Node.js Advanced Practice

45 questions covering 15 Node.js topics.

Quick Quiz

1. What must a middleware function call to pass control onward?

res.send()next()app.use()return true

2. What happens if a middleware neither calls next() nor sends a response?

Express automatically continuesThe request hangs until the client times outIt throws an error immediatelyIt is skipped automatically

3. What does the express.json() middleware do?

Sends a JSON responseParses an incoming JSON request bodyConverts routes to JSONLogs requests

4. What does req.query contain?

Route parametersThe parsed query stringThe request bodyResponse headers

5. What is required for req.body to be populated with parsed JSON?

Nothing, it works automaticallyThe express.json() middleware must be registeredreq.body only works with formsA database connection

6. What does res.status(201).json({...}) do?

Sends two separate responsesSets the status code to 201, then sends a JSON responseCauses an error since methods cannot be chainedOnly sets the status code, without sending a body

7. What data type is a query parameter always received as?

A numberA stringA booleanIt depends on the value

8. What happens to req.body if express.json() is not registered?

It parses automatically anywayIt remains undefined, even with a valid JSON body sentIt throws an errorIt defaults to an empty array

9. Where would you typically put a resource's unique identifier in a request?

The request bodyA route parameter, like /users/:idA custom header onlyIt cannot be sent

10. Why avoid hardcoding secrets directly in source code?

It has no downsideIt ties code to one environment and risks committing secrets to version controlIt makes the code run fasterJavaScript does not support string literals

11. What does the dotenv package do?

Encrypts environment variablesLoads variables from a .env file into process.env for local developmentDeploys the app to productionReplaces npm

12. Should a .env file containing real secrets be committed to version control?

Yes, alwaysNo, it should be in .gitignoreOnly in private reposOnly for small projects

13. How does Express recognize an error-handling middleware?

By its function nameBy having four parameters: (err, req, res, next)By being registered firstBy returning a Promise

14. In older Express versions, what happens to an unhandled rejected Promise in an async route handler?

It automatically reaches the error-handling middlewareIt does not automatically reach the error handler unless caught and passed via next(err)It crashes the entire server immediatelyIt is silently ignored with no consequence

15. Where must error-handling middleware be registered relative to routes?

First, before any routesLast, after all other routes and middlewareIt does not matterOnly inside individual route files

16. What is the RESTful convention for a URL, per the guidance in this lesson?

Verbs in the URL, like /getUserNouns representing resources, with HTTP methods expressing the actionEvery URL should be a single wordURLs should always include the word "api"

17. What status code conventionally indicates a resource was successfully created?

200201204404

18. What is the conventional difference between PUT and PATCH?

They are identicalPUT replaces the entire resource; PATCH updates only the provided fieldsPUT is for reading, PATCH is for writingPATCH can only be used with JSON

19. Why can't express.json() parse file uploads?

It can, no extra middleware is neededFile uploads use multipart/form-data encoding, not JSONExpress does not support file uploads at allFiles must be base64-encoded first

20. Why is setting a file size limit important?

It is not importantWithout one, large uploads can exhaust server disk space or memoryIt only affects upload speedIt is required by multer syntax

21. Why prefer uploading files to object storage (like S3) over local disk in production?

Local disk is always fasterA local uploads folder does not survive redeploys or scale across multiple server instancesObject storage is required by ExpressThere is no real reason

22. Why start app.listen() only after the database connection succeeds?

It is not necessary, order does not matterTo avoid accepting requests before the app can actually query the databaseExpress requires it syntacticallyIt has no real benefit

23. What does mongoose.model() create?

A raw database connectionA model class used to query and create documents matching a schemaAn Express routeAn environment variable

24. Why listen for connection error events even after the initial connection succeeds?

It is unnecessary once connectedA database connection can become unreachable at any later point during the server's lifetimeIt only matters during testingMongoose requires it for schema validation

25. Why use a connection pool instead of opening a new connection per request?

It has no real benefitOpening a fresh connection per request is slow; a pool reuses ready connectionsPools are required by SQL syntaxIt only matters for MongoDB

26. Why is string-concatenating user input into a SQL query dangerous?

It is not dangerous if done carefullyIt opens the door to SQL injection attacksIt only affects performanceIt is a syntax error

27. What do parameterized queries (like $1 placeholders) protect against?

Slow queriesSQL injection, by safely escaping valuesConnection timeoutsMissing indexes

28. What is the difference between authentication and authorization?

They are the same thingAuthentication verifies identity; authorization checks what an authenticated user is allowed to doAuthorization always happens firstAuthentication only applies to admins

29. Why return the same generic error for "user not found" and "wrong password"?

It has no real reasonDistinguishing them lets an attacker enumerate which emails have accountsIt is required by HTTPIt makes debugging harder for developers

30. Why is it often recommended to use an established library or service for authentication instead of building it entirely from scratch?

Custom authentication is always fasterAuthentication has many subtle security details that are easy to get wrongExpress does not support custom authenticationThere is no real benefit

31. Is the payload of a JWT encrypted?

Yes, alwaysNo, it is only base64-encoded and readable by anyoneOnly with a secret keyOnly in production

32. What does the JWT signature protect against?

NothingThe token being tampered with undetectedThe token expiringNetwork eavesdropping

33. What is a downside of stateless JWTs compared to database-backed sessions?

They cannot be verifiedA JWT cannot be instantly revoked before it expires without extra infrastructureThey are always slowerThey cannot contain a user ID

34. Why is a fast hash function like plain SHA-256 a poor choice for passwords?

It is not actually fastIts speed lets attackers try billions of password guesses per secondIt cannot hash stringsIt is more secure than bcrypt

35. What does a salt do?

Encrypts the password reversiblyEnsures identical passwords produce different hashes and defeats precomputed lookup tablesMakes the password shorterSpeeds up hashing

36. Should a hashed password ever be included in an API response?

Yes, it is safe since it is hashedNo, it should always be excluded from responses and logsOnly for admin usersOnly in development

37. What does CORS control?

Which servers can be accessed by curlWhether a browser allows JavaScript on one origin to make requests to a different originDatabase access permissionsFile upload sizes

38. Does CORS stop a server-to-server request from bypassing it?

Yes, alwaysNo, CORS is a browser-enforced protection, not a general firewallOnly for GET requestsOnly without credentials

39. What does the helmet middleware do?

Parses request bodiesSets a collection of HTTP headers that reduce common web vulnerabilitiesHandles file uploadsConnects to a database

40. What is the main difference between a unit test and an integration test?

Unit tests are always slowerA unit test verifies one function in isolation; an integration test verifies multiple pieces working togetherIntegration tests cannot use assertionsThere is no real difference

41. What does supertest let you do?

Mock a databaseSend HTTP requests directly to an Express app in tests, without a live serverGenerate test data automaticallyReplace Vitest entirely

42. Why is it common to keep app.listen() out of app.js and put it in a separate server.js?

It is required by ExpressSo tests can import the configured app directly, without starting a real serverIt makes the app fasterThere is no real reason

43. Why separate app.js from server.js?

It is required by Node.jsIt lets tests import the configured Express app without starting a real serverIt makes the app run fasterThere is no real benefit

44. Why handle SIGTERM in a production server?

It has no practical useTo finish in-flight requests and close connections cleanly before the process exitsIt is required by npmOnly CLI tools need this

45. What can happen if an unhandled promise rejection is ignored?

Nothing, Node.js always recovers automaticallyIt can silently fail or crash the process in newer Node.js versionsIt only affects the terminal outputIt automatically retries the operation