Comparison questionMedium~7 minData & APIs / 27 of 33

Interview question

When should a rule be enforced by application validation, and when should it also be enforced by a database constraint?

Database constraints vs application validation

Explains database constraints versus application validation with practical .NET data-access examples and production trade-offs.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

Application validation gives users early, specific feedback, while database constraints protect truth under concurrency and from every writer. I validate required values, formats, ranges, and known business rules in the application, then use NOT NULL, foreign keys, unique constraints, and check constraints for invariants the database can enforce. The two layers complement each other rather than compete.

Full answer below

Practice focus

Understanding of database constraints versus application validation, EF Core/SQL behavior, API boundaries, production risks, and practical debugging or design judgment.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Explain database constraints versus application validation with practical .NET data-access examples and production trade-offs. It matters in real backend work because query shape, indexes, transactions, locking, and data volume can turn harmless-looking code into a production bottleneck. The practical angle is database constraints versus application validation, EF Core/SQL behavior, API boundaries, production risks, and practical debugging or design judgment, tied to a concrete production decision.
Application validation gives users early, specific feedback, while database constraints protect truth under concurrency and from every writer. I validate required values, formats, ranges, and known business rules in the application, then use NOT NULL, foreign keys, unique constraints, and check constraints for invariants the database can enforce. The two layers complement each other rather than compete.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
A pre-check such as 'email is available' improves the experience but cannot guarantee uniqueness because two requests can pass it together. The unique constraint is the final authority, and the API maps its expected violation to a stable conflict or validation response. I avoid duplicating complex business workflows in database triggers, but I keep structural and cross-row invariants close to the data when the database can enforce them reliably.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
In production I document which layer owns each invariant and test the race, not only the friendly pre-check. Constraint names or provider error codes are translated without exposing SQL details to clients. Bulk imports, background jobs, maintenance scripts, and old application versions still meet the same database rules. Schema changes use a migration sequence that cleans existing bad data before adding a stricter constraint. For distributed ownership, a local database cannot enforce a remote service's fact, so the design needs a contract, reservation, or compensating workflow instead of a fictional cross-service foreign key.

Coding practice

Practice the problem like a real interview: restate, reason, implement, and test.

ExampleCandidatePractical exampleWalk through sample input and output.Open details

Details

For order numbers, the API can validate format, but the database should enforce uniqueness. If a unique constraint is violated, the API can return 409 Conflict with a stable error code.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Treating database constraints versus application validation as a syntax detail instead of a production behavior.
Not checking generated SQL, query plans, or actual data volume.
Testing only with tiny local data and assuming production will behave the same.
Fixing symptoms with caching, timeouts, or retries before understanding the data-access cause.

Red flagsCandidateSigns the approach is fragileSignals that an interviewer may treat as risky.Open details

Details

Cannot explain how database constraints versus application validation affects API behavior.
Gives only a definition with no practical example.
Ignores production failure modes.
Does not know how to verify the behavior.

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

Why is an application uniqueness check not enough?
When should the API return 409 Conflict?
What rules belong in the database?
How do background jobs affect validation strategy?

Continue the section

Next in Data & APIs: Read Models

Step 28 of 33

Use read models for complex API screens

Opening drill

Comparison questionMedium~7 minData & APIs / 27 of 33

Interview question

When should a rule be enforced by application validation, and when should it also be enforced by a database constraint?

Database constraints vs application validation

Explains database constraints versus application validation with practical .NET data-access examples and production trade-offs.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

Full answer below

Practice focus

Understanding of database constraints versus application validation, EF Core/SQL behavior, API boundaries, production risks, and practical debugging or design judgment.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Explain database constraints versus application validation with practical .NET data-access examples and production trade-offs. It matters in real backend work because query shape, indexes, transactions, locking, and data volume can turn harmless-looking code into a production bottleneck. The practical angle is database constraints versus application validation, EF Core/SQL behavior, API boundaries, production risks, and practical debugging or design judgment, tied to a concrete production decision.
Application validation gives users early, specific feedback, while database constraints protect truth under concurrency and from every writer. I validate required values, formats, ranges, and known business rules in the application, then use NOT NULL, foreign keys, unique constraints, and check constraints for invariants the database can enforce. The two layers complement each other rather than compete.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
A pre-check such as 'email is available' improves the experience but cannot guarantee uniqueness because two requests can pass it together. The unique constraint is the final authority, and the API maps its expected violation to a stable conflict or validation response. I avoid duplicating complex business workflows in database triggers, but I keep structural and cross-row invariants close to the data when the database can enforce them reliably.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
In production I document which layer owns each invariant and test the race, not only the friendly pre-check. Constraint names or provider error codes are translated without exposing SQL details to clients. Bulk imports, background jobs, maintenance scripts, and old application versions still meet the same database rules. Schema changes use a migration sequence that cleans existing bad data before adding a stricter constraint. For distributed ownership, a local database cannot enforce a remote service's fact, so the design needs a contract, reservation, or compensating workflow instead of a fictional cross-service foreign key.

Coding practice

Practice the problem like a real interview: restate, reason, implement, and test.

ExampleCandidatePractical exampleWalk through sample input and output.Open details

Details

For order numbers, the API can validate format, but the database should enforce uniqueness. If a unique constraint is violated, the API can return 409 Conflict with a stable error code.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Treating database constraints versus application validation as a syntax detail instead of a production behavior.
Not checking generated SQL, query plans, or actual data volume.
Testing only with tiny local data and assuming production will behave the same.
Fixing symptoms with caching, timeouts, or retries before understanding the data-access cause.

Red flagsCandidateSigns the approach is fragileSignals that an interviewer may treat as risky.Open details

Details

Cannot explain how database constraints versus application validation affects API behavior.
Gives only a definition with no practical example.
Ignores production failure modes.
Does not know how to verify the behavior.

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

Why is an application uniqueness check not enough?
When should the API return 409 Conflict?
What rules belong in the database?
How do background jobs affect validation strategy?

Continue the section

Next in Data & APIs: Read Models

Step 28 of 33

Use read models for complex API screens

When should a rule be enforced by application validation, and when should it also be enforced by a database constraint?

Practice focus

Answer path

Why this question matters

Coding practice

Review signals

Follow-up prompts

Continue the section

When should a rule be enforced by application validation, and when should it also be enforced by a database constraint?

Practice focus

Answer path

Why this question matters

Coding practice

Review signals

Follow-up prompts

Continue the section