Learning path
Backend Engineer learning path: everything to study, topic by topic
Comprehensive backend engineering assessment covering API design, data persistence, authentication and security, architecture patterns, production readiness, and distributed systems.
Short answer
To learn Backend Engineer, work through 6 modules and 36 topics in the order they build on each other. It starts with API Design & Development, then moves on to Data Persistence and Authentication & Security. Use the map as a checklist, or measure your level and study only what is missing.
What you will study
Topics are grouped by module. Open one to see its objectives and key concepts.
1 · API Design & Development6 topics
REST API Design
Resource modeling, URI conventions, HTTP methods, HATEOAS, content negotiation, and idempotency in RESTful API design
Objectives
- Design RESTful APIs following resource-oriented conventions
- Apply idempotency and proper HTTP method semantics
Key concepts
- resource modeling
- URI naming conventions
- HTTP methods
- HATEOAS
- content negotiation
- idempotency
- pagination
- filtering
HTTP Protocol & Status Codes
HTTP/1.1 vs HTTP/2 vs HTTP/3, status code semantics, headers, caching directives, and connection management
Objectives
- Select appropriate HTTP status codes for different API responses
- Configure caching headers to optimize API performance
Key concepts
- HTTP status codes
- request/response headers
- content types
- caching headers
- ETag
- connection keep-alive
- HTTP/2 multiplexing
- CORS headers
API Versioning & Documentation
Versioning strategies (URL, header, query), breaking vs non-breaking changes, OpenAPI/Swagger specification, and API lifecycle management
Objectives
- Choose an appropriate API versioning strategy with clear trade-offs
- Document APIs using OpenAPI specification for consumer clarity
Key concepts
- URL versioning
- header versioning
- semantic versioning
- OpenAPI specification
- breaking changes
- deprecation policy
- API lifecycle
- Swagger documentation
GraphQL Fundamentals
Schema design, queries, mutations, subscriptions, resolvers, N+1 problem, and DataLoader pattern in GraphQL APIs
Objectives
- Design GraphQL schemas that avoid common performance pitfalls
- Evaluate when GraphQL is preferable to REST for a given use case
Key concepts
- schema definition language
- queries and mutations
- subscriptions
- resolvers
- N+1 problem
- DataLoader
- schema stitching
- federation
gRPC & Protocol Buffers
Protocol Buffer schema design, gRPC service patterns (unary, streaming), performance characteristics, and inter-service communication
Objectives
- Design efficient gRPC services for inter-service communication
- Choose between REST, GraphQL, and gRPC based on system requirements
Key concepts
- Protocol Buffers
- proto3 syntax
- unary RPC
- server streaming
- client streaming
- bidirectional streaming
- gRPC interceptors
- deadline propagation
API Governance at Scale
Establishing API design standards, versioning policies, lifecycle management, and breaking change governance across large engineering orgs
Objectives
- Establish org-wide API governance frameworks that scale across dozens of teams
- Define deprecation policies and breaking change governance that minimize consumer disruption
Key concepts
- API versioning strategies
- deprecation policy
- API linting
- style guides
- contract testing
- API catalog
- breaking changes
2 · Data Persistence5 topics
Relational Database Design
Normalization forms, entity-relationship modeling, primary and foreign keys, indexes, and constraints for relational databases
Objectives
- Design normalized database schemas that balance integrity and performance
- Create appropriate indexes for common query patterns
Key concepts
- normalization
- 1NF/2NF/3NF/BCNF
- entity-relationship diagrams
- primary keys
- foreign keys
- indexes
- constraints
- denormalization trade-offs
SQL Query Optimization
Query execution plans, index selection, JOIN optimization, subquery vs CTE, partitioning, and database-level performance tuning
Objectives
- Analyze query execution plans to identify performance bottlenecks
- Optimize slow queries through indexing and query restructuring
Key concepts
- EXPLAIN plans
- index types
- covering indexes
- JOIN strategies
- CTEs vs subqueries
- table partitioning
- query hints
- connection pooling
NoSQL Data Modeling
Document, key-value, columnar, and graph data models; access pattern-driven design, denormalization strategies, and single-table design in DynamoDB
Objectives
- Model data for NoSQL databases based on access patterns rather than entities
- Apply single-table design patterns for DynamoDB workloads
Key concepts
- document databases
- key-value stores
- columnar databases
- graph databases
- access patterns
- single-table design
- partition keys
- GSI/LSI
ORM Patterns & Anti-Patterns
Active Record vs Data Mapper, lazy vs eager loading, N+1 queries, unit of work, repository pattern, and raw SQL escape hatches
Objectives
- Identify and fix ORM anti-patterns like N+1 queries
- Choose between ORM abstractions and raw SQL for different scenarios
Key concepts
- Active Record
- Data Mapper
- lazy loading
- eager loading
- N+1 queries
- unit of work
- identity map
- raw SQL escape
Database Migration Strategies
Schema evolution, zero-downtime migrations, expand-contract pattern, data backfill strategies, and migration tooling
Objectives
- Execute zero-downtime database migrations using the expand-contract pattern
- Plan migration rollback strategies for production databases
Key concepts
- schema evolution
- zero-downtime migration
- expand-contract pattern
- data backfill
- migration versioning
- rollback strategies
- blue-green database
- online DDL
3 · Authentication & Security6 topics
Authentication Patterns (JWT/OAuth2/OIDC)
JWT structure and validation, OAuth2 flows, OpenID Connect, session management, token refresh strategies, and multi-factor authentication
Objectives
- Implement secure authentication flows using JWT and OAuth2
- Choose the appropriate OAuth2 flow for different client types
Key concepts
- JWT structure
- access tokens
- refresh tokens
- OAuth2 flows
- authorization code flow
- PKCE
- OpenID Connect
- session management
Authorization Models (RBAC/ABAC)
Role-based access control, attribute-based access control, policy engines, permission hierarchies, and multi-tenant authorization
Objectives
- Design authorization models that scale with organizational complexity
- Evaluate RBAC vs ABAC trade-offs for multi-tenant systems
Key concepts
- RBAC
- ABAC
- policy engines
- permission hierarchies
- resource-based access
- multi-tenant authorization
- OPA
- Casbin
Input Validation & Sanitization
Server-side validation, sanitization techniques, SQL injection prevention, XSS mitigation, and content security policies
Objectives
- Implement server-side validation that prevents injection attacks
- Apply defense-in-depth input handling strategies
Key concepts
- input validation
- sanitization
- SQL injection
- XSS prevention
- parameterized queries
- content security policy
- allowlisting vs denylisting
- schema validation
OWASP Top 10 Backend
Broken access control, cryptographic failures, injection, insecure design, security misconfiguration, and SSRF from the OWASP Top 10
Objectives
- Identify and mitigate OWASP Top 10 vulnerabilities in backend code
- Design security controls that address the most common attack vectors
Key concepts
- broken access control
- cryptographic failures
- injection attacks
- insecure design
- security misconfiguration
- SSRF
- vulnerable components
- security logging
Secrets Management
Vault-based secrets, rotation policies, envelope encryption, environment-based configuration, and zero-trust secret access
Objectives
- Design secrets management pipelines with automatic rotation
- Implement zero-trust patterns for secret access in microservices
Key concepts
- HashiCorp Vault
- AWS Secrets Manager
- secret rotation
- envelope encryption
- dynamic secrets
- zero-trust access
- sidecar injection
- audit logging
Zero-Trust Backend Architecture
Designing backend systems with zero-trust principles: mTLS, service identity, least-privilege, and network segmentation
Objectives
- Design backend systems where no service or network segment is implicitly trusted
- Implement workload identity and mTLS for service-to-service authentication
Key concepts
- mTLS
- SPIFFE/SPIRE
- service mesh
- least privilege
- network segmentation
- secret rotation
- workload identity
4 · Architecture & Patterns8 topics
Layered Architecture
Presentation, business, and data layers; dependency inversion, hexagonal architecture, clean architecture, and onion architecture
Objectives
- Structure backend applications using layered architecture with clear boundaries
- Apply dependency inversion to decouple business logic from infrastructure
Key concepts
- layered architecture
- hexagonal architecture
- clean architecture
- onion architecture
- dependency inversion
- ports and adapters
- use cases
- interface segregation
Domain-Driven Design
Bounded contexts, aggregates, entities, value objects, domain events, ubiquitous language, and context mapping in DDD
Objectives
- Decompose complex domains into bounded contexts with clear boundaries
- Model aggregates that enforce business invariants
Key concepts
- bounded contexts
- aggregates
- entities
- value objects
- domain events
- ubiquitous language
- context mapping
- anti-corruption layer
Event-Driven Architecture
Event types (domain, integration, notification), event bus patterns, choreography vs orchestration, eventual consistency, and event schemas
Objectives
- Design event-driven systems with clear event ownership and schemas
- Choose between choreography and orchestration for workflow coordination
Key concepts
- domain events
- integration events
- event bus
- choreography
- orchestration
- eventual consistency
- event schemas
- dead letter queues
CQRS & Event Sourcing
Command-query responsibility segregation, event sourcing, projections, snapshots, event store design, and replay strategies
Objectives
- Design CQRS systems that separate read and write responsibilities effectively
- Evaluate when event sourcing adds value versus unnecessary complexity
Key concepts
- CQRS
- event sourcing
- projections
- snapshots
- event store
- event replay
- read models
- eventual consistency
Microservices vs Monolith Trade-offs
Monolith-first approach, microservice decomposition, service boundaries, modular monolith, strangler fig pattern, and organizational alignment
Objectives
- Evaluate microservices vs monolith trade-offs for a given organizational context
- Plan monolith-to-microservices migration using the strangler fig pattern
Key concepts
- monolith-first
- microservice decomposition
- service boundaries
- modular monolith
- strangler fig pattern
- Conway's law
- data ownership
- shared nothing
Platform Engineering Principles
Designing internal developer platforms: paved roads, self-service capabilities, and golden paths
Objectives
- Design internal developer platforms that reduce cognitive load across engineering teams
- Define paved roads and golden paths that balance standardization with flexibility
Key concepts
- IDP
- paved road
- golden path
- self-service
- Backstage
- developer experience metrics
- platform as product
Multi-Tenancy Data Isolation
Designing and implementing multi-tenant data isolation using silo, pool, and bridge models with appropriate trade-offs
Objectives
- Select and implement appropriate multi-tenancy isolation models based on security and cost requirements
- Design tenant context propagation that prevents cross-tenant data leakage
Key concepts
- silo model
- pool model
- bridge model
- row-level security
- schema-per-tenant
- noisy neighbor
- tenant context propagation
ML-Backed Services Integration
Integrating ML model inference into backend services: model serving patterns, feature stores, versioning, and fallback strategies
Objectives
- Design backend services that integrate ML inference with appropriate latency and fallback guarantees
- Implement model versioning and A/B deployment patterns for production ML services
Key concepts
- model serving
- REST vs gRPC inference
- feature stores
- model versioning
- A/B deployment
- shadow mode
- fallback logic
5 · Production Readiness5 topics
Error Handling & Logging
Structured error responses, exception hierarchies, structured logging, correlation IDs, log levels, and error aggregation
Objectives
- Design consistent error responses with meaningful error codes
- Implement structured logging with correlation IDs for request tracing
Key concepts
- structured error responses
- exception hierarchies
- structured logging
- correlation IDs
- log levels
- error aggregation
- stack trace handling
- sensitive data masking
Health Checks & Monitoring
Liveness vs readiness probes, dependency health checks, metrics exposition, alerting thresholds, and SLI definition for backend services
Objectives
- Design health check endpoints that accurately reflect service status
- Expose application metrics for monitoring and alerting
Key concepts
- liveness probes
- readiness probes
- startup probes
- dependency health checks
- metrics exposition
- Prometheus metrics
- alerting thresholds
- SLI definition
Rate Limiting & Throttling
Token bucket, sliding window, fixed window algorithms; distributed rate limiting, API quotas, and backpressure mechanisms
Objectives
- Implement rate limiting algorithms appropriate for distributed systems
- Design API quota systems with clear client communication
Key concepts
- token bucket
- sliding window
- fixed window
- distributed rate limiting
- API quotas
- backpressure
- retry-after headers
- rate limit headers
Graceful Degradation
Circuit breaker pattern, bulkhead isolation, fallback strategies, feature flags for degradation, and partial response patterns
Objectives
- Design systems that degrade gracefully under partial failure
- Implement circuit breaker patterns with appropriate thresholds
Key concepts
- circuit breaker
- bulkhead isolation
- fallback strategies
- feature flags
- partial responses
- timeout budgets
- retry with backoff
- load shedding
Performance Profiling & Optimization
CPU and memory profiling, flame graphs, garbage collection tuning, connection pool sizing, and latency optimization techniques
Objectives
- Use profiling tools to identify performance bottlenecks in backend services
- Optimize hot paths based on profiling data and latency percentile analysis
Key concepts
- CPU profiling
- memory profiling
- flame graphs
- GC tuning
- connection pool sizing
- latency percentiles
- async optimization
- hot path optimization
6 · Distributed Systems6 topics
Message Queues & Async Processing
Queue vs topic semantics, delivery guarantees, dead letter queues, consumer groups, idempotent consumers, and backpressure handling
Objectives
- Design message-driven architectures with appropriate delivery guarantees
- Implement idempotent consumers to handle duplicate messages safely
Key concepts
- queue vs topic
- at-least-once delivery
- exactly-once semantics
- dead letter queues
- consumer groups
- idempotent consumers
- message ordering
- backpressure
Caching Strategies
Cache-aside, read-through, write-through, write-behind patterns; TTL strategies, cache invalidation, and distributed cache consistency
Objectives
- Select appropriate caching patterns based on data access characteristics
- Design cache invalidation strategies that maintain data consistency
Key concepts
- cache-aside
- read-through
- write-through
- write-behind
- TTL strategies
- cache invalidation
- cache stampede
- distributed cache
Distributed Transactions
Two-phase commit, saga pattern (choreography vs orchestration), compensating transactions, and outbox pattern for reliable messaging
Objectives
- Design saga-based workflows for cross-service transactions
- Implement the outbox pattern for reliable event publishing
Key concepts
- two-phase commit
- saga pattern
- choreography saga
- orchestration saga
- compensating transactions
- outbox pattern
- idempotency keys
- eventual consistency
Consensus & Consistency Patterns
CAP theorem, PACELC, Raft/Paxos overview, quorum-based reads/writes, vector clocks, and conflict resolution strategies
Objectives
- Apply CAP theorem to make informed consistency-availability trade-offs
- Design conflict resolution strategies for distributed data stores
Key concepts
- CAP theorem
- PACELC
- Raft consensus
- Paxos
- quorum reads/writes
- vector clocks
- conflict resolution
- CRDTs
Multi-Region Architecture
Active-active and active-passive topologies, data replication strategies, latency-based routing, conflict resolution, and disaster recovery
Objectives
- Design multi-region architectures with appropriate consistency guarantees
- Plan disaster recovery strategies meeting defined RPO/RTO objectives
Key concepts
- active-active
- active-passive
- data replication
- latency-based routing
- geo-partitioning
- conflict resolution
- RPO/RTO
- disaster recovery
Service Mesh Patterns
Implementing service mesh patterns: sidecar proxy, circuit breakers, retry policies, and observability in distributed systems
Objectives
- Design service mesh configurations that implement resilience patterns without code changes
- Apply retry budgets, circuit breakers, and traffic shaping for production safety
Key concepts
- sidecar pattern
- circuit breaker
- retry with jitter
- timeout propagation
- traffic shaping
- health checks
- Envoy/Istio
Levels: Junior, Mid, Senior, and Expert
Explain it in your own words
Graded by AI · no account · 1 questionNo options to guess from: you write, the AI grades against the topic's rubric and tells you what level your answer reads at.
Already studying Backend Engineer?
The assessment measures topic by topic, and your plan skips what you already know.
Open to read. An account is only needed to be measured.
Frequently asked questions
Where should I start studying Backend Engineer?
Start with API Design & Development: REST API Design, HTTP Protocol & Status Codes, and API Versioning & Documentation. The map orders topics by what they depend on, so each one prepares the next.
How long does a full Backend Engineer assessment take?
A full assessment of this path takes about 55 minutes. Study time depends on where you start; a diagnostic shows which topics you can skip.
Do I need an account to use this page?
No. The map, objectives and key concepts are open. You only need an account to be measured, get your gap by topic and receive a plan.