Node.js MCQs - Express, Middleware, REST APIs and Security (Set 2)

Q1. In Express, what happens if a middleware neither sends a response nor calls next()?

a) Express returns 404

b) Express automatically moves to the next middleware

c) The request hangs until it times out

d) The server crashes

Q2. How does Express recognise an error-handling middleware?

a) It is named errorHandler

b) It must be the first middleware

c) It is registered with app.error()

d) It takes four arguments: (err, req, res, next)

Q3. In Express 4, what happens when an async route handler throws?

a) Express catches it automatically and calls the error handler

b) The handler is called again

c) The rejection is not passed to Express, so you must catch it and call next(err) (or use a wrapper)

d) The request is retried

Q4. Which status code fits a successful POST that created a new resource?

a) 201 Created

b) 302 Found

c) 204 No Content

d) 200 OK

Q5. A user is logged in but tries to delete another user's post. Which status code is most appropriate?

a) 401 Unauthorized

b) 404 Not Found

c) 403 Forbidden

d) 400 Bad Request

Q6. Which HTTP methods are idempotent by definition?

a) POST and PATCH

b) Only GET

c) POST only

d) GET, PUT and DELETE

Q7. Why should a JWT access token be short-lived?

a) Because browsers delete them after one minute

b) Because a stolen JWT is valid until it expires and is hard to revoke, so a short lifetime limits the damage

c) Because they are encrypted

d) Because JWTs cannot be signed

Q8. What does the payload of a standard signed JWT (JWS) guarantee?

a) It never expires

b) It has not been tampered with, but anyone can read it

c) It is encrypted and secret

d) It can only be read by the server

Q9. Your React app on app.example.com calls an API on api.example.com and the browser blocks it. What must the API do?

a) Return the right CORS headers, such as Access-Control-Allow-Origin for app.example.com

b) Disable HTTPS

c) Use JSONP for all requests

d) Move the API to port 80

Q10. What is the purpose of rate limiting an API?

a) To compress responses

b) To cache responses

c) To validate JSON

d) To limit how many requests a client can make in a time window, protecting against abuse and brute-force attacks

Q11. Which practice prevents SQL injection in a Node.js API?

a) Escaping quotes with replace()

b) Running the database on another server

c) Using POST instead of GET

d) Using parameterised queries or an ORM/query builder that binds parameters

Q12. Where should secrets such as database passwords and API keys live?

a) In a public config.json

b) In the frontend bundle

c) In environment variables or a secret manager, never committed to the repository

d) In the source code

Q13. What does a library like Helmet do for an Express app?

a) Connects to databases

b) Sets security-related HTTP headers such as Content-Security-Policy and X-Content-Type-Options

c) Adds authentication

d) Compresses responses

Q14. Why validate request bodies with a schema (for example Zod or Joi) at the API boundary?

a) TypeScript already validates requests at runtime

b) To make responses faster

c) Because types are erased at runtime, and validation rejects malformed or malicious input before it reaches business logic

d) It is required by Express

Q15. What is graceful shutdown in a Node.js server?

a) Disabling logs

b) Killing the process immediately

c) On SIGTERM, stopping new connections, finishing in-flight requests and closing database connections before exiting

d) Restarting every hour