ASP.NET Core MVC interview questions covering senior practical mvc scenarios & production architecture.
Open a question for the full answer, code and interview guidance.
A production MVC application should separate HTTP concerns from application and business logic. Controllers handle requests and responses, ViewModels define UI contracts, application services coordinate use cases, and infrastructure components handle persistence and external systems.
Keep the controller focused on translating HTTP input into an application request and translating the result into an HTTP response. The application service should own the workflow, transactions, and coordination of domain operations.
Use the Post/Redirect/Get pattern so a successful POST redirects to a GET page instead of rendering the final page directly. For operations where duplicate execution would be harmful, also use server-side idempotency or uniqueness controls.
Use an optimistic concurrency mechanism such as an EF Core concurrency token or rowversion. When an update detects that another user changed the record after it was loaded, catch the concurrency conflict and decide whether to reload, merge, or ask the user to review the latest data.
Protect the Admin area with server-side authorization policies or roles, not only navigation visibility or an /Admin URL. Apply authorization broadly at the area controller level or through conventions, then add more restrictive policies to sensitive operations.
Use resource-based authorization. Load the record, then ask IAuthorizationService whether the current user is allowed to perform the requested operation on that specific resource.
Treat returnUrl as untrusted input. Redirect only when the URL is local to the application; otherwise use a safe default destination.
Represent the filters in a dedicated query ViewModel and bind them from the query string. Build an IQueryable incrementally, apply only requested filters, use a deterministic sort, project to lightweight list ViewModels, and paginate at the database.
Start by measuring query count and duration. Consolidate compatible aggregations, project only required values, use AsNoTracking for read-only work, execute independent operations carefully, and cache results only when their freshness requirements allow it.
Measure the complete request path rather than guessing. Review request latency, application logs, traces, database query timings and execution plans, external HTTP calls, cache behavior, allocations, and browser network timing.
Keep HTTP integration logic in a dedicated service rather than the controller. Configure HttpClient through IHttpClientFactory and apply suitable timeouts and resilience policies according to the operation.
Do not keep an HTTP request open for lengthy background processing when the work can be queued. Persist or enqueue a job, return an acknowledgement or redirect, and process the job with a hosted/background worker or external job system.
Enforce application-defined size limits, authorization, allowed content rules, and safe storage names. Never combine an untrusted client filename directly with a server path, and do not rely only on the file extension to establish content safety.
Authorize access to the logical file record before reading the physical object. Resolve the storage location from trusted server-side metadata rather than accepting an arbitrary path from the request.
Identify data that is expensive to produce, frequently requested, and safe to reuse. Public catalog pages may use output caching, while reusable lookup data can use memory or distributed caching.
Design one query around the data the view actually needs. Project related values into a list ViewModel so EF Core can translate the relationship access into appropriate SQL rather than executing a separate query for each row.
Use dedicated input models containing only properties the user is permitted to submit. Load the target entity on the server and explicitly map approved values rather than binding a persistence entity containing protected fields.
Record meaningful security or business events at the application boundary, including the authenticated actor, operation, target identifier, timestamp, and relevant outcome. For sensitive systems, store audit records in a durable location designed for the required retention and tamper-resistance properties.
Keep Data Annotations focused on simple model-level rules and perform database-dependent validation through an application service or validator. The controller can add resulting errors to ModelState and redisplay the form.
Return the same input model so MVC and Razor can redisplay attempted values and ModelState errors. Rebuild supporting data that is not posted by the form, such as dropdown options, lookup collections, or page-specific reference data.
JavaScript may update the interface immediately for responsiveness, but the server remains authoritative. Every state-changing request must still enforce authentication, authorization, anti-forgery protection when relevant, validation, and business rules.
Configure the hosting environment so ASP.NET Core correctly understands forwarded scheme, host, and client information from trusted proxies. HTTPS termination, forwarded headers, Data Protection keys, authentication cookies, health checks, logging, and environment configuration must all match the deployment topology.
Instances that need to read the same protected cookies or other Data Protection payloads must share a compatible key ring. Persist keys to a suitable shared location and protect the key material according to the hosting environment.
Combine structured logs, metrics, traces, health checks, request correlation, and dependency telemetry so failures and latency can be followed across the application. Capture useful dimensions such as endpoint, status code, duration, database dependency, and external service.
Design around clear responsibilities: controllers handle HTTP flow, ViewModels define UI contracts, application services coordinate use cases, the domain owns business rules, and infrastructure handles external concerns. Prefer explicit dependencies, server-side authorization, strong validation, safe error handling, and measurable behavior.