Django Interview Questions and Answers 2026

Django is a high-level Python web framework built on the "batteries-included" philosophy. Candidates report that the ORM (select_related, prefetch_related, querysets), class-based views vs function-based views, Django REST Framework serializers and ViewSets, middleware, authentication, and signals are the most heavily tested topics in Python backend developer interviews. This guide covers 50 questions from fundamentals to advanced patterns. Confirm the Django version at your target company on their official careers portal.

Table of Contents

1. Django Fundamentals
2. ORM and Models
3. Views and URLs
4. Django REST Framework
5. Authentication and Authorization
6. Middleware and Signals
7. Celery and Async Tasks
8. 5-Question Mock Test
9. Frequently Asked Questions

Django Fundamentals

Q1. What is the Django MVT architecture? Easy

Django follows the MVT (Model-View-Template) pattern:

• Model: Python class mapped to a database table via ORM. Defines schema and business logic.
• View: Python function or class that receives an HTTP request, queries the Model, and returns an HTTP response (usually passing data to a Template).
• Template: HTML files with Django template language ({{ variable }}, {% tag %}) for rendering the response.

Django's URL dispatcher (URLconf) maps URLs to Views, making it slightly different from traditional MVC: Django's View corresponds to a Controller; Django's Template corresponds to an MVC View.

Q2. What is the Django request/response lifecycle? Medium

1. Web server (Gunicorn/uWSGI) receives HTTP request, passes to Django via WSGI/ASGI
2. Request passes through middleware chain (SecurityMiddleware, SessionMiddleware, etc.)
3. URLconf (urls.py) matches URL pattern; dispatches to the matching view
4. View function/class executes: queries database, processes data
5. View returns an HttpResponse (direct or via template rendering)
6. Response passes back through middleware chain (reversed)
7. Response sent to web server and client

Q3. What is settings.py and what are the critical settings? Easy

# settings.py
DEBUG = False  # Never True in production
ALLOWED_HOSTS = ['myapp.com', 'www.myapp.com']
SECRET_KEY = os.environ.get('SECRET_KEY')  # never hardcode

INSTALLED_APPS = [
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.staticfiles',
    'rest_framework',
    'myapp',
]

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.postgresql',
        'NAME': os.environ.get('DB_NAME'),
        'USER': os.environ.get('DB_USER'),
        'PASSWORD': os.environ.get('DB_PASSWORD'),
        'HOST': os.environ.get('DB_HOST', 'localhost'),
        'PORT': '5432',
        'CONN_MAX_AGE': 60,  # persistent connections
    }
}

# Static files
STATIC_URL = '/static/'
STATIC_ROOT = BASE_DIR / 'staticfiles'
MEDIA_URL = '/media/'
MEDIA_ROOT = BASE_DIR / 'media'

# Cache (Redis)
CACHES = {
    'default': {
        'BACKEND': 'django.core.cache.backends.redis.RedisCache',
        'LOCATION': os.environ.get('REDIS_URL', 'redis://localhost:6379/1'),
    }
}

Q4. What is the Django admin and how do you customize it? Easy

# admin.py
from django.contrib import admin
from .models import Post, Category

@admin.register(Post)
class PostAdmin(admin.ModelAdmin):
    list_display = ('title', 'author', 'status', 'created_at')
    list_filter = ('status', 'created_at', 'category')
    search_fields = ('title', 'content', 'author__email')
    prepopulated_fields = {'slug': ('title',)}
    readonly_fields = ('created_at', 'updated_at')
    date_hierarchy = 'created_at'
    ordering = ('-created_at',)
    actions = ['make_published']

    def make_published(self, request, queryset):
        updated = queryset.update(status='published')
        self.message_user(request, f'{updated} posts published.')
    make_published.short_description = 'Mark as published'

    def get_queryset(self, request):
        return super().get_queryset(request).select_related('author', 'category')

Q5. What are Django migrations and how do they work? Medium

Migrations are Django's way of propagating model changes to the database schema.

# Workflow
python manage.py makemigrations myapp  # generate migration files from model changes
python manage.py migrate               # apply pending migrations
python manage.py showmigrations        # list all migrations and status
python manage.py migrate myapp 0003   # migrate to specific migration
python manage.py migrate myapp zero   # unapply all myapp migrations

# squash migrations (merge many into one)
python manage.py squashmigrations myapp 0001 0010

# Data migration example
from django.db import migrations

def populate_slugs(apps, schema_editor):
    Post = apps.get_model('blog', 'Post')
    for post in Post.objects.all():
        from django.utils.text import slugify
        post.slug = slugify(post.title)
        post.save()

class Migration(migrations.Migration):
    dependencies = [('blog', '0003_add_slug_field')]
    operations = [
        migrations.RunPython(populate_slugs, migrations.RunPython.noop)
    ]

ORM and Models

Q6. What is the difference between select_related and prefetch_related? Medium

class Post(models.Model):
    title = models.CharField(max_length=200)
    author = models.ForeignKey(User, on_delete=models.CASCADE)  # FK
    tags = models.ManyToManyField(Tag)  # M2M

# N+1 PROBLEM
posts = Post.objects.all()  # 1 query
for post in posts:
    print(post.author.name)   # 1 query per post (N+1!)
    print(post.tags.all())    # 1 query per post (N+1!)

# select_related: SQL JOIN (for FK / OneToOne)
posts = Post.objects.select_related('author').all()
# -> 1 query with JOIN: SELECT post.*, user.* FROM posts JOIN users ...

# prefetch_related: separate query + Python merge (for M2M / reverse FK)
posts = Post.objects.prefetch_related('tags', 'comments').all()
# -> 1 query for posts + 1 for tags + 1 for comments (3 total, not N+1)

# Combined
posts = Post.objects.select_related('author').prefetch_related('tags', 'comments__author')

# Prefetch with filter
from django.db.models import Prefetch
approved_comments = Comment.objects.filter(approved=True)
posts = Post.objects.prefetch_related(
    Prefetch('comments', queryset=approved_comments, to_attr='approved_comments')
)

Q7. What are QuerySet methods and lazy evaluation? Medium

QuerySets are lazy: they are not executed until evaluated (iterated, sliced, converted to list, len(), bool()).

# Chaining - no DB hit yet
qs = Post.objects.filter(status='published').exclude(is_deleted=True)
qs = qs.select_related('author').order_by('-created_at')

# Evaluated when:
list(qs)           # hits DB
qs[0:10]           # hits DB (SQL LIMIT/OFFSET)
qs.count()         # hits DB (SELECT COUNT)
qs.exists()        # hits DB (SELECT 1 ... LIMIT 1)
qs.first()         # hits DB
for post in qs:    # hits DB

# Aggregation
from django.db.models import Count, Avg, Max, Sum, Q

User.objects.annotate(post_count=Count('posts')).filter(post_count__gt=10)

Post.objects.aggregate(
    total=Count('id'),
    avg_views=Avg('view_count'),
    max_views=Max('view_count'),
)

# Complex filters with Q objects
Post.objects.filter(
    Q(status='published') | Q(is_featured=True),
    Q(created_at__year=2026) & ~Q(author__is_banned=True)
)

# F expressions (database-level field reference)
from django.db.models import F
Post.objects.update(view_count=F('view_count') + 1)  # atomic increment
Post.objects.filter(published_at__gt=F('created_at'))

Q8. What is the Django model Meta class? Easy

class Post(models.Model):
    title = models.CharField(max_length=200)
    slug = models.SlugField(unique=True)
    author = models.ForeignKey(User, on_delete=models.CASCADE)
    created_at = models.DateTimeField(auto_now_add=True)
    view_count = models.IntegerField(default=0)

    class Meta:
        db_table = 'blog_posts'       # custom table name
        ordering = ['-created_at']    # default queryset ordering
        verbose_name = 'Post'
        verbose_name_plural = 'Posts'
        indexes = [
            models.Index(fields=['slug']),             # single field
            models.Index(fields=['author', '-created_at']),  # composite
        ]
        constraints = [
            models.UniqueConstraint(fields=['author', 'slug'], name='unique_author_slug'),
            models.CheckConstraint(check=models.Q(view_count__gte=0), name='non_negative_views'),
        ]

Q9. Predict the output: Medium

from django.db.models import Count

users = User.objects.annotate(post_count=Count('posts'))
print(type(users))
print(type(users.query))

users_list = list(users)
print(type(users_list[0]))
print(hasattr(users_list[0], 'post_count'))

Output:

<class 'django.db.models.query.QuerySet'>
<class 'django.db.models.sql.query.Query'>
<class 'myapp.models.User'>
True

Explanation: users is a QuerySet (lazy, no DB hit). .query is the SQL Query object. list(users) evaluates the QuerySet, executing the SQL. Each element is a User model instance. post_count was added via annotate(), so it exists as an attribute on each User instance.

Q10. What are custom model managers? Advanced

class PublishedManager(models.Manager):
    def get_queryset(self):
        return super().get_queryset().filter(status='published', is_deleted=False)

    def recent(self, days=30):
        from datetime import timedelta
        from django.utils import timezone
        return self.get_queryset().filter(
            created_at__gte=timezone.now() - timedelta(days=days)
        )

    def by_author(self, user):
        return self.get_queryset().filter(author=user)

class Post(models.Model):
    STATUS_CHOICES = [('draft', 'Draft'), ('published', 'Published')]
    title = models.CharField(max_length=200)
    status = models.CharField(max_length=20, choices=STATUS_CHOICES, default='draft')
    is_deleted = models.BooleanField(default=False)

    objects = models.Manager()          # default manager (all objects)
    published = PublishedManager()       # custom manager (filtered)

# Usage
Post.objects.all()                  # all posts including drafts
Post.published.all()                # published, non-deleted only
Post.published.recent(7)            # last 7 days, published only
Post.published.by_author(user)      # user's published posts

Views and URLs

Q11. What is the difference between FBV and CBV in Django? Medium

# Function-Based View (FBV): simple, explicit
from django.shortcuts import render, get_object_or_404

def post_detail(request, pk):
    post = get_object_or_404(Post, pk=pk)
    if request.method == 'POST':
        form = CommentForm(request.POST)
        if form.is_valid():
            comment = form.save(commit=False)
            comment.post = post
            comment.save()
    else:
        form = CommentForm()
    return render(request, 'post_detail.html', {'post': post, 'form': form})

# Class-Based View (CBV): DRY via inheritance, more complex
from django.views.generic import DetailView
from django.contrib.auth.mixins import LoginRequiredMixin

class PostDetailView(LoginRequiredMixin, DetailView):
    model = Post
    template_name = 'post_detail.html'

    def get_context_data(self, **kwargs):
        context = super().get_context_data(**kwargs)
        context['form'] = CommentForm()
        return context

Q12. How do Django URL patterns work? Easy

# urls.py
from django.urls import path, include, re_path
from . import views

urlpatterns = [
    path('', views.HomeView.as_view(), name='home'),
    path('posts/', views.PostListView.as_view(), name='post-list'),
    path('posts/<int:pk>/', views.PostDetailView.as_view(), name='post-detail'),
    path('posts/<slug:slug>/', views.PostDetailView.as_view(), name='post-slug'),

    # Include other URLconfs
    path('api/', include('myapp.api.urls')),
    path('api/v2/', include(('myapp.api.v2.urls', 'v2'), namespace='v2')),

    # Regex path (use sparingly)
    re_path(r'^posts/(?P<year>\d{4})/(?P<month>\d{2})/$', views.archive),
]

# In views
from django.urls import reverse
url = reverse('post-detail', kwargs={'pk': 1})  # /posts/1/
url = reverse('v2:post-list')  # namespaced URL

# In templates
{% url 'post-detail' pk=post.pk %}

Q13. What is Django's template system and how do you create custom tags? Medium

# templatetags/blog_tags.py
from django import template
from django.utils.html import mark_safe
import markdown

register = template.Library()

# Simple tag: returns a value
@register.simple_tag
def active_post_count():
    return Post.published.count()

# Inclusion tag: renders a template
@register.inclusion_tag('partials/recent_posts.html')
def recent_posts(count=5):
    return {'posts': Post.published.order_by('-created_at')[:count]}

# Filter: transforms a value
@register.filter(name='markdown', is_safe=True)
def render_markdown(value):
    return mark_safe(markdown.markdown(value))

# Usage in template
{% load blog_tags %}
{% active_post_count %}
{% recent_posts 3 %}
{{ post.content|markdown }}

Django REST Framework

Q14. What are DRF serializers and how do they work? Medium

from rest_framework import serializers
from .models import Post, User

class UserSerializer(serializers.ModelSerializer):
    class Meta:
        model = User
        fields = ['id', 'username', 'email']
        read_only_fields = ['id']

class PostSerializer(serializers.ModelSerializer):
    author = UserSerializer(read_only=True)
    author_id = serializers.PrimaryKeyRelatedField(
        queryset=User.objects.all(), source='author', write_only=True
    )
    tags = serializers.SerializerMethodField()

    class Meta:
        model = Post
        fields = ['id', 'title', 'slug', 'content', 'author', 'author_id', 'tags', 'created_at']
        read_only_fields = ['id', 'slug', 'created_at']

    def get_tags(self, obj):
        return list(obj.tags.values_list('name', flat=True))

    def validate_title(self, value):
        if len(value) < 5:
            raise serializers.ValidationError('Title must be at least 5 characters')
        return value

    def validate(self, data):
        if data.get('published') and not data.get('content'):
            raise serializers.ValidationError('Published posts must have content')
        return data

    def create(self, validated_data):
        from django.utils.text import slugify
        validated_data['slug'] = slugify(validated_data['title'])
        return super().create(validated_data)

Q15. What are DRF ViewSets and Routers? Medium

from rest_framework import viewsets, permissions, filters
from rest_framework.decorators import action
from rest_framework.response import Response
from django_filters.rest_framework import DjangoFilterBackend

class PostViewSet(viewsets.ModelViewSet):
    serializer_class = PostSerializer
    permission_classes = [permissions.IsAuthenticatedOrReadOnly]
    filter_backends = [DjangoFilterBackend, filters.SearchFilter, filters.OrderingFilter]
    filterset_fields = ['status', 'author']
    search_fields = ['title', 'content']
    ordering_fields = ['created_at', 'view_count']
    ordering = ['-created_at']

    def get_queryset(self):
        return Post.objects.select_related('author').prefetch_related('tags')

    def perform_create(self, serializer):
        serializer.save(author=self.request.user)

    # Custom action: /api/posts/{id}/publish/
    @action(detail=True, methods=['post'], permission_classes=[permissions.IsAuthenticated])
    def publish(self, request, pk=None):
        post = self.get_object()
        if post.author != request.user:
            return Response({'error': 'Not authorized'}, status=403)
        post.status = 'published'
        post.save()
        return Response({'status': 'published'})

# Router auto-generates URLs
from rest_framework.routers import DefaultRouter
router = DefaultRouter()
router.register('posts', PostViewSet, basename='post')
# Generated: GET/POST /posts/, GET/PUT/PATCH/DELETE /posts/{id}/, POST /posts/{id}/publish/

Q16. How does DRF authentication work? Medium

# settings.py
REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': [
        'rest_framework_simplejwt.authentication.JWTAuthentication',
        'rest_framework.authentication.SessionAuthentication',
    ],
    'DEFAULT_PERMISSION_CLASSES': [
        'rest_framework.permissions.IsAuthenticated',
    ],
    'DEFAULT_THROTTLE_CLASSES': [
        'rest_framework.throttling.AnonRateThrottle',
        'rest_framework.throttling.UserRateThrottle',
    ],
    'DEFAULT_THROTTLE_RATES': {
        'anon': '100/day',
        'user': '1000/day',
    },
    'DEFAULT_PAGINATION_CLASS': 'rest_framework.pagination.PageNumberPagination',
    'PAGE_SIZE': 20,
}

# JWT with djangorestframework-simplejwt
from rest_framework_simplejwt.views import TokenObtainPairView, TokenRefreshView

urlpatterns = [
    path('auth/token/', TokenObtainPairView.as_view()),
    path('auth/token/refresh/', TokenRefreshView.as_view()),
]

# Custom permission
class IsAuthorOrReadOnly(permissions.BasePermission):
    def has_object_permission(self, request, view, obj):
        if request.method in permissions.SAFE_METHODS:
            return True
        return obj.author == request.user

Authentication and Authorization

Q17. How does Django's built-in auth system work? Medium

# User model
from django.contrib.auth.models import AbstractUser

class User(AbstractUser):
    bio = models.TextField(blank=True)
    avatar = models.ImageField(upload_to='avatars/', blank=True)
    # AbstractUser already has: username, email, password, first_name, last_name,
    # is_staff, is_superuser, is_active, date_joined, groups, user_permissions

# settings.py
AUTH_USER_MODEL = 'myapp.User'  # must set before first migration

# Permissions
user.has_perm('myapp.view_post')      # app_label.action_modelname
user.has_perm('myapp.change_post', post)  # object-level
user.has_module_perms('myapp')

# Views
from django.contrib.auth.decorators import login_required, permission_required

@login_required
def my_view(request): ...

@permission_required('myapp.change_post', raise_exception=True)
def edit_post(request, pk): ...

# Password hashing
from django.contrib.auth.hashers import make_password, check_password
hashed = make_password('raw_password')  # PBKDF2 with SHA256 by default
valid = check_password('raw_password', hashed)

Middleware and Signals

Q18. How do you create custom Django middleware? Medium

# middleware/timing.py
import time
import logging

logger = logging.getLogger(__name__)

class RequestTimingMiddleware:
    def __init__(self, get_response):
        self.get_response = get_response
        # Called once on startup

    def __call__(self, request):
        start = time.time()

        # Code before view
        response = self.get_response(request)

        # Code after view
        elapsed = time.time() - start
        response['X-Response-Time'] = f'{elapsed:.3f}s'

        if elapsed > 1.0:
            logger.warning(f'Slow request: {request.path} took {elapsed:.3f}s')

        return response

    def process_exception(self, request, exception):
        # Optional: handle exceptions
        pass

    def process_template_response(self, request, response):
        # Optional: modify TemplateResponse before rendering
        return response

# settings.py
MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'myapp.middleware.timing.RequestTimingMiddleware',
    ...
]

Q19. What are Django signals and when should you use them? Advanced

Signals allow decoupled notification when certain actions occur. Built-in signals: pre_save, post_save, pre_delete, post_delete, m2m_changed, request_started, request_finished.

from django.db.models.signals import post_save
from django.dispatch import receiver

@receiver(post_save, sender=User)
def create_user_profile(sender, instance, created, **kwargs):
    if created:
        Profile.objects.create(user=instance)

@receiver(post_save, sender=User)
def save_user_profile(sender, instance, **kwargs):
    instance.profile.save()

# Custom signal
from django.dispatch import Signal

post_published = Signal()  # custom signal

# Sending
post_published.send(sender=Post, post=self, publisher=request.user)

# Connecting (in AppConfig.ready())
from django.apps import AppConfig

class BlogConfig(AppConfig):
    name = 'blog'

    def ready(self):
        import blog.signals  # import connects @receiver decorators

Use signals for true decoupling: when the sender should not know about the receiver (e.g., sending notification when post is published, creating audit logs). Avoid overusing signals as they make code harder to trace.

Celery and Async Tasks

Q20. How do you use Celery with Django? Advanced

# celery.py
import os
from celery import Celery

os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'myproject.settings')

app = Celery('myproject')
app.config_from_object('django.conf:settings', namespace='CELERY')
app.autodiscover_tasks()

# settings.py
CELERY_BROKER_URL = os.environ.get('REDIS_URL', 'redis://localhost:6379/0')
CELERY_RESULT_BACKEND = 'redis://localhost:6379/0'
CELERY_TASK_SERIALIZER = 'json'
CELERY_ACCEPT_CONTENT = ['json']

# tasks.py
from celery import shared_task
from django.core.mail import send_mail

@shared_task(bind=True, max_retries=3, default_retry_delay=60)
def send_welcome_email(self, user_id):
    try:
        user = User.objects.get(pk=user_id)
        send_mail(
            'Welcome!',
            f'Welcome to our platform, {user.first_name}.',
            '[email protected]',
            [user.email],
        )
    except User.DoesNotExist:
        pass
    except Exception as exc:
        raise self.retry(exc=exc)

# Dispatch
send_welcome_email.delay(user.id)
send_welcome_email.apply_async(args=[user.id], countdown=60)  # delay 60s

# Periodic tasks (celery beat)
from celery.schedules import crontab
app.conf.beat_schedule = {
    'cleanup-expired-tokens': {
        'task': 'myapp.tasks.cleanup_expired_tokens',
        'schedule': crontab(hour=2, minute=0),  # 2am daily
    },
}

5-Question Mock Test

Q1. What is the N+1 problem in Django ORM and how do you fix it? Give code examples for both ForeignKey and ManyToMany cases.

Q2. What is the difference between DRF ModelSerializer and Serializer? When would you use each?

Q3. Write a DRF permission class that allows read access to everyone but write access only to the object's owner.

Q4. What are Django signals and when should you prefer them over calling code directly in a view or model method?

Q5. What is the difference between annotate() and aggregate() in Django ORM?

Answers:

A1. N+1: accessing related object per item in a loop. FK fix: Post.objects.select_related('author') (JOIN). M2M fix: Post.objects.prefetch_related('tags') (separate query + Python merge). Combined: chain both.

A2. ModelSerializer auto-generates fields, validators, and create/update from the model Meta. Serializer is fully manual. Use ModelSerializer for standard CRUD; use Serializer for non-model data (login, password change, aggregated responses).

A3. Override has_object_permission: if request.method in SAFE_METHODS return True; else return obj.author == request.user (or obj.owner, depending on model).

A4. Signals when: the caller should not need to know about side effects (send email on user create, create audit log on model save), and the receivers live in different apps. Avoid when: code clarity is more important than decoupling, or when the side effect is always required and the relationship is known.

A5. annotate() adds computed fields to each object in the QuerySet (per-row). aggregate() computes a single dictionary of values across the entire QuerySet. Post.objects.annotate(comment_count=Count('comments')) vs Post.objects.aggregate(total=Count('id'), avg=Avg('view_count')).

Frequently Asked Questions

What is the difference between Django and Flask?

Django is batteries-included: ORM, admin, auth, forms, templates, and more out of the box. Flask is a micro-framework: minimal core, extensions for everything. Django is faster to start with for standard web apps; Flask gives more flexibility for APIs or non-standard projects. Candidates report both appear in Python backend interviews, often as a comparison question.

What is Django REST Framework and do you need it for APIs?

DRF is the standard toolkit for building REST APIs in Django. It provides serializers, generic views, authentication, permissions, throttling, and browsable API. You can build APIs without DRF using JsonResponse and manual view logic, but DRF significantly reduces boilerplate. For production APIs, DRF or its alternatives (Django Ninja, drf-spectacular) are strongly recommended.

What is the Django ORM and when should you use raw SQL?

The Django ORM provides a Python interface to your database via Models and QuerySets. It handles query construction, parameterization (SQL injection prevention), and connection management. Use raw SQL with Manager.raw() or connection.execute() only when the ORM cannot express the query efficiently (complex analytics, specific database functions, bulk operations where ORM overhead matters).

What is the internal mesh of related topics?

• Flask Interview Questions 2026 - compare Django's batteries-included with Flask's minimalism
• FastAPI Interview Questions 2026 - modern async Python API alternative
• Python Interview Questions 2026 - decorators, metaclasses, and async fundamentals
• PostgreSQL Interview Questions 2026 - database queries generated by Django ORM