Spring Boot interviews reward candidates who can say why the framework does something, not just which annotation to type. These are the questions that come up, answered from the mechanism outwards.
🎤 Practise these in an AI mock interviewDependency injection and the container. Everything else builds on this.
final so the object cannot exist half-built, they are visible in the signature so a class with too many is obviously doing too much, and the class can be constructed in a plain unit test with no Spring at all. Field injection hides all three.@Configuration marks the class as a source of bean definitions, @ComponentScan scans this package and below for components, and @EnableAutoConfiguration switches on Boot's conditional configuration.@ConditionalOnClass, @ConditionalOnMissingBean, @ConditionalOnProperty. At startup it evaluates them: a database driver on the classpath and no DataSource of your own means Boot defines one. Defining your own bean makes the condition fail, so your definition wins.--debug for the auto-configuration report, which lists every condition that matched and every one that did not, with the reason.@Components that say what the class is for. @Repository additionally translates persistence exceptions into Spring's DataAccessException hierarchy, and @Controller/@RestController are what web request mapping looks for. So the difference is intent, plus that one real behaviour.The half of the interview that maps to what you actually built.
@RestController is @Controller plus @ResponseBody on every method, so return values are serialised into the response body instead of being resolved as view names. Use it for APIs; use @Controller when you are rendering server-side templates.@RestControllerAdvice class with @ExceptionHandler methods. It centralises the mapping from exception to status code and response body, so controllers stay free of try/catch and every error in the API comes back in the same shape — which is what clients need.@RestControllerAdvice
class ApiExceptionHandler {
@ExceptionHandler(NotFoundException.class)
ResponseEntity<ApiError> notFound(NotFoundException e) {
return ResponseEntity.status(404).body(new ApiError(e.getMessage()));
}
}@PathVariable binds part of the URL path and is for identifying a resource. @RequestParam binds a query parameter and is for filtering, sorting and paging. @RequestBody deserialises the request body, for the payload of a POST or PUT.Location header when something was created, 204 when there is nothing to return. 400 for a malformed or invalid request, 401 not authenticated, 403 authenticated but not allowed, 404 not found, 409 for a conflict such as a duplicate. 500 only for an unexpected server failure — a validation error returning 500 is a common review comment.@NotBlank, @Email, @Min — and put @Valid on the controller parameter. A failure raises MethodArgumentNotValidException, which you map in the advice class above so clients get one consistent error shape with the field names in it.Where the questions get specific and the wrong answer is visible.
RuntimeException only — a checked exception commits unless you set rollbackFor. Second, because it works through a proxy, calling a @Transactional method from another method in the same class bypasses the proxy entirely and no transaction starts.JOIN FETCH in the query, an entity graph, or a batch size so the n queries become a handful.findByEmailAndActiveTrue needs no body.LazyInitializationException when the association is touched after the session closed, which is a sign the fetch should have been part of the query.application-dev.yml, application-prod.yml) activated by a profile, with @ConfigurationProperties binding them to typed objects rather than scattering @Value strings. Secrets come from environment variables or a secret manager, never from a file in the repository.The last third of the interview, and where projects get discussed.
@SpringBootTest starts the whole application context — thorough and slow, right for an integration test. @WebMvcTest loads only the web layer with the rest mocked, so a controller test runs in a fraction of the time. Loading the full context for every test is the usual reason a suite becomes too slow to run.@Mock is Mockito's and creates a mock object with no Spring involved. @MockBean puts a mock into the Spring context, replacing the real bean — which also invalidates the cached context, so overusing it slows the suite by rebuilding the context repeatedly.Authentication is placed in the SecurityContext. Authorisation then decides whether that principal may do this, through URL rules in the chain or @PreAuthorize on methods. Authentication is identity; authorisation is permission.RestClient or WebClient in current versions; RestTemplate is the older, maintenance-mode option. Whatever you use, set a connect and read timeout — an unbounded call to a hanging dependency exhausts your thread pool and takes your service down with theirs./health, /metrics, /info, /env — used by load balancers, orchestrators and monitoring. They expose real internals, so expose only what is needed and put them behind authentication or a separate port.Most candidates know the material and still stumble when asked out loud. Take a Spring Boot mock interview where the AI follows up on what you actually say.
🎤 Start a Spring Boot mock interview