Node.js MCQs - Authentication, Databases, Testing and Deployment (Set 3)

Q1. How should a Node.js app store user passwords?

a) Hashed with a slow, salted algorithm such as bcrypt or Argon2

b) Encrypted with AES so they can be decrypted later

c) Hashed with plain MD5

d) In plain text in a protected table

Q2. Which statement about a JWT payload is correct?

a) It is encrypted by default

b) It is stored on the server

c) It cannot contain user IDs

d) It is Base64URL-encoded and readable by anyone; the signature only prevents tampering

Q3. Which option is generally the safest place to keep an auth token in a browser app to reduce XSS risk?

a) An httpOnly, Secure cookie with SameSite set

b) The URL query string

c) localStorage

d) A JavaScript global variable

Q4. Why do many systems use short-lived access tokens together with refresh tokens?

a) So a stolen access token expires quickly, while the refresh token can get new tokens and can be revoked

b) Because JWTs cannot be verified

c) To reduce bundle size

d) To avoid hashing passwords

Q5. With express-session using a server-side store, what does the browser cookie contain?

a) The user's password

b) All session data

c) A JWT by default

d) Only a signed session ID; the data lives on the server

Q6. What is the correct way to prevent SQL injection in Node.js?

a) Use parameterized queries or prepared statements

b) Escape quotes manually with replace()

c) Validate input on the frontend only

d) Use only POST requests

Q7. Why use a database connection pool?

a) To reuse a set of open connections instead of opening a new one for every request

b) To encrypt connections

c) To run queries in the browser

d) To store query results

Q8. What is the N+1 query problem?

a) Having N + 1 database replicas

b) A Node.js memory leak

c) Running one query with N joins

d) Fetching a list with one query and then running a separate query for each item

Q9. What is required to use multi-document transactions in MongoDB?

a) A standalone server is enough

b) A replica set or sharded cluster

c) Disabling indexes

d) Mongoose version 1

Q10. How does Supertest usually test an Express app?

a) It needs the app deployed to a server

b) It replaces Express routing

c) It takes the app object and sends HTTP requests to it in memory without a fixed port

d) It only tests React components

Q11. What does jest.mock("./db") do in a test file?

a) Runs the database in memory

b) Deletes the db module

c) Skips the test file

d) Replaces the module with an automatic mock so tests do not hit a real database

Q12. Why should configuration such as database URLs and secrets come from environment variables?

a) The same code can run in different environments, and secrets stay out of the source code

b) It is required by npm

c) They are faster

d) Node cannot read JSON files

Q13. How can a Node.js server use all CPU cores?

a) Increase the event loop size

b) Use more async functions

c) Node automatically uses all cores

d) Run multiple processes with the cluster module, PM2 cluster mode or multiple containers behind a load balancer

Q14. What should a graceful shutdown do when the process receives SIGTERM?

a) Ignore the signal

b) Restart the process

c) Stop accepting new connections, finish in-flight requests, close database connections, then exit

d) Exit immediately

Q15. What does the Helmet middleware do in an Express app?

a) Validates JSON bodies

b) Sets HTTP security headers such as Content-Security-Policy and X-Content-Type-Options

c) Rate-limits requests

d) Hashes passwords