Interview Q&A

Answer: SPNETCORE_ENVIRONMENT=Development ✅ Loaded in order of precedence, where later files override earlier ones.

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

• appsettings.json: Base configuration file used across all environments.
• appsettings.{Environment}.json: Environment-specific overrides (e.g.,

Development, Production).

🔧 ASP.NET Core loads them automatically based on the environment:

ASPNETCORE_ENVIRONMENT=Development

✅ Loaded in order of precedence, where later files override earlier ones.

SP.NET Core uses the ASPNETCORE_ENVIRONMENT variable to determine the runtime

environment.

Supported environments (by convention):

• Development
• Staging
• Production

Environment-specific logic can be applied:

if (env.IsDevelopment()) { ... }

lso used to load:

• appsettings.{env}.json
• Startup{env}.cs (in older versions)

Production)

ASP.NET Core uses the ASPNETCORE_ENVIRONMENT variable to determine the runtime

environment.

Supported environments (by convention):

• Development
• Staging
• Production

Environment-specific logic can be applied:

if (env.IsDevelopment()) { ... }

Also used to load:

• appsettings.{env}.json
• Startup{env}.cs (in older versions)

✅ ASP.NET Core supports hierarchical override of config sources:

• Environment variables override appsettings.json:

MyApp__Logging__LogLevel__Default=Warning

• Command line arguments override everything:

dotnet run --Logging:LogLevel:Default=Debug

Inject IConfiguration anywhere:

public class MyService {
private readonly string _apiKey;
public MyService(IConfiguration config) {
_apiKey = config["MySettings:ApiKey"];
}
}

You can also access nested settings via config.GetSection("MySettings").

Bind config to strongly typed objects:

public class MySettings {
public string ApiKey { get; set; }
public int Timeout { get; set; }
}

services.Configure<MySettings>(config.GetSection("MySettings"));

Use via IOptions<MySettings>.

IOptionsMonitor<T>)

• IOptions<T>: Reads settings once at startup.
• IOptionsSnapshot<T>: Gets updated settings per request (for scoped services).
• IOptionsMonitor<T>: Supports change notifications and works in singleton

services.

public MyService(IOptions<MySettings> options) {
var settings = options.Value;
}

Answer: User Secrets (for local dev): dotnet user-secrets init dotnet user-secrets set "MySettings:ApiKey" "secret" Azure Key Vault: builder.Configuration.AddAzureKeyVault(...); ✅ Secure sensitive data like API keys, connection strings, tokens.

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

In appsettings.json:

"Logging": {

"LogLevel": {

"Default": "Information",

"Microsoft": "Warning",

"Microsoft.Hosting.Lifetime": "Information"

}
}

Supports built-in providers: Console, Debug, EventSource, Azure, etc.

Custom configuration through ILogger<T>.

Stored under "ConnectionStrings" section in appsettings.json:

"ConnectionStrings": {

"DefaultConnection":

"Server=.;Database=AppDb;Trusted_Connection=True;"
}

Read via:

var conn = config.GetConnectionString("DefaultConnection");

Or inject via Options pattern.

JSON files support live reload:

builder.Configuration.AddJsonFile("appsettings.json", optional:

false, reloadOnChange: true);

IOptionsMonitor<T> automatically updates bound values when config changes.

🔁 Does not work with all sources (e.g., env vars, command line).

Answer: Using POCOs and Options pattern allows type-safe config: services.Configure&lt;MySettings&gt;(config.GetSection("MySettings")); Use [Required], [Range], etc., to add validation.

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

You can validate bound config using IValidateOptions<T>:

public class MySettingsValidator : IValidateOptions<MySettings> {
public ValidateOptionsResult Validate(string name, MySettings

options) {

if (string.IsNullOrWhiteSpace(options.ApiKey)) {
return ValidateOptionsResult.Fail("ApiKey is

required.");

}
return ValidateOptionsResult.Success;
}
}

Register with DI:

services.AddSingleton<IValidateOptions<MySettings>,

MySettingsValidator>();

Answer: SP.NET Core supports multiple configuration providers: JSON (default) Environment Variables Command Line Args INI files XML files In-memory Azure App Configuration Azure Key Vault Secrets Manager Each can be chained with priority.

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

Answer: Use default values in POCOs or fallback logic: public class MySettings { public string ApiKey { get; set; } = "default-api-key"; } Or: var apiKey = config["MySettings:ApiKey"] ?? "fallback";

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

? "fallback";

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

uthentication &amp; Authorization (JWT, Identity)

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

✅ Best practices:

• Don't log sensitive values
• Use [JsonIgnore] or remove values before logging
• Mask in logs manually:

_logger.LogInformation("Token: {Token}", Mask(token));

• Never store secrets in source-controlled files (appsettings.json)
• Use user-secrets, Key Vault, or environment variables instead

Authentication & Authorization

(JWT, Identity)

Answer: ction (What are you allowed to do?) In ASP.NET Core, both are handled via middleware and attributes like [Authorize], roles, nd policies.

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

• Authentication: Verifying the identity of a user (Who are you?)
• Authorization: Determining if the authenticated user has permission to perform an

action (What are you allowed to do?)

In ASP.NET Core, both are handled via middleware and attributes like [Authorize], roles,

and policies.

SP.NET Core Identity provides a complete solution for:

• User registration & login
• Roles, claims, tokens
• Password hashing
• Two-factor authentication

✅ Setup:

dotnet add package Microsoft.AspNetCore.Identity.EntityFrameworkCore

In Startup or Program.cs:

services.AddIdentity<IdentityUser, IdentityRole>()

.AddEntityFrameworkStores<ApplicationDbContext>()

.AddDefaultTokenProviders();

JWT (JSON Web Token) is a compact, URL-safe token format used for authentication.

✅ Configure JWT auth:

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)

.AddJwtBearer(options => {

options.TokenValidationParameters = new

TokenValidationParameters {

ValidateIssuer = true,

ValidateAudience = true,

ValidateLifetime = true,

ValidateIssuerSigningKey = true,

IssuerSigningKey = new

SymmetricSecurityKey(Encoding.UTF8.GetBytes("your-secret"))

};

});

Use [Authorize] to secure endpoints.

✅ Role-based:

[Authorize(Roles = "Admin")]

✅ Policy-based:

services.AddAuthorization(options => {

options.AddPolicy("CanEdit", policy =>

policy.RequireClaim("EditPermission"));

});

Then use:

[Authorize(Policy = "CanEdit")]

Policy-based gives more flexibility (custom requirements, claims, logic).

Answer: dd claims when creating identity: var claims = new List&lt;Claim&gt; { new Claim(ClaimTypes.Name, user.UserName), new Claim("Permission", "Edit") }; ccess in code: var claim = User.FindFirst("Permission")?.Value;

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.