.g., validation errors).
• Question: What strategies help with graceful degradation and feature kill switches during incidents?
• Answer: Provide fallback responses, disable non-essential features via flags, reduce quality (smaller payloads), and prioritize core paths. Kill switches should be fast, central, and auditable.
• Question: How do you design health checks, readiness checks, and liveness checks for microservices? How should orchestrators react?
• Answer: Liveness detects stuck processes (restart); readiness ensures dependencies are available before traffic; health checks cover domain-level checks. Orchestrators should remove from load balancers on readiness fail and restart on liveness fail.
• Question: How do you approach blue/green or canary deployments? What telemetry do you watch during rollouts?
• Answer: Deploy to a green environment or small canary slice, route partial traffic, and compare metrics. Watch error rates, latency, saturation, and business KPIs; roll back quickly on regressions.
• Question: How do you perform chaos testing or game days? What metrics indicate resilience?
• Answer: Inject faults (latency, outages) in lower environments or controlled prod; observe recovery times, alerting, and SLO adherence. Metrics: success rate, recovery time, saturation, error budgets consumed.
• Question: How do you detect and mitigate cascading failures in distributed systems?
• Answer: Use bulkheads, timeouts, circuit breakers, load shedding, and backpressure. Monitor dependency health and propagate cancellation; design graceful degradation to localize failures.

API & Client Experience

• Question: How do you design contracts for longevity (e.g., tolerant readers, additive changes, schema registries)?
• Answer: Favor additive, backward-compatible changes; require tolerant readers; use versioned schemas/OpenAPI and registries; deprecate slowly with clear communication.
• Question: What strategies help ensure backward compatibility for mobile or desktop clients with long upgrade cycles?
• Answer: Maintain old versions, use feature flags/capability negotiation, avoid breaking changes, and design server defaults to match legacy behavior. Provide migration guides and staged sunsets.
• Question: How do you design pagination, filtering, and sorting APIs at scale? When would you expose GraphQL vs REST?
• Answer: Provide consistent pagination models (cursor/keyset preferred), allow filter/sort on indexed fields, and cap page sizes. Use GraphQL for flexible client-driven data shaping; REST for simpler, cache-friendly endpoints.
• Question: How do you model eventual consistency to users (progress states, compensating actions, retries in UI)?
• Answer: Show intermediate states (pending/processing), allow idempotent retries, surface tracking IDs, and implement compensating actions (undo/cancel) when background work fails.

Domain-Driven Design & Architecture

• Question: How do you identify bounded contexts and anti-corruption layers? When would you use domain events?
• Answer: Map language and workflows to find cohesive domains; use ACLs to translate between contexts and protect models. Emit domain events to decouple side effects within a boundary.
• Question: How do you enforce invariants and aggregate boundaries? What belongs inside vs outside an aggregate?
• Answer: Keep invariants enforced inside aggregate methods/constructors; only expose behaviors that preserve rules. Keep transactional consistency within aggregates; reference others by ID; put long-running workflows outside (sagas/process managers).
• Question: How do you design module boundaries to reduce coupling in a large solution? How do you keep assemblies from becoming god projects?
• Answer: Use clear namespaces, internal visibility, and dependency rules (architecture tests). Limit shared kernels, favor feature folders/modules, and enforce public APIs per module.
• Question: What is your approach to layering (API, application, domain, infrastructure) and cross-cutting concerns?
• Answer: API layer handles transport, application orchestrates use cases, domain holds business logic, infrastructure implements persistence/messaging. Cross-cutting concerns use decorators/middleware/aspects without leaking into domain.

Trade & FinTech Scenarios (if relevant)

• Question: How would you design a price streaming service with fan-out to WebSocket clients and downstream analytics?
• Answer: Ingest market data into a durable bus (Kafka), normalize, cache latest prices, and fan-out via WebSockets/SignalR with backpressure. Persist ticks for analytics and snapshots; shard by symbol for ordering.
• Question: How do you design an order lifecycle with validation, risk checks, routing, and post-trade reconciliation?
• Answer: Use a state machine per order, apply pre-trade validations and risk limits, route via smart router to venues, capture executions, and reconcile with clearing/ledgers. Ensure idempotent events and audit trails.
• Question: How do you build a reliable FIX/FAST/REST gateway for external brokers? How do you handle sequence gaps and retries?
• Answer: Implement session management, heartbeats, and sequence tracking; persist session state; recover gaps via resend requests; throttle/resend with backoff; isolate tenants; and validate messages strictly.
• Question: How would you ensure auditability and traceability for regulatory requirements? What storage and retention strategies do you use?
• Answer: Use append-only logs, immutability (WORM storage), signed/hashed records, and durable retention per regulation. Include correlation IDs for events, maintain tamper-evident trails, and automate exports for compliance.

Behavioral & Collaboration

• Question: Describe a time you had to simplify an over-engineered solution. How did you influence stakeholders?
• Answer: Explain the problem/impact, propose a simpler alternative with cost/benefit, present data (performance/maintainability), run a spike/prototype, and align stakeholders via demos and risk analysis.
• Question: How do you lead technical design reviews? What artifacts do you produce and how do you gather feedback?
• Answer: Prepare a concise design doc (problem, goals, options, trade-offs), diagrams, and risks; share ahead of time, run a structured meeting, capture decisions, and follow up with action items.
• Question: How do you prioritize refactoring and tech debt without slowing feature delivery?
• Answer: Tie debt to measurable risk/impact, bundle refactors with feature work, use small iterative changes, and maintain a prioritized debt backlog with dedicated capacity.
• Question: When mentoring junior engineers, how do you balance guidance with letting them learn through mistakes?
• Answer: Provide guardrails (tests, checklists), pair program, set clear goals, allow safe experiments, and conduct constructive retros to reinforce learning while protecting quality.

---

Use these prompts to self-assess depth, breadth, and clarity. Focus on crisp answers backed by concrete examples from your projects.