Next.js MCQs - Authentication, Route Handlers and Forms (Set 8)

Q1. Which file creates an API endpoint that answers GET /api/users in the App Router?

a) app/api/users/handler.ts with a default export

b) pages/api/users.tsx exporting a React component

c) app/api/users/route.ts exporting an async function named GET

d) app/api/users/page.tsx with a default export

Q2. What happens if a folder contains both page.tsx and route.ts, for example app/contact/page.tsx and app/contact/route.ts?

a) Both run and their output is merged

b) The page handles GET and the route handles POST

c) Next.js reports a conflict, because a page and a route handler cannot be at the same route segment

d) The route handler is ignored

Q3. In Next.js 15, what is the default caching behaviour of a GET route handler?

a) It is cached in the browser only

b) It is always cached as static output at build time

c) It is not cached by default; you can opt in with export const dynamic = 'force-static'

d) It is cached for 60 seconds

Q4. How do you read the id param in app/api/posts/[id]/route.ts in Next.js 15?

a) export async function GET(req, { params }) { const { id } = await params }

b) const id = req.params.id

c) const id = process.env.id

d) const id = useParams().id

Q5. A client sends JSON in a POST request to a route handler. How do you read the body?

a) request.query

b) JSON.parse(request)

c) const data = await request.json()

d) req.body is already parsed

Q6. In a Next.js 15 Server Component, which code correctly reads the session cookie?

a) document.cookie

b) const s = useCookies().session

c) const store = await cookies(); const s = store.get('session')?.value

d) const s = cookies.session

Q7. Where are you allowed to set or delete a cookie with (await cookies()).set(...)?

a) Only in Server Actions and route handlers (middleware sets cookies on its response instead)

b) Only in Client Components

c) Anywhere, including during Server Component rendering

d) Only in next.config.js

Q8. Which set of options is the best choice for a session cookie that holds a session token?

a) No options, so it works on every site

b) httpOnly: true, secure: true, sameSite: 'lax'

c) Store the token in localStorage instead

d) httpOnly: false so the client can read it

Q9. Middleware redirects users without a session cookie away from /dashboard. Why should the dashboard's data fetching and Server Actions still check the session?

a) Middleware is best treated as an optimistic first check; a matcher mistake or a bypass bug would otherwise expose the data, so auth must also be verified close to the data

b) They should not; middleware is enough

c) Because Server Actions run in the browser

d) Because middleware cannot read cookies

Q10. With Auth.js (NextAuth v5) in the App Router, how is the sign-in endpoint usually exposed?

a) By adding a <NextAuthProvider> only

b) Auth.js does not need any route

c) In app/api/auth/[...nextauth]/route.ts with export const { GET, POST } = handlers, where handlers comes from NextAuth({...})

d) In pages/_app.tsx

Q11. A form has required on its inputs. Why should the Server Action still validate the FormData, for example with Zod safeParse?

a) A Server Action is a public POST endpoint that anyone can call without the form, so client-side checks can be bypassed

b) It does not need to; HTML validation is enough

c) To make the form submit faster

d) Zod is required for Server Actions to compile

Q12. A Server Action is used with useActionState(createPost, initialState). What does React pass to createPost, and what does the hook return?

a) The action gets (formData) only; the hook returns the response

b) The action gets the router; the hook returns nothing

c) The action gets only an event; the hook returns a boolean

d) The action gets (prevState, formData); the hook returns [state, formAction, isPending]

Q13. A component calls useFormStatus() and renders the <form> itself. Why does pending stay false while the form submits?

a) useFormStatus reads the status of a parent form, so it must be called in a component rendered inside the form, such as a SubmitButton

b) useFormStatus only works with GET forms

c) It needs a Suspense boundary

d) pending only updates in development

Q14. After a Server Action inserts a new post, the user should see the updated /posts list and land on the new post. Which order is correct?

a) redirect('/posts/' + id) then revalidatePath('/posts')

b) window.location.reload()

c) revalidatePath('/posts') then redirect('/posts/' + id)

d) Only router.refresh() inside the action

Q15. A Server Action wraps its database call and redirect('/done') in a single try { } catch { return { error: 'Failed' } }. What goes wrong?

a) The database call runs twice

b) redirect() cannot be used in Server Actions

c) Nothing

d) The redirect throws a special NEXT_REDIRECT error, which the catch block swallows, so the user is not redirected and sees "Failed"