40 questions / 10 random questions
Random questions, instant feedback, and review for missed questions.
What should be clarified first when designing a new business mobile app?
Answer: Target users, key tasks, usage context, offline needs, security, and success metrics
Define use cases with mobile context such as movement, one-handed use, connectivity loss, battery, and shared devices to guide architecture, data, permissions, and UI.
The UI became complex by calling network APIs and local databases directly. What is an appropriate improvement?
Answer: Use repositories as data-layer entry points to centralize source coordination and business rules
Repositories hide network, cache, and database differences while centralizing updates and conflict resolution, allowing UI code to focus on state and user events.
Multiple components independently update the same screen state, causing inconsistencies. Which design is appropriate?
Answer: Separate state and events with a single source of truth and unidirectional data flow
State flows from its owner to the UI, while user events return to that owner for centralized updates. Transitions become traceable and testable.
Which design prevents losing an in-progress draft when the OS terminates the app process in the background?
Answer: Persist important drafts incrementally in local storage and restore them after relaunch
Data that must outlive UI or process lifetime should be persisted. Design save cadence, encryption, deletion rules, and schema migration as well.
Network requests duplicate after rotation or window-size changes. Which state-management approach is appropriate?
Answer: Keep loading state in a state holder that outlives UI recreation and share the same request
UI instances may be recreated during configuration changes. Separate data loading from the UI instance and use lifecycle-aware observation and request deduplication.
Which navigation-stack and back-navigation design is appropriate?
Answer: Define and consistently implement expected back behavior for top-level destinations, modals, and deep links
Design predictable hierarchy and task boundaries. Test parent behavior from deep links, unsaved changes, and returning from authentication.
Which layout design appropriately supports phones, foldables, and tablets?
Answer: Adapt panes, information density, and navigation to available size classes and posture
Choose list-detail, navigation rail, or two-pane patterns based on available space rather than device names, preserving state during window resizing.
Which boundary design is appropriate between shared business logic and Android or iOS platform APIs?
Answer: Define interfaces in the domain and implement notifications, storage, and location with platform adapters
Keep domain logic independent of platform details to improve testing and replacement, while preserving platform-specific UX where appropriate.
What is an appropriate source of truth for screen data in an offline-first app?
Answer: Read from a synchronized local database and write network results into it first
An observable local source provides consistent data regardless of connectivity, while repositories handle network synchronization and conflicts.
Which design reliably sends a comment created while offline?
Answer: Persist it in a local outbox and retry with OS-managed background work while showing status
Store operation ID, payload, and retry state in an outbox that survives process death. Use network constraints and exponential backoff, exposing pending or failed status.
Multiple devices edit the same record while offline. Which synchronization design is appropriate?
Answer: Detect conflicts with version metadata and business rules, then use automatic merge or user resolution
Whether last-write-wins is appropriate depends on data semantics. Choose server versions, field-level merge, CRDTs, or user resolution based on business impact.
What is the core design for preventing duplicate purchases when retrying after a mobile-network timeout?
Answer: Attach an idempotency key to the same intent and have the server reuse the result
After a timeout, the client cannot know whether the server completed the action. Retry with the same operation ID so the server applies the side effect once and returns the durable result.
Which data-loading design is appropriate for an infinite-scrolling feed?
Answer: Use cursor pagination, a local cache, deduplication, and separate refresh and append states
Cursors and stable IDs reduce duplicates and gaps in changing feeds. Show cached items first and handle initial, refresh, and append errors separately.
Which retry policy is appropriate for mobile network APIs?
Answer: Retry only transient errors with bounded exponential backoff and jitter, respecting lifecycle and cancellation
Separate retryable timeouts, disconnects, and some 5xx errors from client or auth errors needing correction. Retry budgets and jitter limit battery use and thundering herds.
After a user leaves search, an old response returns and overwrites the new screen. What is an appropriate fix?
Answer: Cancel stale tasks on lifecycle or new queries and apply only the latest result by request ID
Asynchronous responses can arrive out of order. Structured concurrency, cancellation, and sequence IDs define lifecycle ownership and result-application conditions.
Which design is appropriate for non-urgent synchronization that should run after the app is closed?
Answer: Delegate to the OS background-task scheduler with constraints, deadlines, and retries
Mobile operating systems restrict background execution. Use platform schedulers with battery, network, or charging constraints and make tasks idempotent and resumable.
The UI stalls during scrolling and ANRs or hangs increase. What is the first design improvement?
Answer: Move network, disk, heavy decoding, and computation off the main thread and measure frame performance
The UI thread handles input and rendering. Trace long tasks, locks, I/O, and excessive layout, then apply asynchronous work, chunking, precomputation, or caching.
A photo list crashes from memory pressure. Which image design is appropriate?
Answer: Downsample to display size and use lazy loading, bounded caching, and cancellation
Decoded image memory can greatly exceed compressed file size. Use thumbnails, appropriate pixel sizes, reuse, and bounded prefetch to reduce peak memory.
Which strategy is appropriate for improving a slow cold start?
Answer: Measure time to initial and full display, keep only essential work, and lazy-load the rest
Trace main-thread initialization, dependency injection, database opening, and SDK startup. Show useful UI early and defer, parallelize, or background nonessential work.
Which synchronization design reduces battery and mobile-data consumption?
Answer: Batch updates and use delta sync, caching, and appropriate constraints and cadence to reduce radio wakeups
Frequent wakeups, GPS, and full downloads consume battery and data. Define freshness needs and, when push triggers sync, fetch actual data only when appropriate.
Which design is most appropriate for storing a login refresh token on a device?
Answer: Use OS-protected storage such as Keychain or Keystore and minimize accessibility conditions and scope
Store tokens in OS secure storage with an accessibility policy appropriate to the use case. Keep them out of logs, backups, clipboards, and screenshots, and remove them on logout or revocation.
A payment app adds root detection. How should server-side authorization be designed?
Answer: Treat device-integrity signals as risk input while the server authorizes every user, action, and object
Clients are modifiable and root or jailbreak detection can be bypassed. The server must make the final decision for sensitive actions; integrity signals can drive risk-based controls such as step-up authentication.
Which operational design is appropriate when certificate pinning is adopted?
Answer: Keep platform TLS validation and plan backup pins, key rotation, and an emergency recovery path
Pinning can disconnect every client after a certificate change. Use it only when justified by the threat model, retaining normal TLS validation and preparing overlapping pins, monitoring, and recovery.
What is the best design for sensitive offline data stored in an on-device database?
Answer: Minimize fields and retention, encrypt with separated keys when needed, and control backups, logs, and logout deletion
Encryption at rest does not protect decrypted displays, logs, backups, or leaked keys. Minimize storage and design key management, access, retention, and deletion together based on data classification.
What is the best timing and fallback for requesting camera permission?
Answer: Request the minimum permission when the user chooses capture, explain why, and offer alternate input after denial or revocation
Just-in-time requests make purpose clear and reduce unnecessary access. Recheck permission state because it can be denied or revoked, and design graceful degradation per feature.
What privacy work is most important before adding a third-party analytics SDK?
Answer: Inventory collected data, destinations, purposes, consent, retention, deletion, and SDK versions, matching store disclosures to behavior
An SDK is part of the app's data supply chain. Verify actual network behavior, configuration, pre-consent transmission, and transitive SDKs; disable unnecessary data and keep disclosures synchronized.
What is a safe design for opening an order-cancellation screen through a universal or app link?
Answer: Verify associated domains, allowlist routes, and perform parameter validation, login, order authorization, and confirmation
Deep links are external input. Domain association verifies entry ownership but does not replace business authorization. Separate navigation from side effects and add reauthentication or confirmation as risk requires.
Which design is most appropriate for a WebView that displays external content?
Answer: Prefer the system browser; when a WebView is required, restrict domains and disable unnecessary JavaScript, bridges, and file access
Connecting web content to native privileges expands the attack surface. Distinguish origins and explicitly define navigation, cookies and tokens, downloads, TLS errors, and popups.
Which design is appropriate for updating order details from a push notification?
Answer: Treat the push payload as an untrusted update hint, fetch authorized current state from the API, and deduplicate processing
Push messages may be delayed, dropped, duplicated, reordered, or exposed on a lock screen. Avoid sensitive data, deduplicate by version or event ID, and converge on authorized server state.
Which session design is appropriate for a mobile app using biometric authentication?
Answer: Use short-lived access tokens with secure refresh and revocation; use biometrics to unlock local credentials and reauthenticate high-risk actions
Biometrics usually establish local user presence to unlock a key or credential. Keep this separate from server session issuance, expiry, revocation, and lost-device response, requiring fresh authentication for sensitive actions.
Which approach is most appropriate for designing an accessible screen?
Answer: Provide semantics, labels, focus order, adequate touch targets, dynamic type, and contrast, then test with screen readers and switch access
Accessibility covers information structure, interaction order, state announcements, and layouts under text scaling, not just labels. Test core flows with real assistive technologies and varied settings.
Which design prevents later failures in localization and right-to-left support?
Answer: Use resource strings and plurals, and test locale formatting, RTL, text expansion, and font fallback with pseudolocales and devices
Word order, plurals, dates, numbers, direction, and glyph widths vary by locale. Resource complete semantic units and verify start/end layouts and expansion early through automated and visual checks.
Which UI-state design is needed for an offline-capable list screen?
Answer: Distinguish loading, empty, stale, offline, partial error, and retry states while preserving existing content during refresh
Connectivity changes and partial failures are normal on mobile. Model data presence, freshness, refresh progress, and action results independently so useful content remains and next actions are clear.
Which observability design is appropriate for a production mobile app?
Answer: Observe crashes, hangs, startup, and network by release, OS, device, and feature flag, redacting PII and secrets with controlled sampling and retention
Mobile failures cluster by release, device, OS, and network. Include diagnostic dimensions and correlation IDs while building minimization, redaction, access control, and retention into telemetry.
Which build practice makes native crashes diagnosable after release?
Answer: Securely retain and map each build's dSYM, mapping files, and native symbols to crash reports, with release IDs and breadcrumbs
Optimized or obfuscated stacks cannot be reconstructed without build-specific symbol artifacts. Have CI uniquely link artifacts and versions, and verify successful upload as a release gate.
What is the best way to roll out a high-risk mobile feature?
Answer: Use a server-controlled default-safe flag, staged cohorts, guardrail metrics, a kill switch, cache expiry, and fallback
Mobile distribution, review, and user updates introduce delay. Provide controls that can stop behavior without replacing the binary, with safe defaults and compatibility for stale config and offline devices.
How should an on-device database schema migration be released safely?
Answer: Test paths from every supported old version with representative data, designing transactions, rollback behavior, and cross-version compatibility
Users skip multiple app versions when updating. Test the migration graph, large-database duration, low disk, and interruption, while keeping server APIs and synchronized data compatible with old and new clients.
Which practice is appropriate for release signing and the dependency supply chain?
Answer: Operate signing keys with least privilege in protected CI or key services, and manage lockfiles, SBOMs, signature checks, dependency scans, and build provenance
A release key is authority to publish app updates. Avoid distributing it manually; add approval, audit, rotation, and recovery. Pin dependencies reproducibly and track provenance and vulnerabilities per release.
Which pre-release testing strategy is most appropriate for a mobile app?
Answer: Automate domain units, repository offline and sync behavior, UI and accessibility, API integration, and upgrades, supplementing with real devices across representative OS, form factors, performance, and networks
Mobile quality depends on OS lifecycle, hardware, permissions, networks, and upgrades as well as logic. Use a risk-based test pyramid and device matrix prioritized by usage distribution and critical flows.
Crash rate spikes on one OS immediately after a staged release. What is the best initial response?
Answer: Pause rollout, disable the feature by flag if possible, preserve release and OS cohorts plus symbolicated stacks, and decide on rollback or hotfix
First limit impact while preserving diagnostic evidence and classifying affected cohorts. After recovery, review the timeline, detection gaps, test coverage, and guardrails, tracking prevention work with owners and deadlines.