Question 1

Explain the architecture of your current project end to end.

Accepted Answer

In short: Use the skeleton: business context → frontend (framework, state, auth) → API (layers, validation, errors, logging) → data (EF/Dapper, SQL Server, stored procedures) → security (identity provider, JWT, roles) → delivery (Git, CI/CD, hosting) → your part and one measurable result. Draw the boxes while you speak and keep it to about two minutes; the interviewer will drill into what interests them.

Question 2

What happens when a user clicks "Save" in your Angular/React app until the data is in SQL Server?

Accepted Answer

In short: Form validation → service calls POST /api/... with JSON → interceptor adds the JWT → browser sends CORS preflight if cross-origin → Kestrel → middleware (exception handling, routing, CORS, authentication, authorization) → controller/endpoint → model binding and validation (400 if invalid) → service applies business rules → EF Core tracks the new entity → SaveChangesAsync opens a transaction and runs INSERT → SQL Server checks constraints and commits → API returns 201 Created with the new resource → UI updates the list and shows a message. Errors flow back as ProblemDetails and are shown by the interceptor.

Question 3

What is the difference between authentication and authorization? Which status codes do they return?

Accepted Answer

In short: Authentication proves who the caller is (token, cookie); failure → 401 Unauthorized . Authorization decides what an authenticated caller may do (roles, policies, claims); failure → 403 Forbidden . In ASP.NET Core: UseAuthentication() then UseAuthorization() , [Authorize(Roles = Admin )] or policies.

Question 4

What is CORS and why do you get a CORS error only in the browser?

Accepted Answer

In short: CORS (Cross-Origin Resource Sharing) is a browser protection: JavaScript from origin A (e.g. http://localhost:4200 ) may read a response from origin B ( https://api.example.com ) only if B sends Access-Control-Allow-Origin allowing A. Non-simple requests trigger an OPTIONS preflight. Postman and server-to-server calls don t enforce it. Fix: builder.Services.AddCors(...) with the exact SPA origins and app.UseCors(...) before auth — never AllowAnyOrigin together with credentials.

Question 5

Why do you return DTOs instead of EF entities from an API?

Accepted Answer

In short: Entities expose internal fields (passwords, audit columns), create circular references for JSON, couple the API contract to the database schema, and with lazy loading can trigger extra queries during serialisation. DTOs give a stable contract, only the needed fields, and let you project in SQL ( Select(o = new OrderDto(...)) ) so less data is read.

Question 6

How do you implement paging, sorting and searching in a full stack app?

Accepted Answer

In short: Server-side: the API takes page , size (clamped to a maximum, e.g. 100), sort and q ; EF Core builds Where → OrderBy → Skip/Take , returns { items, total } (or a continuation token for keyset paging on very large tables). SQL needs an index that supports the filter + order. UI: debounce the search box (300 ms), cancel the previous request ( switchMap in RxJS / AbortController ), keep page/sort in the URL query string so links and Back work.

Question 7

Where do you store the JWT in an SPA, and how do you refresh it?

Accepted Answer

In short: Safest: don t expose tokens to JavaScript — use a Backend-for-Frontend that keeps tokens server-side and gives the browser an HttpOnly, Secure, SameSite cookie. If the SPA holds tokens, keep the short-lived access token in memory (not localStorage , which XSS can read) and use refresh-token rotation via the identity provider (MSAL / oidc-client handle this). On a 401 the interceptor refreshes once and retries; if refresh fails, redirect to login.

Question 8

How do you handle errors globally in both the API and the UI?

Accepted Answer

In short: API: AddProblemDetails() + an IExceptionHandler (or exception middleware) maps known exceptions to 400/404/409 and logs unknown ones as 500 with a correlation id; [ApiController] returns validation errors automatically. UI: one HTTP interceptor (Angular) or fetch wrapper (React) maps status codes to field errors, a login redirect, a no permission page, or a toast showing the correlation id; React error boundaries / Angular ErrorHandler catch rendering errors.

Question 9

Explain the N+1 problem and how you detect and fix it.

Accepted Answer

In short: One query loads N parents, then one more query runs per parent to load children (often through lazy loading or a query inside a loop) — 1 + N round trips. Detect it with EF Core logging / Application Insights dependency telemetry / SQL Profiler showing many identical queries. Fix: eager load with Include , or better project only what you need in one query ( Select ), use AsSplitQuery for large graphs, and never query inside a loop.

Question 10

How do you make an API call from Angular and show loading and error states?

Accepted Answer

In short: Inject HttpClient into a service that returns an Observable T ; in the component either subscribe with takeUntilDestroyed() or use the async pipe / toSignal . Keep loading , error and data state (signals or a store), set loading before the call, clear it in finalize , catch errors with catchError . For search, use debounceTime + distinctUntilChanged + switchMap so older requests are cancelled.

Question 11

How do you secure an ASP.NET Core Web API?

Accepted Answer

In short: HTTPS only (HSTS); authentication with JWT bearer from a trusted identity provider; authorization with policies and resource checks (user may only see their own orders — prevents IDOR); input validation; parameterised queries (EF/Dapper do this — never concatenate SQL); rate limiting ( AddRateLimiter ); CORS restricted to known origins; secrets in Key Vault; security headers; no stack traces to clients; dependency scanning in CI; logging without sensitive data.

Question 12

How would you structure a new .NET full stack solution from scratch?

Accepted Answer

In short: Domain, Application, Infrastructure and Api projects (clean architecture), tests projects alongside, and the SPA in its own folder. Dependency rule inwards; DI registers Infrastructure implementations of Application interfaces. Cross-cutting: global error handling with ProblemDetails, validation (FluentValidation), structured logging with correlation ids, health checks, OpenAPI. Start as a modular monolith, one database with schemas per module. Add CI from day one.

Question 13

Your list page takes 8 seconds to load. How do you find and fix the problem?

Accepted Answer

In short: Measure layer by layer: browser DevTools Network (is it the API call or rendering?), API timing / Application Insights (controller vs SQL time), EF Core logs or SQL Profiler for the generated SQL, actual execution plan in SSMS. Typical fixes: server-side paging and projection, a covering index for the filter/sort columns, removing N+1 queries, AsNoTracking , caching reference data, removing .Result blocking, virtualising long lists and lazy-loading the route in the UI. Re-measure after each change and report the before/after numbers.

Question 14

Monolith or microservices for a new product? Justify.

Accepted Answer

In short: Usually a modular monolith first: one deployable, clear module boundaries, one database with separate schemas, in-process calls — simpler to build, test, deploy and debug. Move a module to a microservice when it needs independent scaling, release cadence, technology or team ownership. Microservices add network failures, distributed data and transactions (sagas/outbox), observability and DevOps cost — accept that only for a concrete benefit.

Question 15

The UI shows "CORS error" after you deployed the API to Azure, but it worked locally. What do you check?

Accepted Answer

In short: The CORS policy must include the production SPA origin exactly (scheme + host + port, no trailing slash); UseCors must run before UseAuthentication / UseAuthorization and before the endpoints; Azure App Service s own CORS setting can override the app — use one or the other; the CORS error can also hide a 500 or 404 (a failed preflight or an error page without CORS headers) — check the API logs and the Network tab for the actual status.

Question 16

A user can see another customer's orders by changing the id in the URL. What is wrong and how do you fix it?

Accepted Answer

In short: That is an IDOR (Insecure Direct Object Reference) — broken object-level authorization, the #1 item in the OWASP API Security Top 10. Authentication alone is not enough: the API must check ownership on every request, e.g. filter by the current user s customer id from the token ( Where(o = o.CustomerId == currentUser.CustomerId) ) or use resource-based authorization ( IAuthorizationService.AuthorizeAsync(User, order, OwnsOrder ) ). Return 404 (not 403) to avoid revealing that the id exists, and add tests for it.

Question 17

After a release the API is slow and SQL CPU is at 100%. What do you do?

Accepted Answer

In short: Stabilise first: roll back or scale up if users are blocked. Then find the top queries by CPU (Query Store / sys.dm_exec_query_stats ), compare plans before and after the release — usually a new query without an index, a changed LINQ query producing a bad plan, an N+1 loop, or parameter sniffing. Fix with an index, a rewritten query, forcing the last good plan in Query Store as a stop-gap, and add a performance test or alert so it is caught earlier next time.

Question 18

You are asked to add a "bulk upload products from Excel" feature. Walk through your design.

Accepted Answer

In short: UI: upload control with file type/size checks, shows progress, then a result summary. API: POST multipart, validate size, store the file (Blob Storage), return 202 with an import id. Worker: read with a streaming library (e.g. ClosedXML/ExcelDataReader), validate every row and collect errors, insert in batches ( SqlBulkCopy or EF Core bulk/ ExecuteUpdate ) inside a transaction or into a staging table then MERGE . Status endpoint/SignalR for progress; downloadable error report; idempotent so a retry doesn t duplicate rows; audit who uploaded what.

Question 19

What is the difference between a value type and a reference type?

Accepted Answer

A value type variable holds the data itself ( int , bool , decimal , DateTime , any struct / enum ). Assigning it copies the value. A reference type variable holds a reference to an object on the managed heap ( class , string , arrays, delegates, record ). Assigning it copies the reference, so two variables can point to the same object. csharp Copy var a = new List int (); var b = a; b.Add( 1 ); // a.Count == 1 — same object int x = 1 ; int y = x; y++; // x is still 1 Value types are stored inline (stack for locals, inside the parent object for fields); reference-type objects always live on the heap and are cleaned up by the GC.

Question 20

What is the difference between string and StringBuilder?

Accepted Answer

In short: string is immutable : every concatenation creates a new string object, so building a string in a loop causes many allocations (O(n²) copying). StringBuilder keeps a mutable buffer and appends in place; call ToString() once at the end. Use StringBuilder for loops or many appends, plain strings/interpolation for a handful of pieces.

Question 21

Explain const vs readonly vs static readonly.

Accepted Answer

const : compile-time constant, implicitly static, only primitives/strings; the value is baked into callers at compile time. readonly : instance field assigned at declaration or in a constructor; can differ per object. static readonly : one value per type, computed at runtime (e.g. static readonly HttpClient Client = new() ). Gotcha: if library A has public const int Max = 10 and app B uses it, changing it to 20 in A does nothing in B until B is recompiled. Use static readonly for values that may change.

Question 22

What are boxing and unboxing? Why avoid them?

Accepted Answer

In short: Boxing converts a value type to object (or an interface) by allocating a heap object and copying the value; unboxing casts it back to the exact value type. It costs an allocation, a copy and GC pressure. Typical sources: non-generic collections ( ArrayList ), string.Format with value-type arguments on old APIs, calling interface methods on structs via the interface. Generics remove most boxing.

Question 23

What is the difference between == and .Equals()?

Accepted Answer

In short: For reference types , == compares references unless the operator is overloaded; Equals() is virtual and can be overridden to compare content. string overloads both to compare text. Records generate value-based Equals and == . For value types, Equals compares content. When you override Equals , also override GetHashCode (objects that are equal must have the same hash code, or dictionaries break).

Question 24

What are ref, out and in parameters?

Accepted Answer

All three pass an argument by reference : ref — must be initialised before the call; the method can read and change it. out — need not be initialised; the method must assign it (used by TryParse ). in — read-only reference; avoids copying large structs.

Question 25

Why should you use decimal instead of double for money?

Accepted Answer

In short: double is binary floating point and can t represent many base-10 fractions exactly (0.1 + 0.2 != 0.3), so totals drift by tiny amounts that show up in invoices and reports. decimal stores base-10 digits exactly with 28–29 significant digits. Trade-off: decimal is slower and uses 16 bytes, so use double for scientific/graphics maths and decimal for money and quantities that must add up exactly. In SQL Server map it to DECIMAL(18,2) , not FLOAT .

Question 26

What is the difference between Parse, TryParse and Convert?

Accepted Answer

In short: int.Parse( x ) throws FormatException for bad input (and ArgumentNullException for null). int.TryParse(s, out var n) returns false instead of throwing — use it for user input. Convert.ToInt32(value) accepts many types (object, double, string), returns 0 for null , and rounds doubles to the nearest even number ( Convert.ToInt32(2.5) → 2) whereas a cast truncates ( (int)2.9 → 2). Pass a CultureInfo when parsing numbers and dates from files or APIs.

Question 27

What is the difference between Dictionary and Hashtable?

Accepted Answer

In short: Dictionary TKey,TValue is generic: type-safe, no boxing, faster; a missing key with the indexer throws KeyNotFoundException (use TryGetValue ). Hashtable is the old non-generic version storing object keys/values: needs casts, boxes value types, and returns null for a missing key. Both are hash tables with O(1) average lookup. For multiple threads use ConcurrentDictionary .

Question 28

What is the difference between a multidimensional and a jagged array?

Accepted Answer

In short: A multidimensional (rectangular) array int[,] is one object where every row has the same length, accessed as a[r, c] . A jagged array int[][] is an array of arrays — each row is a separate array and can have a different length, accessed as a[r][c] . Jagged arrays are more flexible and often faster in .NET; rectangular arrays suit fixed grids such as matrices.

Question 29

Explain IEnumerable, ICollection, IList and IQueryable.

Accepted Answer

IEnumerable T : forward-only iteration ( foreach ), deferred execution with LINQ to Objects, runs in memory . ICollection T : adds Count , Add , Remove , Contains . IList T : adds index access and Insert . IQueryable T : builds an expression tree that a provider (EF Core) translates to SQL and runs in the database . csharp Copy db.Orders.Where(o = o.Total 100 ).ToList(); // IQueryable: WHERE in SQL db.Orders.AsEnumerable().Where(o = o.Total 100 ).ToList(); // loads ALL rows then filters in memory

Question 30

What are delegates and events? How do they differ?

Accepted Answer

In short: A delegate is a type-safe function pointer ( Func , Action , custom delegate ). It can be multicast. An event wraps a delegate so outside code can only += / -= handlers; only the declaring class can raise it. This prevents subscribers from wiping out other handlers ( = null ) or raising the event themselves. Pattern: `public event EventHandler ? Changed; and raise with Changed?.Invoke(this, args)`.

Question 31

How does async/await work internally? Does it create a new thread?

Accepted Answer

In short: No new thread is created by await . The compiler turns the method into a state machine . When it hits await on an incomplete task, the method returns to its caller and the thread goes back to the pool. When the I/O completes, a continuation resumes the state machine — on the captured synchronisation context if there is one (UI thread), otherwise on a thread-pool thread. CPU-bound work still needs Task.Run or parallelism to move off the current thread.

Question 32

What is the difference between Task.WhenAll and awaiting tasks one by one?

Accepted Answer

In short: Awaiting sequentially makes total time the sum of the calls; starting all tasks and then await Task.WhenAll(...) makes it roughly the longest single call. WhenAll throws the first exception when awaited, but the returned task s Exception holds all of them. Use WhenAny for first to finish or timeouts.

Question 33

Why is async void dangerous?

Accepted Answer

In short: Callers can t await it, so they can t know when it finishes, and an exception thrown inside crashes the process (it is raised on the synchronisation context instead of being stored in a Task). Use async Task everywhere except event handlers.

Question 34

What is IDisposable and the using statement? Dispose vs Finalize?

Accepted Answer

In short: IDisposable.Dispose() releases unmanaged resources (connections, file handles) deterministically . using guarantees Dispose is called even if an exception is thrown (compiles to try/finally ). A finaliser is called by the GC at an unpredictable time and costs an extra GC cycle; it is only a safety net for raw unmanaged handles. In Dispose call GC.SuppressFinalize(this) if a finaliser exists. Most code just wraps SafeHandle and never writes a finaliser.

Question 35

Explain garbage collection generations.

Accepted Answer

In short: The heap is split into Gen 0 (new objects, collected very often and cheaply), Gen 1 (survivors of Gen 0, a buffer), and Gen 2 (long-lived objects, collected rarely and expensively). Most objects die young, so collecting Gen 0 frequently is efficient. Objects of 85,000 bytes or more go to the Large Object Heap , collected with Gen 2. .NET has workstation and server GC modes, plus background (concurrent) GC for Gen 2.

Question 36

How do you create a custom exception, and when should you?

Accepted Answer

In short: Derive from Exception , end the name with Exception , provide the standard constructors (parameterless, message, message + inner exception) plus constructors/properties for useful data (e.g. Balance , Requested ). Create one only when callers need to catch that specific situation (e.g. InsufficientFundsException → show a friendly message or return 409); otherwise throw the built-in ones ( ArgumentException , InvalidOperationException ). Always pass the inner exception when wrapping.

Question 37

How do you make code thread-safe? Compare lock, Monitor, SemaphoreSlim, Interlocked and concurrent collections.

Accepted Answer

lock (sugar for Monitor.Enter/Exit ): mutual exclusion inside one process, synchronous only. SemaphoreSlim : limits concurrency to N and supports WaitAsync , so use it when you must await inside the critical section. Interlocked : atomic operations on single variables (increment, compare-exchange), lock-free. ConcurrentDictionary / ConcurrentQueue / Channel T : built-in thread-safe structures. Immutability: data that never changes needs no locks. Across processes/servers: database locks, distributed locks (Redis, blob leases), Mutex for the same machine.

Question 38

What causes a deadlock with async code and how do you avoid it?

Accepted Answer

In short: Classic case: in a UI app or old ASP.NET (with a synchronisation context), code calls task.Result . The blocked thread holds the context; the awaited method s continuation needs the same context to resume, so both wait forever. Fixes: go async all the way ( await instead of .Result ), use ConfigureAwait(false) in library code, and never mix blocking and async calls. ASP.NET Core has no synchronisation context, but blocking still causes thread-pool starvation under load.

Question 39

A method builds a CSV of 200,000 rows using += on a string and takes minutes. What do you do?

Accepted Answer

In short: String concatenation in a loop copies the whole string every time, so the work is O(n²). Replace it with a StringBuilder , or better, stream the rows straight to the output ( StreamWriter , or PipeWriter in ASP.NET Core) so the full file is never held in memory. Measure before and after with a stopwatch or BenchmarkDotNet. For huge exports, page the database query and write as you read.

Question 40

Your API's memory keeps growing until the pod restarts. How would you investigate?

Accepted Answer

Confirm the trend with dotnet-counters (GC heap size, Gen 2 count, LOH size). Take memory dumps a few minutes apart with dotnet-dump collect (or dotnet-gcdump ) and compare which types grow, using Visual Studio, PerfView or dotnet-dump analyze ( dumpheap -stat , gcroot ). Usual culprits: static collections or caches with no eviction, event handlers never unsubscribed, HttpClient created per request, undisposed streams/DbContexts, large byte arrays on the LOH, unbounded MemoryCache . Fix (size-limited cache, IHttpClientFactory , using , weak events), then load-test to confirm.

Question 41

Two users update the same in-memory counter and some increments are lost. Why, and how do you fix it?

Accepted Answer

In short: count++ is read, add, write — three steps. Two threads can read the same value and both write value+1, so one increment is lost (a race condition). Fix with Interlocked.Increment(ref count) , a lock , or a concurrent type. If the counter must survive restarts or work across several servers, keep it in the database (`UPDATE ... SET Count = Count + 1 ) or in Redis INCR` instead.

Question 42

What is the CLR and what does it do?

Accepted Answer

In short: The Common Language Runtime is .NET s execution engine. It loads assemblies, verifies type safety, JIT-compiles IL to native code, manages memory with the garbage collector, handles exceptions, threads and synchronisation, provides interop with native code and exposes debugging/profiling services. Code running under it is managed code .

Question 43

What are CTS and CLS?

Accepted Answer

In short: CTS (Common Type System) defines how types are declared and used in .NET — value vs reference types, inheritance, members, visibility — so all languages share one type system (C# int = VB.NET Integer = System.Int32 ). CLS (Common Language Specification) is a subset of CTS rules that every .NET language supports, so a CLS-compliant library can be used from any language (e.g. avoid public unsigned types or names differing only in case).

Question 44

What is IL (MSIL/CIL) and what does the JIT do?

Accepted Answer

In short: IL is the CPU-independent, stack-based intermediate code the C#/VB.NET compilers produce, stored with metadata in assemblies. At runtime the JIT compiles each method s IL to native machine code on its first call, optimised for the actual CPU; tiered compilation starts with quick code and re-compiles hot methods with full optimisation. ReadyToRun and Native AOT precompile to reduce startup time.

Question 45

What is the difference between .NET Framework, .NET Core and .NET 5+?

Accepted Answer

In short: .NET Framework (2002–2019) is Windows-only, installed machine-wide, and now only maintained (4.8.1 last); it has Web Forms, WCF and WWF. .NET Core (2016–2019) was the open-source, cross-platform, high-performance rewrite. .NET 5 (2020) onward unifies them as simply .NET , released every November with LTS versions (6, 8, 10) supported for 3 years. New projects use .NET 8/10.

Question 46

What is managed vs unmanaged code?

Accepted Answer

In short: Managed code runs under the CLR, which handles memory (GC), type safety and exceptions — C#, VB.NET, F#. Unmanaged code runs directly on the OS without the CLR — C/C++ DLLs, Win32 APIs, COM components — and manages its own memory. .NET calls unmanaged code via P/Invoke or COM interop; resources from it must be released with IDisposable / SafeHandle .

Question 47

What is an assembly? What does it contain?

Accepted Answer

In short: The unit of deployment and versioning in .NET — a .dll or .exe containing IL code, metadata describing all types and members, a manifest (name, version, culture, public key token, references) and optional resources. Assemblies can be private (in the app folder), shared in the GAC (.NET Framework) or satellite (localised resources).

Question 48

Explain how the garbage collector works. What are generations?

Accepted Answer

In short: The GC allocates objects by bumping a pointer and, when the gen-0 budget is used up, suspends threads, marks all objects reachable from roots (stack, statics, handles), compacts survivors and updates references. Generations: gen 0 for new objects (collected often and cheaply), gen 1 as a buffer, gen 2 for long-lived objects (full, expensive collections). Large objects (≥ 85,000 bytes) go to the LOH, collected with gen 2 and not compacted by default.

Question 49

Dispose vs Finalize — what's the difference? What is the Dispose pattern?

Accepted Answer

In short: Dispose (from IDisposable ) is called deterministically by your code ( using ) to release resources early; a finalizer ( ~Class() ) is called non-deterministically by the GC s finalizer thread as a safety net for unmanaged resources and makes objects survive an extra GC. The Dispose pattern: Dispose() calls Dispose(true) and GC.SuppressFinalize(this) ; the finalizer calls Dispose(false) ; Dispose(bool disposing) frees managed resources only when disposing is true and unmanaged resources always. Prefer SafeHandle over writing finalizers.

Question 50

Where are value types and reference types stored?

Accepted Answer

In short: Reference-type objects are always on the managed heap; variables hold references to them. Value types are stored inline where they are declared: on the stack (or in registers) for locals, inside the containing object for fields, inside the array for array elements, and on the heap when boxed or captured by closures/async methods. So value types live on the stack is only partly true.

Question 51

Workstation vs Server GC?

Accepted Answer

In short: Workstation GC uses one heap and runs collections on the allocating thread — lower memory and shorter pauses, suited to desktop apps. Server GC creates one heap and one dedicated GC thread per logical core and collects in parallel — higher throughput and allocation rates, more memory, the default for ASP.NET Core. Both support background (concurrent) gen-2 collection; .NET 9 enables DATAS to adapt Server GC heap count to load.

Question 52

How do you find a memory leak in a production .NET application?

Accepted Answer

In short: Confirm growth with dotnet-counters / Application Insights (GC heap size and gen-2 size rising, gen-2 collections not reclaiming). Capture heap snapshots ( dotnet-gcdump ) or full dumps ( dotnet-dump ) at two points in time, compare object counts by type, and find the roots keeping them alive ( gcroot , paths to root ). Typical culprits: unbounded static caches, event handlers not unsubscribed, timers, captive dependencies in DI, undisposed resources, LOH fragmentation from large buffers.

Question 53

An ASP.NET Core API's memory grows steadily until the container is OOM-killed every few hours. What do you do?

Accepted Answer

In short: Monitor GC counters to see if the managed heap (gen 2/LOH) grows or native memory grows. Take two dotnet-gcdump snapshots and compare the biggest growing types; check their roots. Common findings: an in-memory cache without limits, a singleton holding scoped objects or request data, event subscriptions, HttpClient created per request, large response buffering in the LOH. Also set container memory limits correctly (GC respects them), consider DATAS/workstation GC for small containers, and add alerts on memory growth.

Question 54

What are the four pillars of OOP? Explain each with an example.

Accepted Answer

Encapsulation — private state with a controlled public API. BankAccount keeps _balance private and exposes Deposit() that rejects negative amounts. Abstraction — expose what , hide how . IPaymentGateway.ChargeAsync() hides HTTP calls, signatures and retries. Inheritance — a derived class reuses and extends a base. Contractor : Employee reuses Name and Describe() . Polymorphism — the same call behaves differently by type. employee.MonthlyPay() runs the Permanent or Contractor override at runtime.

Question 55

What is the difference between a class and an object?

Accepted Answer

In short: A class is a type definition (blueprint) describing fields, properties and methods; it exists in code and metadata. An object is an instance of that class created at runtime with new , occupying memory with its own state. One class, many objects.

Question 56

What is the difference between method overloading and method overriding?

Accepted Answer

Overloading Overriding Same name, different parameters Same signature in a derived class Same class (or derived) Requires virtual / abstract + override Resolved at compile time Resolved at runtime by the object s type Return type alone can t differ Return type the same (covariant returns allowed since C# 9)

Question 57

What is the difference between an abstract class and an interface? When do you use which?

Accepted Answer

In short: An abstract class can hold state, constructors and shared implementation, and a class can inherit only one. An interface is a contract; a class can implement many, and it has no instance state (default methods are allowed since C# 8). Use an interface for capabilities and dependency injection ( IEmailSender ) and an abstract class when related types share code and state ( Shape , Employee ). A common design is to use both: the interface for consumers, an abstract base for shared code.

Question 58

Does C# support multiple inheritance?

Accepted Answer

In short: Not for classes — a class has exactly one base class, which avoids the diamond problem (ambiguity when two parents implement the same member). A class can implement multiple interfaces . If two interfaces declare the same member, use explicit interface implementation to disambiguate.

Question 59

What are access modifiers? What are the defaults?

Accepted Answer

In short: public , private , protected , internal , protected internal , private protected (plus file for types). Defaults: class members are private ; top-level types are internal ; interface members are public .

Question 60

What is the difference between method overriding and method hiding (new)?

Accepted Answer

In short: With override , the runtime type decides which method runs — true polymorphism. With hiding ( new ), the compile-time variable type decides: A x = new B(); x.Name() calls A.Name() . Hiding breaks polymorphism and is usually a design smell. The compiler warns if you hide a member without the new keyword.

.NET Full Stack Developer — Interview Questions