From J2EE to Spring Boot: What Actually Changed?
Java enterprise development has changed dramatically, but many core concerns remain the same: transactions, security, data consistency, scalability, integration and operability. The useful way to prepare for a senior Java interview is not to memorize old J2EE APIs. It is to understand the architectural evolution and why modern Spring Boot systems are designed differently.
1. What Was J2EE Trying to Solve?
J2EE standardized enterprise capabilities such as servlets, JSP, transactions, messaging, persistence and component models. Application servers provided many platform services centrally. This was valuable in an era when enterprise Java needed portability and standard infrastructure.
2. Why Did EJB Gain a Reputation for Complexity?
Earlier EJB models often required heavy configuration, container-specific deployment and programming conventions that were disproportionate for ordinary business services. Later specifications improved substantially, but Spring had already popularized a simpler programming model based on POJOs and dependency injection.
3. What Did Spring Change?
Spring separated application code from many container concerns. Dependency injection, transaction management and data access became easier to compose and test. The architectural lesson is inversion of control: business objects should not need to manually construct every dependency or know infrastructure details.
4. What Did Spring Boot Change?
Spring Boot reduced setup friction through opinionated defaults, auto-configuration, embedded servers and production-oriented features. Instead of deploying every application into a shared heavyweight application server, teams commonly build independently deployable services.
5. Is an Embedded Server Less Enterprise?
No. An embedded Tomcat or Jetty simply packages the HTTP runtime with the service. Enterprise quality comes from architecture, security, observability, deployment discipline and operations, not from whether the servlet container is installed separately.
6. What Is Dependency Injection?
Objects declare dependencies and the container provides them. This reduces construction coupling and supports testing. But dependency injection should not become a service-locator pattern hidden behind annotations. Module boundaries still matter.
7. Constructor Injection or Field Injection?
I generally prefer constructor injection because required dependencies are explicit, objects can be immutable, and unit tests are straightforward. Field injection hides dependencies and makes plain object construction harder.
8. What Does @Transactional Really Do?
Spring typically applies transaction behavior through a proxy. This leads to important details: self-invocation may bypass the proxy, checked-exception rollback behavior differs unless configured, and the transaction only protects resources participating in that transaction manager.
9. Why Should External HTTP Calls Usually Stay Outside a DB Transaction?
A remote call can take seconds or fail unpredictably while database locks remain held. That increases contention and makes recovery harder. I prefer short local transactions and explicit coordination patterns for external effects.
10. How Do You Solve Database + Kafka Dual Writes?
The transactional outbox pattern is one of my preferred answers. The service writes business state and an outbox event in one local transaction. A separate publisher reliably sends the event to Kafka.
@Transactional
public Order createOrder(CreateOrderCommand command) {
Order order = orderRepository.save(Order.create(command));
outboxRepository.save(OutboxEvent.orderCreated(order));
return order;
}11. What Is the Difference Between JPA and Hibernate?
JPA/Jakarta Persistence is a specification; Hibernate is a widely used implementation. Senior engineers should understand the ORM behavior underneath annotations: persistence context, dirty checking, lazy loading, batching and generated SQL.
12. What Is the N+1 Query Problem?
An application fetches a list of parent rows and then lazily executes another query for each child relationship. A page showing 100 orders can accidentally execute 101 queries. Fetch joins, entity graphs or query-specific DTO projections can solve it depending on the use case.
13. Why Should You Inspect Generated SQL?
ORMs reduce boilerplate, not the need to understand databases. Production performance still depends on indexes, query plans, join cardinality, transactions and connection pools.
14. What Is a Good Spring Boot Module Structure?
I prefer business capability boundaries over giant controller/service/repository folders.
com.example.platform
order/
api/
application/
domain/
infrastructure/
payment/
customer/
shared/15. When Would You Use a Modular Monolith?
When one deployment remains operationally simpler and independent scaling or ownership is not yet required. Strong modules make later extraction possible without forcing distributed-system complexity too early.
16. When Would You Move to Microservices?
Independent teams, release cadence, scaling requirements, security boundaries or domain ownership can justify it. “The application is large” by itself is not enough.
17. How Do You Design REST APIs?
Use stable resource semantics, proper status codes, validation, pagination, idempotency where needed, clear error contracts and backward-compatible evolution. REST is not simply exposing every database table through a controller.
18. How Do You Version APIs?
Prefer backward-compatible additive changes. When a break is unavoidable, publish a migration window, observe consumers and deprecate deliberately. URL versioning is only one implementation technique.
19. How Do You Handle Validation?
Transport validation catches malformed input. Domain validation protects business invariants. I avoid relying only on controller annotations for rules that must remain true regardless of transport.
20. What Is the Role of Spring Security?
Authentication verifies identity, authorization decides what that identity may do, and security filters enforce policy around requests. For APIs I often work with OAuth2/OIDC and JWT access tokens, but token validation is only the first step; resource-level authorization still matters.
21. Why Is JWT Not a Session Database Replacement?
JWT can reduce server-side lookup for some authentication flows, but revocation, key rotation, scope design, token lifetime and sensitive-claim handling still need architecture. Long-lived self-contained tokens can create security problems.
22. How Do You Protect an API from Abuse?
Authentication, authorization, rate limits, request-size limits, input validation, timeout policies and audit logging all matter. A WAF or API Gateway can add another protection layer.
23. How Would You Integrate Kafka?
Define event contracts, stable keys, idempotent consumers, retry/DLQ policy, observability, schema evolution and ownership. Publishing JSON to a topic is the easy part; operating the event lifecycle is the architecture.
24. How Do You Handle Duplicate Events?
Assume they can happen. Use stable event IDs, unique constraints or processed-event records so applying an event twice does not corrupt business state.
25. How Do You Handle Backpressure?
Bound consumer concurrency, monitor lag, protect database pools and external services, and scale based on the bottleneck. More Kafka consumers can make a saturated dependency worse.
26. What Is Resilience4j Used For?
It provides patterns such as circuit breaker, retry, rate limiter and bulkhead. The important design question is how policies combine and what the request budget is. Blind retries can create cascading failures.
27. What Is a Bulkhead?
A bulkhead isolates resource pools so failure in one dependency or workload does not consume all threads/connections and take down unrelated operations.
28. What Should Be Observed?
Request rate, error rate, latency percentiles, JVM heap, GC, thread pools, connection pools, Kafka lag, dependency latency, pod restarts and business KPIs. Logs, metrics and distributed traces should be correlated.
29. What JVM Problems Matter in Production?
Heap pressure, excessive allocation, GC pauses, thread contention, deadlocks and native memory can all matter. Modern JVMs are highly capable, but teams still need telemetry rather than assuming “the JVM handles it.”
30. How Do You Diagnose High CPU?
First determine whether CPU is expected because traffic increased. Then correlate endpoints, thread dumps, profiling, GC and recent deployments. High CPU may come from tight loops, serialization, regex, encryption, excessive retries or inefficient queries causing application work.
31. How Do You Diagnose Memory Growth?
Compare heap occupancy after GC, allocation rate, caches, retained objects and workload changes. A growing cache and a true memory leak require different solutions.
32. How Do You Containerize Spring Boot?
Use a minimal runtime, non-root user, deterministic build, health endpoints and sensible JVM/container memory configuration. Keep secrets outside the image.
33. How Should Kubernetes Probes Be Designed?
Liveness should indicate a process that needs restart. Readiness should indicate whether the pod can accept traffic. Do not make liveness depend on every downstream dependency or one outage can trigger unnecessary restart loops.
34. How Do You Gracefully Shut Down Kafka Consumers?
Stop taking new records, finish or safely abandon in-flight work according to processing semantics, commit offsets correctly, close clients and exit before Kubernetes termination grace expires.
35. What Is an Expand-and-Contract Database Migration?
First add the new schema in a backward-compatible way, deploy code that can work with both, migrate data, switch readers/writers, then remove the old schema in a later release. This avoids coupling database change to an instantaneous deployment.
36. Blue/Green or Canary?
Blue/green gives a clear environment switch. Canary exposes the new version gradually. Database compatibility and asynchronous consumers must be considered; HTTP traffic switching alone does not make a stateful migration safe.
37. How Do You Define SLOs?
Start with user-visible reliability: availability, latency or successful business completion. Engineering metrics should support those outcomes. A service can have 99.9% process uptime while users still cannot complete payments.
38. Why Is Cost Part of Architecture?
CPU, memory, database capacity, network traffic and observability all have cost. An architecture that scales technically but consumes resources inefficiently is not production-ready.
39. What Does a Senior Java Engineer Need Beyond Spring?
Databases, distributed systems, security, messaging, cloud, containers, Kubernetes, observability, CI/CD, performance and domain modeling. Framework knowledge is only one layer.
40. What Is the Most Important Interview Skill?
Explain trade-offs. Strong engineers say what they would choose, what could fail, how they would observe it, how they would recover and what complexity the team must own.
FAQ
Is J2EE still relevant?
The term is historical; modern specifications are under Jakarta EE. Understanding the evolution remains useful because many enterprise concepts—servlets, transactions, messaging and persistence—still exist in modern systems.
Spring Boot or Jakarta EE?
Both can build enterprise systems. The right decision depends on ecosystem, team skills, platform standards and operational model. Spring Boot has a very large ecosystem and is common for independent services.
Should every Spring Boot service be a microservice?
No. Spring Boot is also excellent for modular monoliths. Service boundaries should follow business and operational needs.
Related Guides
Your feedback helps prioritize deeper technical content.
Romharshan Singh
Senior Solution Architect and Full Stack Technology Leader with 20+ years of enterprise engineering experience across AI, cloud, distributed systems, Java, Node.js, React, Angular, Kafka and Kubernetes.
