How do you control how many users can reach your microservice? There are billions of potential users, but you want only ten thousand to get through.

Token bucket when bursts are acceptable, sliding window when the limit must be exact. Fixed window is the cheapest and lets through twice the limit at every window boundary. The single-machine algorithm is the easy half — the real question is where the counter lives once you have more than one instance.

How do you store user details and passwords in AWS?

With a deliberately slow, salted hash — bcrypt, scrypt or Argon2, or PBKDF2 if you cannot add a dependency. SHA-256 is wrong precisely because it is fast: speed is the attacker's budget, and a database leak turns into account takeover at whatever rate your hash allows.

How does Spring Boot manage dependency versions internally?

One version wins and the other is discarded — there is no classpath on which both exist. Maven picks the one declared nearest the root, Gradle picks the highest, so the same dependency set resolves differently under each. Whoever needed the loser then fails at runtime with a linkage error, on first execution of that call site and not before.

Senior Java: Spring Boot internals, and four scenarios

Curated list25 questions

Reported, not verified

These are shared by candidates, not verified by us, and not endorsed or confirmed by the companies named. Everything else on this site is checked on every build; this section is reported rather than verified, and it is kept separate for exactly that reason. Process varies by team, by interviewer and by year, so treat a list as one loop that happened, not as a syllabus you can expect to be repeated.

Source: Posted on LinkedIn as "Most Frequently Asked Scenario-Based Questions for Senior Java Developer Roles", 2026. One person's synthesis of what gets asked at senior level, not a record of a single loop. Reproduced as posted, with the questions grouped by subject.

3 of 25 of these have a deep-dive answer on this site. The rest are not covered yet and are marked so — a gap you can see is more useful than one you cannot.

4 of them are scenarios rather than recall questions, and they are highlighted below. Worth separating, because they are a different thing to prepare: a recall question has an answer you can revise, while a scenario is asking whether you can reason about a production problem and defend the tradeoff you picked.

Messaging and service-to-service calls

0/4 answered here

01
Scenario
You have three microservices, A, B and C. A posts a message to a Kafka topic that B consumes. How does B consume that message and post it to the REST endpoint of C?
Not covered on this site yet.
02
How do you post a message to a REST endpoint, and what is the difference between HttpClient and RestTemplate?
Not covered on this site yet.
03
Scenario
You consume a Kafka message in XML, convert it, and publish it to a downstream topic. The database write succeeds but the publish fails. How do you roll back the database change, and how do you handle this in a microservice?
Not covered on this site yet.
04
Scenario
Design a flow where a message is put somewhere that five different microservices can read from asynchronously. What approaches are there, and why would you pick one?
Not covered on this site yet.

Traffic, security and operations

2/4 answered here

05
Scenario
How do you control how many users can reach your microservice? There are billions of potential users, but you want only ten thousand to get through.
How would you implement a rate limiter? — 13 min
06
How do you store user details and passwords in AWS?
How should a password be stored? — 11 min
07
How do you configure a health check in a Spring Boot application?
Not covered on this site yet.
08
How do you stop anyone outside from hitting the health-check URL of your service, and how do you secure it?
Not covered on this site yet.

Spring Data and Hibernate

0/6 answered here

09
What is the difference between CrudRepository and JpaRepository?
Not covered on this site yet.
10
What is the difference between SessionFactory and EntityManager?
Not covered on this site yet.
11
Which does Spring Data JPA use internally — SessionFactory or EntityManager?
Not covered on this site yet.
12
Which do you use in Hibernate itself — SessionFactory or EntityManager?
Not covered on this site yet.
13
How does Spring communicate with the database, and how does Spring Data JPA do the same?
Not covered on this site yet.
14
How does pagination work in Spring Boot? How do Spring Boot and the database know that only ten records should be fetched at a time? Explain the flow from controller to service to repository.
Not covered on this site yet.

Spring Boot internals

1/11 answered here

15
How does Spring Boot decide which auto-configuration to apply?
Not covered on this site yet.
16
What happens internally when you add the spring-boot-starter-web dependency?
Not covered on this site yet.
17
Why does Spring Boot prefer convention over configuration?
Not covered on this site yet.
18
What is the exact startup flow of a Spring Boot application?
Not covered on this site yet.
19
What happens if you put @Controller, @Service and @Repository on the same class?
Not covered on this site yet.
20
How does Spring Boot detect the embedded Tomcat and configure it?
Not covered on this site yet.
21
How does Spring Boot remove XML configuration completely?
Not covered on this site yet.
22
What is the role of SpringFactoriesLoader?
Not covered on this site yet.
23
How does Spring Boot handle profile-specific configuration?
Not covered on this site yet.
24
How does Spring Boot manage dependency versions internally?
Two libraries need different versions of the same dependency. What happens? — 13 min
25
How does Spring Boot handle externalized configuration?
Not covered on this site yet.

What this list is worth

Somebody’s view of what is worth revising, not a record of an interview. Useful as a checklist of topics you should be able to explain; useless as a guarantee that these are the questions you will get. For patterns across many interviews rather than a single list, the company-type breakdowns are the better guide.

Every other page on this site compiles and runs its code on each deploy and diffs the output against what the page claims. This page cannot work that way — it reports what someone else said — so it is kept in its own section and labelled on every view.