Multiple choice practice

Node.js REST API MCQ questions

Take a short practice test with instant feedback, then revise every question with its answer and the reason behind it.

Node.js REST API tutorial Interview questions

Questions: 94
From lessons: 74
Your last test: —

Practice test

Node.js REST API practice testTrue or false Question 1 of 10

Generating the spec from the same code that defines routes helps keep the docs accurate.

Score so far: 0/0

All questions with answers

Which method should create a new resource in a collection?
- AGET
- BPOST
- CPUT
- DDELETE
Show answer
Answer: B. POST
POST /api/products creates a product; the server assigns the id.
What does REST stand for?
- ARemote Execution Service Transfer
- BRepresentational State Transfer
- CRequest State Transport
- DResource Endpoint Standard Type
Show answer
Answer: B. Representational State Transfer
REST is an architectural style described by Roy Fielding.
Which status code means “validation failed”?
- A200
- B400
- C404
- D500
Show answer
Answer: B. 400
400 Bad Request (or 422) with details about each invalid field.
Which status code fits a successful DELETE with no body?
- A200
- B201
- C204
- D202
Show answer
Answer: C. 204
204 No Content.
Which status code means “authenticated but not allowed”?
- A401
- B403
- C404
- D409
Show answer
Answer: B. 403
401 means not authenticated; 403 means authenticated but forbidden.
Which library is commonly used to validate request bodies?
- Azod
- Blodash
- Cmoment
- Dchalk
Show answer
Answer: A. zod
zod (or joi, express-validator) describes and checks input shapes.
Which Express object groups routes into a module?
- Aexpress.Group()
- Bexpress.Router()
- Cexpress.Module()
- Dapp.group()
Show answer
Answer: B. express.Router()
A router is mounted with app.use("/api/products", router).
Which query safely limits page size from user input?
- ALIMIT ${req.query.size}
- BLIMIT ? with Math.min(Number(size) || 20, 100)
- CLIMIT req.query.size
- DNo limit is needed
Show answer
Answer: B. LIMIT ? with Math.min(Number(size) || 20, 100)
Convert, default and cap the value, then bind it as a parameter.
What does the cors package do when origin is set to a specific URL?
- ABlocks all requests
- BSends Access-Control-Allow-Origin for that origin
- CEncrypts responses
- DDisables cookies
Show answer
Answer: B. Sends Access-Control-Allow-Origin for that origin
The browser then lets pages from that origin read the response.
Which header carries a bearer token?
- ACookie
- BAuthorization: Bearer <token>
- CX-Token-Auth
- DAccept
Show answer
Answer: B. Authorization: Bearer <token>
The standard is Authorization: Bearer followed by the token.
What are the three parts of a JWT?
- AHeader, payload, signature
- BKey, value, expiry
- CUser, role, secret
- DAlgorithm, body, hash
Show answer
Answer: A. Header, payload, signature
Each part is base64url-encoded and separated by dots.
Is a JWT payload encrypted?
- AYes, always
- BNo, it is only encoded and signed
- COnly with HS256
- DOnly in cookies
Show answer
Answer: B. No, it is only encoded and signed
Anyone can read it; never put secrets in it.
What status should a rate limiter return when the limit is hit?
- A403
- B429
- C503
- D408
Show answer
Answer: B. 429
429 Too Many Requests, ideally with a Retry-After header.
What is wrong with this route?
JavaScript Illustrative
```
1app.delete('/api/orders/:id', requireAuth, async (req, res) => {
2  await pool.query('DELETE FROM orders WHERE id = ?', [req.params.id]);
3  res.sendStatus(204);
4});
```
- ANothing
- BAny logged-in user can delete any order — ownership is not checked
- CDELETE cannot have params
- DIt should return 200
Show answer
Answer: B. Any logged-in user can delete any order — ownership is not checked
Check that the order belongs to req.user (or that the user is an admin) — broken object-level authorization.
Which response suits GET /api/products/999 when it does not exist?
- A200 with null
- B204
- C404 with an error body
- D500
Show answer
Answer: C. 404 with an error body
404 Not Found tells the client the resource does not exist.
Where should a refresh token usually be stored in a browser app?
- AlocalStorage
- BAn httpOnly, Secure cookie
- CA global variable
- DThe URL
Show answer
Answer: B. An httpOnly, Secure cookie
httpOnly cookies cannot be read by injected scripts.
Which tool generates interactive docs from an OpenAPI file?
- ASwagger UI
- BESLint
- CPrettier
- Dnodemon
Show answer
Answer: A. Swagger UI
Swagger UI (or Scalar, Redoc) renders the spec with a “try it” console.
What does res.location() combined with res.status(201) achieve?
- ARedirects the browser
- BTells the client the URL of the new resource
- CCaches the response
- DSets a cookie
Show answer
Answer: B. Tells the client the URL of the new resource
The Location header points to the created resource.
Which logger writes fast structured JSON logs?
- Apino
- Bconsole
- Cdebug
- Dchalk
Show answer
Answer: A. pino
pino is a fast JSON logger; pino-http adds request logging.
Which variable typically switches Express into production behaviour?
- ANODE_ENV=production
- BEXPRESS_MODE=prod
- CENV=live
- DPROD=1
Show answer
Answer: A. NODE_ENV=production
Express and many libraries optimise when NODE_ENV is production.
The payload of a JWT is encrypted, so it is safe to put a password in it.
- ATrue
- BFalse
Show answer
Answer: B. False
JWT payloads are only base64url-encoded and signed. Anyone with the token can read them.
From the lesson: JWT
A logged-in student tries to delete a course reserved for admins. Which status code fits?
- A400
- B401
- C403
- D404
Show answer
Answer: C. 403
403 Forbidden: the user is known but lacks permission.
From the lesson: JWT
Which function checks a token’s signature and expiry?
- Ajwt.decode
- Bjwt.verify
- Cjwt.sign
- DJSON.parse
Show answer
Answer: B. jwt.verify
decode only reads the payload; verify checks it.
From the lesson: JWT
Which URL is the most RESTful way to delete course 7?
- APOST /api/deleteCourse?id=7
- BGET /api/courses/7/delete
- CDELETE /api/courses/7
- DDELETE /api/course?id=7
Show answer
Answer: C. DELETE /api/courses/7
Method = verb, URL = resource.
From the lesson: REST API Fundamentals
What does “stateless” mean in REST?
- AThe API has no database
- BEach request contains everything needed; the server keeps no per-client session between requests
- CResponses are never cached
- DOnly GET is allowed
Show answer
Answer: B. Each request contains everything needed; the server keeps no per-client session between requests
Any server instance can handle any request.
From the lesson: REST API Fundamentals