This page needs a newer browser to run its tools. You can still read everything here.

Data Formats (JSON, YAML, TOML, XML, CSV) Module 5

YAML 1.2 and its traps interview questions

Interview questions on YAML 1.2 and its traps: short warm-ups, then what each harder question tests, the first step of a good answer and its follow-ups.

17 questions: 6 warm-ups and 11 with model answers · Levels: Fresher to senior

Warm-up questions

Short questions with short answers, each answered in full.

Fresher to mid

Is every JSON document valid YAML?

Answered in the lesson YAML essentials: mappings, sequences, scalars
Fresher to mid

A YAML value starts with | or with >: what changes?

Answered in the lesson Multi-line strings: YAML block scalars
Fresher to mid

What is a YAML schema, and why can two parsers read 010 differently?

Answered in the lesson YAML tags and schemas: failsafe, JSON, core
Fresher to mid

What is the Norway problem in YAML?

Answered in the lesson YAML type traps: Norway, octal, sexagesimal
Fresher to mid

Anchor, alias and merge key: what does each one do?

Answered in the lesson YAML anchors, aliases and merge keys
Fresher to mid

safe_load or load: which one, and why?

Answered in the lesson Safe YAML loading and comment-safe edits

Questions with model answers

What each question tests, the first step of a good answer and the follow-ups to expect.

Fresher to mid

A deploy stops with a YAML syntax error at line 112, column 9 of a 300-line settings file, but line 112 looks correct. How do you find the real cause, and what would stop the next such mistake before it reaches a deploy?
What it tests

Knowing that a parser reports where it stopped, looking past the named line for tabs and indentation, making white space visible, and catching the mistake earlier with an editor setting and a CI check.

First step

Treat the position as the place where the parser gave up, not the place of the mistake. Look at the start of line 113 and at the lines around 112 with the white space made visible, for example cat -et on macOS or cat -A on Linux, which print a tab as ^I.
Follow-ups
- The file loads, but one setting has the wrong value. Where do you look?
- Why is an editor setting not enough on its own?
- What should the CI check do besides parsing?
From the lesson YAML essentials: mappings, sequences, scalars
Model answer, Pro. Model answers open with any pass; prices are in the notice on this page.
Opening the model answers with your pass…
Model answers open with any MySmartCoPilot pass.
Pro pass · 1 week₹79$2.99
30 days₹179$5.99
1 year₹1,699$45
One payment; a pass never renews. The price shown is the total you pay: no fees or charges are added at checkout.
Passes can’t be bought right now, so the model answers can’t be opened at the moment. If you have a pass, enter your licence key.
Choose a pass I have a licence key
It also opens every other in-depth part in Learn and every Pro tool. Sales are final, except where the law gives you a right to withdraw, for example in the EU and the UK (refund policy).
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

Your service keeps one YAML file per branch, 40 files in all. A colleague wants a single file with 40 documents instead. What changes for the code that loads it, for errors and for the people who edit it, and what would you decide?
What it tests

Knowing streams and stream loaders, that a one-document loader keeps only the first document without a warning, how one syntax error affects the rest, and the cost of one large file for reviews and merges.

First step

Find every place that loads these files and the call each one uses. A one-document loader such as Psych's safe_load returns the first document and drops the rest silently, so every reader must move to a stream reader such as safe_load_stream, and a test must check that 40 documents come back.
Follow-ups
- One document has a syntax error. What happens to the other 39?
- How do you check that every document has the same keys?
- When would you keep 40 files?
From the lesson YAML essentials: mappings, sequences, scalars
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

A pipeline compares the CA certificate stored in a YAML file with a pinned SHA-256 digest. After a colleague tidied the file, the check fails, although the certificate text looks the same. What do you check, what probably changed, and how do you make such values safe to edit?
What it tests

Knowing that chomping changes the final bytes of a value, comparing bytes rather than text, and protecting byte-exact values with a test, a stated convention or a separate file.

First step

Load the value from the old and the new version of the file and compare lengths and the last bytes, not the text on screen. Then compare the block headers: a | that became |- removes the final line break, which changes the bytes and therefore every digest of them.
Follow-ups
- Why does the change hardly show in a review of the file?
- Would you keep the certificate in YAML at all?
- What test would catch this before the pipeline does?
From the lesson Multi-line strings: YAML block scalars
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

You must keep a 40-line SQL script inside a YAML settings file, and a tool runs it byte for byte. Its first line is indented, and it ends with a blank line that a checksum covers. How do you write the block, and how do you prove that the loaded value is exact?
What it tests

Choosing literal style, an indentation indicator and keep chomping together, and proving equality against the original bytes with a test.

First step

Use a literal block, because folding would join the lines. Add an indentation indicator, because the first line starts with spaces, and the keep indicator, because the blank line at the end must survive: for a key at the left margin, a header such as |2+.
Follow-ups
- Why not one double-quoted string with escapes?
- What happens to the indicator when the key moves under another key?
- When would you keep the script in its own file?
From the lesson Multi-line strings: YAML block scalars
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

Your team is replacing a YAML 1.1 loader with a YAML 1.2 core-schema loader in a service that reads 300 configuration files. How do you find, before the switch, every value whose type or value will change, and what do you do about each?
What it tests

Knowing where YAML 1.1 and the core schema differ, finding affected values by loading every file with both loaders and comparing, and fixing them with quotes, tags or schema checks.

First step

Load every file with both loaders and compare the results value by value, type included, printing the path of each difference. Expect them in boolean words such as yes and on, octal with a leading 0, the 0o form, binary, underscores, floats without a dot, base-60 numbers and dates.
Follow-ups
- A difference is in a key, not a value. How do you treat it?
- Which differences do you fix in the files, and which in code?
- How do you keep new files from bringing the problem back?
From the lesson YAML tags and schemas: failsafe, JSON, core
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

Your configuration format needs references to secrets, written password: !secret db_password. How would you implement the tag in your loader, and what must happen when another tool that does not know the tag reads the same file?
What it tests

Designing an application tag with a registered handler, refusing unknown tags, keeping resolved secrets out of logs, and knowing that some loaders drop an unknown tag silently.

First step

Work on the parse tree before any values are built, so every tag is visible: replace each !secret node with the looked-up secret, refuse every other unknown tag with its line, and test what each other tool that reads the file does with !secret. Psych's safe_load dropped the tag and returned the name itself.
Follow-ups
- Where should the secret values themselves live?
- How do you keep a secret out of logs and error messages?
- What would you use instead of a tag?
From the lesson YAML tags and schemas: failsafe, JSON, core
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Fresher to mid

A service in a Compose-style file lists its ports as - 22:22 and - 8080:80. The second mapping works; the first one never does. Explain what happened, why only one entry is affected, and how you would fix the file and keep the trap out of new files.
What it tests

Knowing YAML 1.1 base-60 integers and why only small trailing parts match, quoting port mappings as the Compose reference advises, and checking types or linting in CI.

First step

Print what the parser built for the ports list. Under YAML 1.1 rules 22:22 fits the base-60 integer pattern and becomes a number (Psych made it 80520), while 80 after a colon is more than 59, so 8080:80 stays a string.
Follow-ups
- Which other entries in the file are at risk?
- Why does it matter which program reads the file?
- What would you add to CI?
From the lesson YAML type traps: Norway, octal, sexagesimal
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

A script loads the CI pipeline file, raises the timeout of the integration job, and saves the file. After it runs, every job has the new timeout, and the diff also renames anchors to &1 and &2. Explain both effects and rewrite the script so it changes one job and nothing else.
What it tests

Knowing that aliases load as one shared object, that a dump rewrites anchors, and how to edit one value safely: copy before changing, or change the text at the node's position.

First step

Check whether the jobs come from aliases: if they do, they are one object, so the script changed the shared node, not one job. Psych showed the same: after one change both jobs read 5. The anchor names are lost because a dump writes sharing back with names of its own.
Follow-ups
- How do you change one job in memory without touching the others?
- How do you save the change without rewriting the rest of the file?
- What test would have caught it?
From the lesson YAML anchors, aliases and merge keys
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

A converter accepts YAML files of up to 10 KB from users and returns JSON. A 400-byte upload makes it run out of memory. Explain how that can happen, and design the limits you would add, with the order in which they run.
What it tests

Knowing how alias expansion grows with each level, why a size cap alone fails, counting the expansion on the parse tree before building, and the limits parsers ship.

First step

Look for anchors and aliases in the upload. If each level of a file repeats the level before several times, the data grows like a power: in a measured case, 312 bytes of YAML held one key worth 502,441 bytes of JSON, so the file size says little about the output size.
Follow-ups
- Why is turning aliases off not always possible?
- What limit would you choose, and how?
- Which other limits belong in the same guard?
From the lesson YAML anchors, aliases and merge keys
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

In a code review you find a new endpoint that reads an uploaded YAML report with YAML.load_stream in Ruby, and a batch job that calls yaml.load(f, Loader=yaml.Loader) in Python. What do you ask for, what fixed code do you expect, and which test would keep it fixed?
What it tests

Recognising full loaders by behaviour rather than name, asking for safe loaders with explicit allowlists, adding limits for outside input, and a test that fails on a class tag.

First step

Name the risk precisely: both calls build objects of classes that the document names, so an uploaded file decides what the program creates. In Psych 5.3.1, load_stream built a Note from a class tag while safe_load_stream refused it, and yaml.Loader, in PyYAML's own words, may construct an arbitrary Python object.
Follow-ups
- The batch job only reads files the team writes. Does it still matter?
- The report contains dates. How do you load them safely?
- What else should the upload endpoint check?
From the lesson Safe YAML loading and comment-safe edits
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

After a merge, a shared settings file has timeout_seconds: 30 near the top of a mapping and timeout_seconds: 300 at its end. A Ruby service starts with 300; a Node.js service refuses to start. Explain both behaviours, decide what the file should say, and stop it happening again.
What it tests

Knowing that YAML keys must be unique, that parsers differ (keep the last or refuse), finding duplicates with line numbers on the parse tree, and a CI gate.

First step

Both services read the same file and disagree because their parsers treat the repeated key differently: Psych keeps the last value without a warning, while the yaml package for JavaScript checks that keys are unique by default. Find every duplicate with its lines before choosing the value.
Follow-ups
- Which value should win, and who decides?
- How would you find other duplicates across 200 files?
- Why is "last one wins" dangerous even when it picks the right value?
From the lesson Safe YAML loading and comment-safe edits
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes

The lessons of this module

YAML essentials: mappings, sequences, scalars Free lesson, Pro answers: 15 minutes
Multi-line strings: YAML block scalars Free lesson, Pro answers: 15 minutes
YAML tags and schemas: failsafe, JSON, core Free lesson, Pro answers: 15 minutes
YAML type traps: Norway, octal, sexagesimal Free lesson, Pro answers: 15 minutes
YAML anchors, aliases and merge keys Free lesson, Pro answers: 15 minutes
Safe YAML loading and comment-safe edits Free lesson, Pro answers: 15 minutes

All Data Formats (JSON, YAML, TOML, XML, CSV) interview questions · The Data Formats (JSON, YAML, TOML, XML, CSV) track

Warm-up questions

Is every JSON document valid YAML?

A YAML value starts with | or with >: what changes?

What is a YAML schema, and why can two parsers read 010 differently?

What is the Norway problem in YAML?

Anchor, alias and merge key: what does each one do?

safe_load or load: which one, and why?

Questions with model answers

A deploy stops with a YAML syntax error at line 112, column 9 of a 300-line settings file, but line 112 looks correct. How do you find the real cause, and what would stop the next such mistake before it reaches a deploy?

Your service keeps one YAML file per branch, 40 files in all. A colleague wants a single file with 40 documents instead. What changes for the code that loads it, for errors and for the people who edit it, and what would you decide?

A pipeline compares the CA certificate stored in a YAML file with a pinned SHA-256 digest. After a colleague tidied the file, the check fails, although the certificate text looks the same. What do you check, what probably changed, and how do you make such values safe to edit?

You must keep a 40-line SQL script inside a YAML settings file, and a tool runs it byte for byte. Its first line is indented, and it ends with a blank line that a checksum covers. How do you write the block, and how do you prove that the loaded value is exact?

Your team is replacing a YAML 1.1 loader with a YAML 1.2 core-schema loader in a service that reads 300 configuration files. How do you find, before the switch, every value whose type or value will change, and what do you do about each?

Your configuration format needs references to secrets, written password: !secret db_password. How would you implement the tag in your loader, and what must happen when another tool that does not know the tag reads the same file?

A service in a Compose-style file lists its ports as - 22:22 and - 8080:80. The second mapping works; the first one never does. Explain what happened, why only one entry is affected, and how you would fix the file and keep the trap out of new files.

A script loads the CI pipeline file, raises the timeout of the integration job, and saves the file. After it runs, every job has the new timeout, and the diff also renames anchors to &1 and &2. Explain both effects and rewrite the script so it changes one job and nothing else.

A converter accepts YAML files of up to 10 KB from users and returns JSON. A 400-byte upload makes it run out of memory. Explain how that can happen, and design the limits you would add, with the order in which they run.

In a code review you find a new endpoint that reads an uploaded YAML report with YAML.load_stream in Ruby, and a batch job that calls yaml.load(f, Loader=yaml.Loader) in Python. What do you ask for, what fixed code do you expect, and which test would keep it fixed?

After a merge, a shared settings file has timeout_seconds: 30 near the top of a mapping and timeout_seconds: 300 at its end. A Ruby service starts with 300; a Node.js service refuses to start. Explain both behaviours, decide what the file should say, and stop it happening again.