Interview Q&A

Database security refers to the practices, tools, and measures used to protect a database

from unauthorized access, misuse, modification, or destruction of its data. It ensures the

confidentiality, integrity, and availability (often referred to as the CIA triad) of the data stored

within the database.

Why it's important:

• Confidentiality: Protects sensitive data from unauthorized access (e.g., personal

information, financial data).

• Integrity: Ensures data remains accurate, consistent, and unaltered by unauthorized

users.

• Availability: Ensures data is available when needed and prevents disruptions from

threats like ransomware or DDoS attacks.

s data, not executable code.

• - Example in MySQL (using PDO in PHP)

$stmt = $pdo->prepare('SELECT * FROM users WHERE username =

:username AND password = :password');
$stmt->execute(['username' => $username, 'password' => $password]);

• ● Input Validation: Always validate user input by checking for expected data types,

lengths, and ranges.

• Escaping User Input: If parameters cannot be parameterized, make sure all user

input is properly escaped.

• Least Privilege Principle: Limit database user permissions to only those necessary

to perform their tasks.

• Web Application Firewalls (WAF): Use WAFs to detect and block SQL injection

ttacks.

SQL Injection is a type of attack where an attacker inserts or manipulates malicious SQL

code into a query, which can compromise the database. It usually happens when user input

is improperly sanitized or validated.

Prevention techniques:

Use Prepared Statements/Parameterized Queries: This ensures that user input is treated

as data, not executable code.

• - Example in MySQL (using PDO in PHP)

$stmt = $pdo->prepare('SELECT * FROM users WHERE username =

:username AND password = :password');

$stmt->execute(['username' => $username, 'password' => $password]);

• Input Validation: Always validate user input by checking for expected data types,

lengths, and ranges.

• Escaping User Input: If parameters cannot be parameterized, make sure all user

input is properly escaped.

• Least Privilege Principle: Limit database user permissions to only those necessary

to perform their tasks.

• Web Application Firewalls (WAF): Use WAFs to detect and block SQL injection

attacks.

fter the full backup until the specified point in time.

SQL Server Example:

RESTORE DATABASE MyDatabase FROM DISK = 'C:\Backups\MyDatabase.bak';

RESTORE LOG MyDatabase FROM DISK = 'C:\Backups\MyDatabase_log.trn'

WITH STOPAT = '2023-09-14T15:30:00'; -- Restore up to a specific

time

PostgreSQL Example:

To enable point-in-time recovery, you need to restore a base backup, then use WAL

(Write-Ahead Logging) archives to apply changes until the desired point.

• You would also set the restore_command in recovery.conf and specify the

recovery_target_time.

Point-in-time recovery (PITR) allows you to restore a database to a specific moment in

time, which can be crucial in scenarios where:

• Data corruption or accidental deletion occurs.
• You want to rollback to a specific moment before a harmful event.

How it works:

• First, a full backup is restored.
• Then, transaction log backups are applied, allowing you to replay changes made

after the full backup until the specified point in time.

SQL Server Example:

RESTORE DATABASE MyDatabase FROM DISK = 'C:\Backups\MyDatabase.bak';

RESTORE LOG MyDatabase FROM DISK = 'C:\Backups\MyDatabase_log.trn'

WITH STOPAT = '2023-09-14T15:30:00'; -- Restore up to a specific

time

PostgreSQL Example:

To enable point-in-time recovery, you need to restore a base backup, then use WAL

(Write-Ahead Logging) archives to apply changes until the desired point.

• You would also set the restore_command in recovery.conf and specify the

recovery_target_time.

Answer: Database scaling refers to increasing a database's ability to handle more workload—either by increasing the resources available to a single instance or distributing the load across multiple instances.

What interviewers expect

• A clear definition tied to SQL in SQL & Databases projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production SQL & Databases application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in SQL & Databases architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

read replica is a copy of a database that is used to offload read-only queries from the

primary database (master). It is particularly useful for handling high read traffic and

improving database scalability.

• How it helps with scaling:
• By distributing read requests across multiple replicas, the primary database

can focus on write operations, reducing the load on the master.

• It improves performance by providing additional resources dedicated to read

operations.

• Example: In a web application with high traffic, multiple read replicas can

serve read-heavy queries, while writes are only made to the master database.

Note: Read replicas are usually asynchronous, meaning there can be a slight delay in

replication. For critical real-time reads, this might not be suitable.

Database caching involves storing frequently accessed data in a faster storage layer (e.g.,

memory) so that future requests for the same data can be served more quickly, reducing the

need to query the database repeatedly.

• How it improves performance:
• Reduces database load: Instead of querying the database every time data is

requested, the cache can provide instant access to commonly requested

data.

• Improves response time: Caching data in-memory (using technologies like

Redis or Memcached) makes it accessible in nanoseconds, compared to the

millisecond access time of traditional disk-based databases.

• Reduces latency: Caching significantly reduces the time taken to fetch data,

improving the overall user experience.

Example: Frequently accessed user profiles in a web application can be cached using

Redis, so that subsequent requests don't have to query the database again.

Query optimization is the process of improving the efficiency of SQL queries to reduce

resource consumption and improve response time. The goal is to make sure that queries are

executed using the most efficient execution plan possible.

• Why it's important:
• Optimized queries help reduce CPU load, memory consumption, and I/O

operations, improving overall system performance.

• It prevents slow queries that might degrade the user experience or cause

resource contention in high-traffic applications.

• Common techniques:
• Indexing: Using appropriate indexes can drastically reduce query times.
• **Avoiding SELECT ***: Only select the necessary columns instead of

selecting all columns.

• Query refactoring: Break down complex queries into simpler ones, or

replace subqueries with joins when possible.

• Using appropriate joins: Ensure proper joins are used (e.g., INNER JOIN

vs. OUTER JOIN).

• Limit result set: Use LIMIT or TOP to reduce the number of rows returned.

Event sourcing is a pattern where the state of an application is determined by a sequence

of events, rather than storing the current state directly in the database.

• How it works: Instead of storing the current state of an entity, each change to that

entity (event) is stored as an immutable event in an event store. The state can be

reconstructed by replaying the events.

• Advantages:
• You have a complete audit trail of changes.
• Enables eventual consistency and can scale well in distributed systems.
• Use cases: CQRS (Command Query Responsibility Segregation), systems

requiring full audit logs, and systems that need to capture historical data changes.

materialized view is a database object that stores the results of a query physically, unlike

regular view, which computes its result dynamically.

• Advantages:
• Faster query response times as the results are precomputed and stored.
• Can be refreshed periodically (e.g., every hour or after specific events) to

keep the data up to date.

• Use cases: Reporting, data warehousing, and aggregation-heavy applications.
• Example:
• A materialized view could aggregate sales data by day, allowing a query to

retrieve the precomputed values instead of performing costly aggregation on

the fly.

time-series database (TSDB) is optimized for storing, querying, and managing

time-stamped data (data associated with timestamps), often used for tracking events or

metrics over time.

• Use cases: IoT data, server logs, stock prices, sensor data, application monitoring,

etc.

• Characteristics:
• Data is ordered by timestamps.
• Efficient for inserting large volumes of data continuously.
• Optimized for queries that focus on time ranges (e.g., finding data from a

particular hour or day).

• Examples: InfluxDB, TimescaleDB, Prometheus.

Sharding is the process of breaking a large database into smaller, more manageable pieces

(shards), each of which is stored on a different server.

• When to use it:
• When a single database server can no longer handle the volume of data or

queries.

• When scaling vertically (increasing server resources) is no longer

cost-effective or possible.

• How it works:
• The data is divided based on a specific shard key (e.g., user ID, geographic

region, etc.).

• Each shard contains a subset of the data and is stored on a separate server

or cluster.

Example: In an e-commerce platform, you could shard user data based on geographic

region. Users from the US might be stored in one shard, while users from Europe are stored

in another.

Answer: The DISTINCT keyword is used to return only unique values in the result set, removing any duplicate rows. Example: SELECT DISTINCT Country FROM Customers; This will return a list of unique countries from the Customers table.

What interviewers expect

• A clear definition tied to SQL in SQL & Databases projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production SQL & Databases application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in SQL & Databases architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

The UNION operator combines the result sets of two or more SELECT queries into a single

result set and removes duplicate records. All SELECT queries must have the same number

of columns with compatible data types.

Example:

SELECT Name FROM Employees

UNION

SELECT Name FROM Customers;

• CHAR: A fixed-length string data type. It always reserves the same amount of space

regardless of the string's length.

• Use case: When the length of the string is known and consistent.
• VARCHAR: A variable-length string data type. It only uses as much space as needed

to store the string.

• Use case: When the string length can vary.

Example:

CREATE TABLE Example (

fixed_char CHAR(10),

variable_char VARCHAR(10)

);

The LIMIT clause is used to specify the number of records returned by a SELECT query. It is

commonly used to restrict the number of rows, especially for pagination.

Example:

SELECT * FROM Employees LIMIT 5;

This will return only the first 5 rows from the Employees table.

NULL represents the absence of a value in a column. It is not the same as an empty string or

zero.

• Handling NULL:
• To check for NULL, use IS NULL or IS NOT NULL.
• To handle NULL in queries, use COALESCE() (returns the first non-NULL

value) or IFNULL().

Example:

SELECT Name, IFNULL(Salary, 0) FROM Employees;

nd does not log individual row deletions.

• Cannot be rolled back (in most databases).
• Resets auto-increment counters.
• DELETE: Deletes rows based on a condition, and can be rolled back (if using

transactions).

• Slower compared to TRUNCATE.

Example:

DELETE FROM Employees WHERE Age < 18; -- Deletes only specific rows

TRUNCATE TABLE Employees; -- Deletes all rows

• TRUNCATE: Deletes all rows in a table, but the table structure remains. It is faster

and does not log individual row deletions.

• Cannot be rolled back (in most databases).
• Resets auto-increment counters.
• DELETE: Deletes rows based on a condition, and can be rolled back (if using

transactions).

• Slower compared to TRUNCATE.

Example:

DELETE FROM Employees WHERE Age < 18; -- Deletes only specific rows

TRUNCATE TABLE Employees; -- Deletes all rows

n Index is a database object that speeds up the retrieval of rows from a table by creating a

data structure (often a B-tree). Indexes improve the performance of SELECT queries but can

slow down INSERT, UPDATE, and DELETE operations.

Example:

CREATE INDEX idx_employee_name ON Employees(Name);