ASP.NET MVC interview questions and answers

When a type cannot be constructed from simple names, like a comma-separated set of ids or a custom date format.

I catch unhandled exceptions, log with a correlation id, and return a Problem view or JSON.

Authorize Role covers coarse checks.

I cache ViewComponents, avoid N+1 in each widget, and load below-the-fold bits later.

One action does one use case: bind, call a service, map to a view model, return.

I inject fakes for services and assert the ActionResult type and model.

System.Web is gone, HttpContext is different, and many packages were rewritten.

The server issues a token in the form and validates it on POST to stop CSRF.

After a successful POST I redirect to a GET page so refresh does not resubmit the form.

Group controllers, views, and models by feature instead of by technical type.

I sanitize with a vetted library and still encode by default.

After loading the resource I check ownership or ACL in a filter or service.

I measure action time, EF queries, and view render separately with MiniProfiler or Application Insights.

Chunked uploads or direct-to-blob with a short-lived SAS, plus a complete callback to the app.

Lock after N failed attempts with a cooldown and clear messaging.

Permanent redirects from old routes to new ones.

Cache the anonymous shell and load user widgets via AJAX or donut-hole substitution.

Playwright or Selenium fills fields, posts, and asserts DB or UI.

UseHttpsRedirection plus HSTS middleware in production.

Use Identity's stamped tokens that invalidate on password change.