Difference between EXEC() and sp_executesql with no parameters?
sp_executesql supports parameterisation, whereas EXEC only accepts a string.
Only performance differences that may arise are due to the parameterisation i.e. a parameterised sp_executesql call is more likely to have a reusable cached plan. An EXEC call is likely to lead to lots of single use space wasters in the plan cache.
This helped me to crack the interview that's why I'm posting to help someone for the same.
Good luck!