Interview Q&A

Configuration providers are components that load configuration data from various

sources.

Built-in Providers:

• JSON files (appsettings.json)
• Environment variables
• Command-line arguments
• In-memory collections
• Azure Key Vault
• User Secrets (for local dev)
• Custom providers (you can build your own)

Example:

builder.Configuration

.AddJsonFile("appsettings.json")

.AddEnvironmentVariables()

.AddCommandLine(args);

Each provider plugs into the same configuration system, so you can access everything via

IConfiguration.

🔐 3. How do you manage secrets in development?

In development, never store passwords, API keys, or connection strings in code or

ppsettings.json.

Use User Secrets — a safe way to store secrets outside the project tree.

🧰 4. What is User Secrets in ASP.NET Core?

User Secrets are a local, developer-only configuration storage that keeps sensitive data

out of source control.

Setup:

Enable secrets:

dotnet user-secrets init

public class LogActionFilter : ActionFilterAttribute

public override void OnActionExecuting(ActionExecutingContext

context)

Console.WriteLine($"Action:

{context.ActionDescriptor.DisplayName}");

Use it:

[LogActionFilter]

public IActionResult Index() => View();

📤 15. How do you pass data from controller to view?

You can use:

Answer: Hangfire or Quartz.NET for Background Jobs Hangfire Example: app.UseHangfireDashboard(); RecurringJob.AddOrUpdate(() => Console.WriteLine("Recurring job"), Cron.Daily); Quartz.NET: Supports cron-like scheduling and clustered execution.

What interviewers expect

• A clear definition tied to MVC in ASP.NET Core MVC projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core MVC application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core MVC architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

How to Test Minimal APIs?

Answer:

Minimal APIs are tested using WebApplicationFactory or TestServer.

Example:

var factory = new WebApplicationFactory<Program>();
var client = factory.CreateClient();
var response = await client.GetAsync("/products");
var products = await

response.Content.ReadFromJsonAsync<List<Product>>();

Assert.NotEmpty(products);

Health Checking in ASP.NET Core

builder.Services.AddHealthChecks()

.AddSqlServer(connectionString)

.AddCheck<CustomHealthCheck>("CustomCheck");

app.MapHealthChecks("/health");

Custom Health Check Example:

public class CustomHealthCheck : IHealthCheck
{
public Task<HealthCheckResult>

CheckHealthAsync(HealthCheckContext context, CancellationToken

token) =>

Task.FromResult(HealthCheckResult.Healthy("Everything OK"));

}

How to Use Serilog or NLog?

Serilog Example (Program.cs):

builder.Host.UseSerilog((ctx, lc) => lc

.WriteTo.Console()

.WriteTo.File("logs/log-.txt", rollingInterval:

RollingInterval.Day)

);

NLog Example:

• Install NLog.Extensions.Logging package
• Add NLog.config file
• Configure in Program.cs:

builder.Logging.ClearProviders();

builder.Logging.SetMinimumLevel(LogLevel.Information);

builder.Host.UseNLog();

✅ Both support structured logging, sinks, filtering, and rolling files.

What Frameworks Are Commonly Used?

Answer:

• xUnit – Popular, lightweight, supports parallel testing.
• NUnit – Rich assertion library.
• MSTest – Microsoft-supported, integrated in Visual Studio.

Most modern ASP.NET Core projects use xUnit + Moq.

ASP.NET Core Data Protection API provides secure cryptographic APIs for:

• Encrypting cookies and tokens
• Protecting form data
• Persisting secure keys (across app restarts)

Setup:

builder.Services.AddDataProtection()

.PersistKeysToFileSystem(new DirectoryInfo(@"c:\keys"))

.SetApplicationName("MyApp");

You can use it directly:

var protector = _provider.CreateProtector("MyPurpose");
var encrypted = protector.Protect("secret-data");
var decrypted = protector.Unprotect(encrypted);

✅ Data Protection is the backbone for:

• Cookie Authentication
• CSRF Tokens
• TempData encryption

🧠 Summary

Concept Description Best For

In-memory caching Stores data in server memory Single-server or dev

Distributed caching Shared cache (Redis, SQL) Scalable apps

Response caching Caches HTTP responses Public/static data

Output caching (.NET 8) Advanced, user-aware

caching

Dynamic APIs

Response compression Gzip/Brotli for responses Large payloads

sync/await Non-blocking I/O High concurrency

Startup optimization Faster app boot Cloud apps

Data protection Encrypt sensitive data Cookies, tokens,

forms

Testing

How to Unit Test Controllers?

Unit testing controllers ensures your business logic in action methods works correctly

without hitting the database or HTTP pipeline.

Steps:

ASP.NET Core Data Protection API provides secure cryptographic APIs for:

• Encrypting cookies and tokens
• Protecting form data
• Persisting secure keys (across app restarts)

Setup:

builder.Services.AddDataProtection()

.PersistKeysToFileSystem(new DirectoryInfo(@"c:\keys"))

.SetApplicationName("MyApp");

You can use it directly:

var protector = _provider.CreateProtector("MyPurpose");

var encrypted = protector.Protect("secret-data");

var decrypted = protector.Unprotect(encrypted);

✅ Data Protection is the backbone for:

• Cookie Authentication
• CSRF Tokens
• TempData encryption

🧠 Summary

Concept Description Best For

In-memory caching Stores data in server memory Single-server or dev

Distributed caching Shared cache (Redis, SQL) Scalable apps

Response caching Caches HTTP responses Public/static data

Follow :

Output caching (.NET 8) Advanced, user-aware

caching

Dynamic APIs

Response compression Gzip/Brotli for responses Large payloads

Async/await Non-blocking I/O High concurrency

Startup optimization Faster app boot Cloud apps

Data protection Encrypt sensitive data Cookies, tokens,

forms

Testing

How to Unit Test Controllers?

Unit testing controllers ensures your business logic in action methods works correctly

without hitting the database or HTTP pipeline.

Steps:

Compiled queries improve performance by caching query translation.

Example:

private static readonly Func<AppDbContext, decimal,

IEnumerable<Product>> _getExpensiveProducts =

EF.CompileQuery((AppDbContext ctx, decimal price) =>

ctx.Products.Where(p => p.Price > price));
var result = _getExpensiveProducts(_context, 1000);

🔍 19. What is global query filtering?

It allows you to apply filters automatically to all queries for a given entity — useful for soft

deletes or multi-tenancy.

Example:

modelBuilder.Entity<Product>()

.HasQueryFilter(p => !p.IsDeleted);

ll queries automatically exclude deleted products.

🌐 20. How do you handle database connection

pooling?

Connection pooling is handled automatically by ADO.NET and EF Core providers.

Each new DbContext reuses existing connections from the pool to reduce overhead.

For fine control:

options.UseSqlServer(connectionString, opt =>

opt.EnableRetryOnFailure());

Tips:

• Keep DbContexts short-lived (Scoped lifetime).
• Avoid keeping connections open unnecessarily.
• For high-traffic apps, tune pool

settings in the connection string:

Max Pool Size=200; Min
Pool Size=5;

uthentication & Authorization

Rate Limiting Middleware in .NET 8

builder.Services.AddRateLimiter(options =>

{

options.GlobalLimiter =

PartitionedRateLimiter.Create<HttpContext, string>(httpContext =>

RateLimitPartition.GetFixedWindowLimiter(httpContext.Connection.Remo

teIpAddress?.ToString()!, _ =>

new FixedWindowRateLimiterOptions

{

PermitLimit = 10,

Window = TimeSpan.FromMinutes(1),

QueueLimit = 2

}));

});

app.UseRateLimiter();

✅ Helps protect APIs from abuse or DoS attacks.

How to Enable Application Insights?

Answer:

Application Insights provides monitoring, telemetry, and tracing.

Setup:

builder.Services.AddApplicationInsightsTelemetry(builder.Configurati

on["APPINSIGHTS_INSTRUMENTATIONKEY"]);

Features:

• Track requests, exceptions, and dependencies
• Live metrics and dashboards
• Custom events and telemetry

How to Use Moq for Mocking Dependencies?

Answer:

Moq creates fake implementations of interfaces to control behavior during tests.

Example:

var mockRepo = new Mock<IProductRepository>();

mockRepo.Setup(x => x.GetAll()).Returns(new List<Product> { new

Product { Id = 1, Name = "Laptop" } });
var service = new ProductService(mockRepo.Object);
var products = service.GetAll();

Assert.Single(products);

✅ Use .Setup(), .Verify(), and .Returns() to simulate behavior.