41. When would you choose federation over a monolithic GraphQL server?

Federation is useful when independent teams need autonomous ownership and deployment of different domain areas and the organization is prepared to handle distributed execution and schema governance.

42. What is a GraphQL BFF?

A Backend for Frontend is an API layer tailored to the needs of a particular frontend or group of clients. GraphQL can act as a BFF by aggregating data from multiple backend services.

43. What are persisted GraphQL operations?

They are known GraphQL documents registered ahead of execution and referenced by an identifier. They can improve security, observability, and request efficiency.

44. Why should business logic generally not live directly in resolvers?

Keeping business logic in services or domain modules improves reuse, testing, maintainability, and separation of concerns.

45. How would you debug a slow GraphQL query?

Start with operation-level timing, identify slow resolvers, inspect database and downstream service latency, check for N+1 access, examine query complexity, and use tracing to locate the actual bottleneck.

46. How would you design GraphQL authorization for multi-tenant applications?

Tenant identity should be established from trusted authentication context and every resource access should verify tenant ownership or membership. Client-provided tenant IDs should never be treated as sufficient authorization evidence.

47. How can GraphQL APIs be protected against denial-of-service style expensive queries?

Use authentication-aware rate limits, pagination bounds, query depth and complexity controls, persisted operations where appropriate, timeouts, resource quotas, and infrastructure-level protection.

48. What are the challenges of using GraphQL over multiple microservices?

They include network latency, partial failures, distributed authorization, duplicated data access, schema ownership, query planning, observability, and consistency across services.

49. How should file uploads be handled in a production GraphQL system?

Large files are commonly uploaded directly to object storage using a controlled upload mechanism, while GraphQL manages authorization and metadata rather than carrying large binary payloads through normal API requests.

50. How would you design a production-ready GraphQL API from scratch?

Start with domain-oriented schema design, define clear ownership and nullability, implement authentication and authorization, separate resolvers from business logic, use efficient data access and DataLoader, add bounded pagination and query protection, introduce testing and observability, and establish a safe schema-evolution workflow before scaling infrastructure.