Spring Boot: Senior / Lead Engineer Interview Roadmap

Debarshi Raj Basumatary

13 min read

·

Oct 7, 2026

--

Listen

Share

A comprehensive 100-hour curriculum from Spring fundamentals to production architecture

Press enter or click to view image in full size

Designed around the 80/20 principle: master the concepts that repeatedly appear in real systems and senior-level interviews.

1. Executive Summary

This curriculum is designed to take a Java developer from practical Spring Boot familiarity to senior/lead-level interview readiness. The target is not encyclopedic knowledge of every Spring project. The target is the ability to explain Spring internals, build production-grade services, diagnose failures, reason about performance and concurrency, design secure and resilient distributed systems, and defend architectural trade-offs.

The first 20 hours follow a Josh Kaufman-style rapid-skill acquisition approach: deconstruct the skill, learn enough to self-correct, remove setup friction, and spend most of the time deliberately practicing. The remaining 80 hours progressively deepen the stack.

Target outcome

• Build a production-style Spring Boot REST service from an empty repository.
• Explain the request lifecycle from Tomcat/Servlet infrastructure through DispatcherServlet, Controller, Service, Repository and database.
• Explain IoC, dependency injection, bean lifecycle, auto-configuration, proxies and AOP instead of merely memorizing annotations.
• Reason about JPA/Hibernate persistence context, dirty checking, lazy loading, N+1 queries, transactions and isolation.
• Design authentication/authorization using Spring Security, JWT and OAuth2/OIDC concepts.
• Handle concurrency, async execution, thread pools and virtual threads safely.
• Build tested services with unit, slice, integration and Testcontainers-based tests.
• Use Redis, Kafka and event-driven patterns such as retries, DLQs and the transactional outbox.
• Design resilient microservices with gateway, discovery, timeouts, retries, circuit breakers and rate limiting.
• Operate services using Actuator, Micrometer, metrics, logs, traces and OpenTelemetry.
• Discuss JVM, GC, connection pools, thread pools and database bottlenecks during performance interviews.
• Solve senior system-design problems and clearly explain trade-offs, failure modes and operational concerns.

2. Curriculum at a Glance

• 1. Spring Core + Boot — Hours: 20 · Primary outcome: Strong Spring mental model and independent CRUD service
• 2. Spring MVC + REST — Hours: 10 · Primary outcome: Deep HTTP/request lifecycle and API design
• 3. JPA + Hibernate + SQL — Hours: 12 · Primary outcome: Production-grade persistence knowledge
• 4. Transactions + Consistency — Hours: 6 · Primary outcome: Transaction internals and isolation reasoning
• 5. Spring Security — Hours: 10 · Primary outcome: Secure APIs and modern auth architecture
• 6. Concurrency + Async — Hours: 8 · Primary outcome: Threading, executors, async and virtual threads
• 7. Testing — Hours: 6 · Primary outcome: Layered and integration testing strategy
• 8. Redis + Caching — Hours: 4 · Primary outcome: Caching patterns and failure modes
• 9. Kafka + Event-Driven Architecture — Hours: 8 · Primary outcome: Messaging and distributed workflows
• 10. Microservices + Spring Cloud — Hours: 8 · Primary outcome: Resilient distributed service architecture
• 11. Observability + Production — Hours: 4 · Primary outcome: Operate and diagnose services
• 12. Performance + JVM — Hours: 4 · Primary outcome: Performance analysis and bottleneck diagnosis
• TOTAL — Hours: 100 · Primary outcome: Senior/lead interview foundation

3. How to Study

The learning loop

1. Learn the mental model before memorizing APIs.
2. Implement the concept in a small Spring Boot application.
3. Break it deliberately: invalid input, failures, concurrency, database errors, timeouts.
4. Inspect what Spring actually does using logs, debugger, SQL logs, Actuator and tests.
5. Explain the concept aloud using the Feynman technique.
6. Answer interview questions without notes.
7. Rebuild important features from a blank project.

Recommended time split

• Concept learning — Share: 20–25% · Rule: Use official documentation and focused explanations.
• Coding — Share: 45–50% · Rule: Write the feature yourself; avoid tutorial copying.
• Debugging/experiments — Share: 15–20% · Rule: Break assumptions and inspect internals.
• Interview practice — Share: 10–15% · Rule: Explain, compare, design and defend decisions.

Do not treat the 100 hours as 100 hours of videos. Senior competence comes from implementation, debugging and architectural reasoning.

4. Phase 1 — Spring Core + Spring Boot (20 hours)

Objectives

• Understand IoC, dependency injection, beans and ApplicationContext.
• Understand component scanning and configuration.
• Understand Spring bean lifecycle and post-processors.
• Understand Spring Boot auto-configuration, starters, profiles and configuration properties.
• Build a REST service using Controller → Service → Repository layering.
• Understand enough of AOP/proxies to reason about @Transactional and @Async.

20-hour schedule

• 0–1 — Focus: Spring vs Spring Boot · Practice / checkpoint: Explain why Boot exists and what SpringApplication.run starts.
• 1–2 — Focus: IoC + dependency injection · Practice / checkpoint: Rewrite manual object construction using constructor injection.
• 2–3 — Focus: Beans + component scanning · Practice / checkpoint: Trace how Controller receives a Service bean.
• 3–4 — Focus: REST + DispatcherServlet · Practice / checkpoint: Build GET/POST endpoints and trace request flow.
• 4–5 — Focus: HTTP request/response · Practice / checkpoint: Use path variables, query params, request bodies and status codes.
• 5–6 — Focus: Service layer · Practice / checkpoint: Move business logic out of controllers.
• 6–7 — Focus: DTOs · Practice / checkpoint: Create request/response DTOs and mappings.
• 7–8 — Focus: JPA mental model · Practice / checkpoint: Trace Spring Data → JPA → Hibernate → JDBC → DB.
• 8–9 — Focus: Entities · Practice / checkpoint: Create Task entity and schema.
• 9–10 — Focus: Repositories · Practice / checkpoint: Implement CRUD and derived queries.
• 10–11 — Focus: Relationships · Practice / checkpoint: Implement User → Tasks with @ManyToOne.
• 11–12 — Focus: Transactions · Practice / checkpoint: Observe commit/rollback behavior.
• 12–13 — Focus: Validation · Practice / checkpoint: Add Bean Validation and @Valid.
• 13–14 — Focus: Exception handling · Practice / checkpoint: Create @ControllerAdvice and consistent error responses.
• 14–15 — Focus: Configuration · Practice / checkpoint: Profiles, environment variables and configuration properties.
• 15–16 — Focus: Security fundamentals · Practice / checkpoint: Understand SecurityFilterChain and auth vs authorization.
• 16–17 — Focus: Capstone skeleton · Practice / checkpoint: Start Expense Management API from blank project.
• 17–18 — Focus: CRUD implementation · Practice / checkpoint: Implement users, expenses and categories.
• 18–19 — Focus: Production hardening · Practice / checkpoint: Validation, exceptions, DTOs and transactions.
• 19–20 — Focus: Challenge mode · Practice / checkpoint: Break the API and explain the full request-to-database path.

Phase 1 interview checkpoints

• What happens when SpringApplication.run() executes?
• What is a Spring Bean?
• How does component scanning work?
• Why is constructor injection generally preferred?
• What is ApplicationContext?
• What is the difference between BeanFactory and ApplicationContext?
• What is @SpringBootApplication composed of?
• What is auto-configuration?
• Why can @Transactional fail during self-invocation?
• What is the difference between a Spring-managed object and an ordinary Java object?

5. Phase 2 — Spring MVC + REST (10 hours)

Core topics

• Servlet container and embedded Tomcat
• DispatcherServlet
• HandlerMapping and HandlerAdapter
• MessageConverters and Jackson
• Filters vs Interceptors
• Argument resolvers
• Exception resolution
• REST resource modeling
• HTTP semantics and status codes
• Pagination, filtering and sorting
• API versioning
• Idempotency
• ETags and conditional requests
• OpenAPI/Swagger

Request lifecycle to master

Client → HTTP → Tomcat → Servlet infrastructure → DispatcherServlet → HandlerMapping → Controller → Service → Repository → response conversion → HTTP response.

Senior interview exercises

• Design a paginated /orders API.
• Explain PUT vs PATCH and when each is appropriate.
• Design an idempotent payment endpoint.
• Explain how Jackson converts JSON into a Java object.
• Explain Filter vs Interceptor and where authentication belongs.
• Design a consistent error response format for a large API.

6. Phase 3 — JPA + Hibernate + SQL (12 hours)

Architecture to understand

Spring Data JPA → JPA API → Hibernate implementation → EntityManager → Persistence Context → JDBC → database.

Must-master topics

• Entity lifecycle: transient, managed, detached, removed
• Persistence context and first-level cache
• EntityManager: persist, merge, remove, detach, refresh
• Dirty checking and write-behind
• Flush vs commit
• LAZY vs EAGER loading
• N+1 query problem
• JOIN FETCH, EntityGraph and projections
• Cascade types
• Orphan removal
• Optimistic locking with @Version
• Pessimistic locking
• JDBC batching
• Second-level cache concepts
• Open Session in View
• Indexes and query plans
• Connection pooling and HikariCP

Senior interview scenarios

• Why is Hibernate issuing 101 SQL queries for 100 orders?
• Why does changing an entity sometimes persist without calling save()?
• Why can EAGER fetching be dangerous?
• When would you use DTO projection instead of fetching entities?
• How would you prevent two users from purchasing the last inventory item?
• How would you diagnose connection pool exhaustion?

7. Phase 4 — Transactions + Data Consistency (6 hours)

Topics

• ACID
• Spring transaction abstraction
• TransactionManager
• Proxy-based transaction interception
• @Transactional propagation
• Rollback rules
• Isolation levels
• Dirty reads, non-repeatable reads, phantom reads and lost updates
• Optimistic vs pessimistic locking
• Transaction boundaries
• Self-invocation problem
• Database transactions vs distributed transactions

Propagation to know

• REQUIRED — Join existing transaction or create one.
• REQUIRES_NEW — Suspend existing transaction and create a new one.
• NESTED — Use a nested transaction/savepoint where supported.
• SUPPORTS — Run with a transaction if one already exists.
• MANDATORY — Require an existing transaction.
• NOT_SUPPORTED — Run outside a transaction.
• NEVER — Fail if a transaction exists.

Interview challenge

Explain exactly why @Transactional is commonly implemented through a proxy, why self-invocation bypasses that proxy, and how transaction boundaries should be placed around business operations.

8. Phase 5 — Spring Security (10 hours)

Security architecture

HTTP request → Security Filter Chain → authentication → SecurityContext → authorization → controller.

Topics

• SecurityFilterChain
• Authentication and Authorization
• SecurityContext
• AuthenticationProvider
• Password hashing and PasswordEncoder
• Session vs stateless authentication
• JWT structure and validation
• Access vs refresh tokens
• Token expiry and rotation
• CSRF and CORS
• OAuth 2.0 roles and flows
• Authorization Code + PKCE
• Client Credentials
• OpenID Connect
• Resource Server
• Method-level security
• Role-based and permission-based authorization

Senior security exercises

• Design a JWT-secured Spring Boot API.
• Explain why a JWT is not automatically encrypted.
• Explain CSRF and why its risk changes for stateless token-based APIs.
• Design OAuth2 login with an external identity provider.
• Design service-to-service authentication.
• Explain authentication vs authorization with a concrete API example.

9. Phase 6 — Concurrency + Async (8 hours)

Topics

• Java threads and thread safety
• ExecutorService and thread pools
• Callable and Future
• CompletableFuture
• thenApply vs thenCompose vs thenCombine
• Exception handling in async pipelines
• CPU-bound vs I/O-bound work
• Spring @Async and proxy implications
• TaskExecutor
• Thread pool sizing and queueing
• Virtual threads
• Race conditions and synchronization
• Deadlocks and starvation
• Backpressure concepts

Interview exercises

• Parallelize three independent remote calls and combine the results.
• Explain why increasing the thread pool indefinitely makes a service worse.
• Explain when virtual threads help and when they do not.
• Diagnose a service with thread-pool exhaustion.
• Design an asynchronous report-generation endpoint.

10. Phase 7 — Testing (6 hours)

Testing pyramid

Unit tests → slice tests → integration tests → contract tests → end-to-end tests.

Topics

• JUnit 5
• Mockito
• Mock vs Spy
• Argument matching and verification
• @SpringBootTest
• @WebMvcTest
• @DataJpaTest
• MockMvc
• Integration testing
• Testcontainers
• Real PostgreSQL in tests
• Contract testing concepts
• Test data management
• Testing transactions and rollback

Senior expectation

You should be able to justify what to mock, what not to mock, and where real infrastructure provides more confidence than mocks.

11. Phase 8 — Redis + Caching (4 hours)

Topics

• Redis data structures at a conceptual level
• Spring Cache abstraction
• @Cacheable, @CachePut and @CacheEvict
• Cache-aside
• Write-through and write-behind concepts
• TTL and invalidation
• Cache stampede
• Cache penetration
• Cache avalanche
• Distributed locking concepts
• Failure behavior when Redis is unavailable

Interview challenge

Design a cache for a product catalog and explain consistency, invalidation, TTL, cold starts and what happens when Redis fails.

12. Phase 9 — Kafka + Event-Driven Architecture (8 hours)

Kafka mental model

Producer → Topic → Partition → Offset → Consumer Group → Consumer.

Topics

• Topics and partitions
• Ordering guarantees
• Consumer groups and rebalancing
• Offsets
• Replication
• Retention
• Producer acknowledgments
• Serialization/deserialization
• Spring Kafka producers and consumers
• Consumer error handling
• Retries and dead-letter topics
• At-most-once, at-least-once and exactly-once concepts
• Idempotent consumers
• Event-driven architecture
• Transactional Outbox
• CDC concepts
• Saga
• CQRS and Event Sourcing concepts

Senior interview exercises

• Design order → payment → inventory event flow.
• Explain why retries can create duplicate business operations.
• Design an idempotent Kafka consumer.
• Explain the transactional outbox and why it exists.
• Design a retry and dead-letter strategy.
• Explain ordering when a topic has multiple partitions.

13. Phase 10 — Microservices + Spring Cloud (8 hours)

Topics

• Monolith vs modular monolith vs microservices
• Service boundaries
• API Gateway
• Service discovery
• Configuration management
• Load balancing
• OpenFeign / HTTP clients concepts
• WebClient
• Timeouts
• Retries
• Circuit breakers
• Bulkheads
• Rate limiting
• Fallbacks
• Distributed transactions
• Saga choreography vs orchestration
• Eventual consistency
• Containerized deployment concepts

Architecture exercise

Design Order, Payment, Inventory and Notification services. Identify synchronous vs asynchronous communication, transaction boundaries, failure handling, idempotency, observability and data ownership.

14. Phase 11 — Observability + Production (4 hours)

Three pillars

• Logs
• Metrics
• Distributed traces

Topics

• Spring Boot Actuator
• Health and readiness concepts
• Micrometer
• Prometheus
• Grafana
• Structured logging
• Correlation IDs
• OpenTelemetry
• Trace and span model
• Alerting concepts
• SLI, SLO and SLA basics

Incident exercise

A production API has p99 latency of 3 seconds. Explain how you would use metrics, logs, traces, thread dumps, connection-pool metrics and database telemetry to locate the bottleneck.

15. Phase 12 — Performance + JVM (4 hours)

JVM topics

• Heap, stack and metaspace
• Young and old generations
• Garbage collection
• JIT compilation
• Thread dumps
• Heap dumps
• CPU and memory profiling concepts

Spring/backend bottlenecks

• Tomcat thread pool exhaustion
• Application executor exhaustion
• HikariCP connection pool exhaustion
• N+1 queries
• Slow SQL and missing indexes
• Excessive serialization
• Large payloads
• GC pressure
• Cache misses
• Remote-service latency

Interview exercise

Given high CPU, high GC and increasing latency, explain the sequence of evidence you would collect before changing configuration.

16. Capstone Projects

Project 1 — Production CRUD API

• Spring Boot + MVC + PostgreSQL + JPA
• DTOs, validation and exception handling
• Pagination/filtering/sorting
• Unit + integration tests
• Dockerized local environment

Project 2 — Secure API

• Spring Security
• JWT or OAuth2 resource-server model
• Role/permission-based authorization
• Redis caching
• Rate limiting concept
• Security-focused tests

Project 3 — Event-Driven Order Platform

• Order, Payment, Inventory and Notification services
• Kafka
• Transactional outbox
• Retries and DLQ
• Idempotent consumers
• Resilience4j
• Redis
• OpenTelemetry
• Docker Compose

Project 4 — Lead-level system design

Design and document a scalable order-processing platform. Produce an architecture diagram, API contracts, database schema, event contracts, failure-mode analysis, scaling strategy, security model, observability plan and deployment strategy.

17. Senior / Lead Interview Question Bank

Spring Core

• Explain IoC and DI without using Spring-specific terminology first.
• How does Spring discover and instantiate beans?
• What is a BeanPostProcessor?
• What is the difference between @Component and @Bean?
• Why does constructor injection improve design?
• How does Spring create proxies?

Spring Boot

• What is auto-configuration?
• How do conditional beans work?
• What does @SpringBootApplication contain?
• How do profiles and configuration properties work?
• How would you debug unexpected auto-configuration?

MVC

• Walk through a request from socket to controller.
• Filter vs interceptor?
• How does Jackson serialization work?
• How would you implement API versioning?
• How would you design idempotency?

JPA/Hibernate

• Explain persistence context.
• Explain dirty checking.
• What causes N+1?
• LAZY vs EAGER?
• JOIN FETCH vs EntityGraph?
• Optimistic vs pessimistic locking?
• Why can save() be misleading regarding SQL execution?

Transactions

• Explain @Transactional internals.
• Why does self-invocation matter?
• Explain propagation.
• Explain isolation levels.
• How do you prevent lost updates?

Security

• Authentication vs authorization?
• Explain SecurityFilterChain.
• JWT vs session authentication?
• OAuth2 vs OIDC?
• How does PKCE work conceptually?
• What are CSRF and CORS?

Concurrency

• How do you size an executor?
• CompletableFuture thenApply vs thenCompose?
• How do virtual threads change the concurrency model?
• How do you prevent race conditions?

Distributed systems

• When should a service call another service synchronously?
• When should it publish an event?
• How do retries interact with idempotency?
• Explain circuit breaker states.
• Explain the outbox pattern.
• How do you handle distributed transactions?

18. System Design Interview Track

Systems to design

• URL shortener — ID generation, cache, database scaling
• E-commerce platform — Services, inventory, payment, consistency
• Payment system — Idempotency, transactions, retries
• Ticket booking — Concurrency, locking, overselling
• Notification platform — Kafka, workers, retry/DLQ
• Ride sharing — Real-time state, location, events
• Rate limiter — Redis, token bucket, distributed state
• Order processing — Kafka, outbox, Saga, observability

Design answer structure

1. Clarify functional and non-functional requirements.
2. Estimate scale: users, requests/sec, storage and traffic.
3. Define APIs and major domain objects.
4. Choose data stores and explain why.
5. Define service boundaries.
6. Define synchronous and asynchronous flows.
7. Discuss consistency and transaction boundaries.
8. Design caching and scaling.
9. Design failure handling and resilience.
10. Design security.
11. Design observability.
12. Identify trade-offs and future bottlenecks.

19. Readiness Rubric

• Foundation — Build CRUD APIs and explain IoC, DI, MVC and basic JPA.
• Intermediate — Build secure, validated APIs with transactions and tests.
• Senior-ready — Explain internals, diagnose performance issues and design resilient services.
• Lead-ready — Make architecture decisions, quantify trade-offs, define boundaries and reason about failure at system scale.

Do not move on until…

• You can rebuild a basic service without a tutorial.
• You can explain every major annotation you use.
• You can inspect SQL generated by Hibernate.
• You can explain transaction boundaries and isolation.
• You can diagnose N+1 and connection-pool issues.
• You can explain security flows on a whiteboard.
• You can design retry, timeout and circuit-breaker behavior.
• You can explain Kafka delivery semantics and idempotency.
• You can design a multi-service system and identify consistency boundaries.
• You can defend architecture decisions under interviewer challenge.

20. Final 100-Hour Checklist

☐ Spring IoC / DI / Beans

☐ ApplicationContext and bean lifecycle

☐ Component scanning and configuration

☐ Spring Boot auto-configuration

☐ Spring MVC request lifecycle

☐ REST and HTTP semantics

☐ DTOs, validation and exception handling

☐ JPA / Hibernate architecture

☐ Persistence context and dirty checking

☐ Fetch strategies and N+1

☐ Transactions and propagation

☐ Isolation and locking

☐ Spring Security

☐ JWT / OAuth2 / OIDC concepts

☐ Concurrency and executors

☐ CompletableFuture and @Async

☐ Virtual threads

☐ Testing and Testcontainers

☐ Redis and caching

☐ Kafka

☐ Outbox / Saga / CQRS concepts

☐ Microservices

☐ API Gateway and service discovery

☐ Resilience patterns

☐ Observability

☐ JVM and performance

☐ System design

☐ Production troubleshooting

☐ Architecture trade-offs

☐ Senior/lead interview practice

21. Recommended Final Interview Sprint

• 1 — Spring Core + Boot internals; 30 rapid-fire questions
• 2 — MVC + REST; design 3 APIs
• 3 — JPA/Hibernate; solve 10 persistence scenarios
• 4 — Transactions + concurrency; explain 10 failure cases
• 5 — Security; design JWT/OAuth2 architecture
• 6 — Kafka + microservices; design event-driven workflow
• 7 — System design mock interview + production incident drill

For the final sprint, prioritize explanation and trade-offs over memorization. Senior interviews often test whether you can reason under incomplete information, not whether you remember an annotation’s exact spelling.

22. Definition of Done

You are ready to target senior/lead Spring Boot interviews when you can take an unfamiliar production scenario, identify the relevant Spring/JVM/database/distributed-system concepts, propose a design, explain alternatives, identify failure modes, and describe how you would validate the design in production.

The ultimate objective is not 100% API coverage. It is the ability to move fluently between code, framework internals, database behavior, concurrency, distributed systems, security, operations and architecture.