Top 30 Advanced Node.js & Express Concepts Quiz

30 questions. Pick an answer, or open “Show the answer” to read it.

Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.

1. Question 1 of 30

   How does Libuv ensure non-blocking I/O for operations that lack native asynchronous support from the operating system?

   • aIt queues these operations and processes them sequentially in a separate, single-threaded background process.
   • bIt transforms the synchronous I/O call into a Promise, allowing the JavaScript engine to continue execution.
   • cIt uses a dedicated thread pool to execute these operations, preventing the main JavaScript thread from blocking.
   • dIt directly executes these operations on the main JavaScript thread, relying on the OS to manage concurrency.
   Show the answer

   Answer: c · It uses a dedicated thread pool to execute these operations, preventing the main JavaScript thread from blocking.

   Libuv employs a thread pool for I/O operations that do not have native asynchronous OS APIs, allowing these tasks to run in the background without blocking the main JavaScript event loop. Relying on the main thread or just JavaScript Promises would not achieve true non-blocking I/O at the system level.

   Read the full bite: Libuv: The Engine Behind Node.js Async I/O

2. Question 2 of 30

   For which task would Node.js Worker Threads provide the most significant benefit?

   • aHandling concurrent network requests from many clients.
   • bQuerying a remote database for user profiles.
   • cProcessing a large video file to apply a filter.
   • dReading multiple files from the local filesystem.
   Show the answer

   Answer: c · Processing a large video file to apply a filter.

   Worker threads are specifically designed for CPU-bound operations like video processing to offload heavy computation from the main thread. I/O-bound tasks, such as database queries or network requests, are already efficiently managed by Node's event loop and do not benefit from worker threads.

   Read the full bite: Worker Threads: True Parallelism in Node.js

3. Question 3 of 30

   What is the primary advantage of employing the Node.js cluster module in a multi-core environment?

   • aIt facilitates the distribution of application load across multiple physical servers using an internal load balancer.
   • bIt provides a low-overhead mechanism for inter-process communication, ideal for tasks requiring frequent data exchange.
   • cIt allows a single Node.js application to utilize all available CPU cores for I/O-bound network operations on one machine.
   • dIt enables direct memory sharing between worker processes for CPU-intensive computations.
   Show the answer

   Answer: c · It allows a single Node.js application to utilize all available CPU cores for I/O-bound network operations on one machine.

   The cluster module's core purpose is to enable a single Node.js application to fully utilize all CPU cores on a *single* multi-core machine for I/O-bound tasks like network applications. It is not designed for direct memory sharing (that's worker_threads), distributing across multiple physical servers, or low-overhead IPC for frequent data exchange, as IPC overhead is noted as high.

   Read the full bite: Node.js Cluster: Scaling on a Single Machine

4. Question 4 of 30

   If module A requires B, and B subsequently requires A, what does Node.js provide to B for A's exports when A was the module initially loaded?

   • aAn empty object or a partially populated module.exports object from A.
   • bA null value, indicating that the dependency could not be resolved.
   • cA fully resolved module.exports object from A, as if A had finished executing.
   • dA runtime error, immediately halting execution due to the detected cycle.
   Show the answer

   Answer: a · An empty object or a partially populated module.exports object from A.

   To prevent an infinite loop, Node.js returns the module.exports object from A as it exists at that moment, which is often incomplete. It does not immediately crash or provide a fully resolved object, but rather an unfinished version that can lead to later TypeErrors.

   Read the full bite: Node.js Circular Dependencies: The Unfinished Export

5. Question 5 of 30

   What is the primary advantage of using an NPM scope (e.g., @my-org/package) for your packages?

   • aIt ensures your package name is globally unique without requiring any special prefixes.
   • bIt allows you to publish private packages and organize related modules under a shared namespace.
   • cIt simplifies the installation command for users by shortening the package name.
   • dIt automatically sets your package's visibility to private, preventing public access by default.
   Show the answer

   Answer: b · It allows you to publish private packages and organize related modules under a shared namespace.

   Option B accurately describes the core benefits of NPM scopes: they are mandatory for publishing private packages and provide a way to group related modules under a common, unique namespace. Option D is incorrect because the card states that scoped packages are public by default and require a specific flag for private access.

   Read the full bite: NPM Scopes: Namespacing Packages to Avoid Collisions

6. Question 6 of 30

   When using Promise.race() for a network request with a timeout, what is the outcome if the timeout promise rejects before the network request resolves?

   • aThe Promise.race() promise will eventually resolve with the network request's data.
   • bThe Promise.race() promise will resolve with an array of results from both promises.
   • cThe Promise.race() promise will wait for both to complete and then reject if either failed.
   • dThe Promise.race() promise will reject with the timeout's error.
   Show the answer

   Answer: d · The Promise.race() promise will reject with the timeout's error.

   Promise.race() settles with the outcome of the very first promise to settle, regardless of whether it resolves or rejects. If the timeout promise rejects first, the race() promise immediately rejects with that error. The network request's eventual resolution is ignored because it was not the first to settle.

   Read the full bite: Promise.race(): First Promise to Settle Wins

7. Question 7 of 30

   What is the primary reason to use Promise.allSettled() over Promise.all() for multiple asynchronous tasks?

   • aTo obtain a status report for every task, allowing individual handling of successes and failures.
   • bTo optimize performance by running all promises concurrently and discarding failed ones.
   • cTo ensure the entire operation fails immediately if any single task encounters an error.
   • dTo retrieve the result of the first promise that completes, whether it succeeds or fails.
   Show the answer

   Answer: a · To obtain a status report for every task, allowing individual handling of successes and failures.

   Promise.allSettled() is designed to provide an outcome for every promise in the batch, whether it fulfilled or rejected, allowing for graceful handling of partial failures. Option C describes Promise.all(), which short-circuits and rejects the entire batch if any promise fails.

   Read the full bite: Promise.allSettled(): Never Fail a Batch of Promises

8. Question 8 of 30

   Which scenario best describes when to use Promise.any()?

   • aTo wait for all promises to settle (fulfill or reject) and get their individual outcomes.
   • bTo ensure all provided promises fulfill successfully before proceeding with their combined results.
   • cTo get the value from the very first promise that either fulfills or rejects.
   • dTo retrieve the result from the first promise that successfully completes, ignoring any failures.
   Show the answer

   Answer: d · To retrieve the result from the first promise that successfully completes, ignoring any failures.

   The correct answer (D) accurately describes Promise.any()'s purpose: to get the first successful result, even if other promises fail. Option C describes Promise.race(), which settles with the first promise regardless of its outcome.

   Read the full bite: Promise.any(): Get the Fastest Successful Result

9. Question 9 of 30

   How does Top-Level Await primarily affect the loading and execution of an ES module and its dependencies?

   • aIt pauses the execution of the specific module and any modules that depend on it until the top-level promise resolves.
   • bIt allows the module to perform asynchronous setup, but only if it is imported using a dynamic import() statement.
   • cIt forces the entire application to wait for the module's asynchronous operations to complete before any other modules can load.
   • dIt converts the module into a CommonJS module, enabling require() calls to handle asynchronous dependencies.
   Show the answer

   Answer: a · It pauses the execution of the specific module and any modules that depend on it until the top-level promise resolves.

   The card states that Top-Level Await "pauses the execution of that specific module" and that "When another module imports it, the JavaScript engine effectively 'awaits' the completion of the module being imported." This means dependent modules will wait. Option C is incorrect because the card explicitly states, "it does not block the main thread for other unrelated tasks."

   Read the full bite: Top-Level Await: `await` Without an `async` Function

10. Question 10 of 30

    What is the primary security risk when using algorithms like MD5 or SHA1 for sensitive data hashing?

    • aThey are susceptible to collision attacks, where distinct inputs yield identical hash values.
    • bTheir fixed-size output is too small, making brute-force attacks trivial.
    • cThey are no longer supported by the Node.js crypto module.
    • dThey can be easily decrypted to recover the original sensitive data.
    Show the answer

    Answer: a · They are susceptible to collision attacks, where distinct inputs yield identical hash values.

    The card explicitly states that MD5 and SHA1 are vulnerable to 'collision attacks,' where two different inputs can produce the same hash, undermining their reliability. Hashing is a one-way process by design, so it cannot be reversed to retrieve original data, making option D incorrect for any hashing algorithm.

    Read the full bite: Hashing Data with Node.js's `crypto` Module

11. Question 11 of 30

    In a Node.js web server, what is the most critical reason to avoid `zlib`'s synchronous methods like `gzipSync()`?

    • aThey offer a significantly lower compression ratio compared to their asynchronous streaming counterparts.
    • bThey cannot handle large files efficiently, often leading to partial compression or data corruption.
    • cThey prevent the server from processing other client requests until the compression is complete.
    • dThey are less secure due to potential timing attacks on compressed data.
    Show the answer

    Answer: c · They prevent the server from processing other client requests until the compression is complete.

    The card explicitly warns that synchronous methods block the Node.js event loop, making the server unresponsive to other requests and severely degrading performance. The compression ratio is determined by the algorithm, not whether the method is synchronous or asynchronous.

    Read the full bite: Node's zlib Module: Trading CPU for Bandwidth

12. Question 12 of 30

    An Express application must verify that an email domain can accept mail before allowing signup. Which DNS method should it use?

    • adns.resolveMx because it directly queries nameservers for mail exchange records
    • bdns.lookupService because it maps the domain to its SMTP service endpoint
    • cdns.lookup because it returns the domain's IP address from the OS resolver
    • ddns.resolveTxt because it retrieves domain verification records required for email
    Show the answer

    Answer: a · dns.resolveMx because it directly queries nameservers for mail exchange records

    dns.resolveMx queries nameservers directly for MX records, which prove a domain is configured to receive mail, whereas dns.lookup only returns IP addresses via getaddrinfo and cannot verify mail configuration.

    Read the full bite: Node.js DNS: lookup vs. resolve

13. Question 13 of 30

    In which situation is it generally more appropriate to handle an error directly within an Express route handler rather than relying on global error middleware?

    • aA third-party API call returns an unhandled exception, causing a promise rejection.
    • bThe application encounters a critical uncaught error that could crash the Node.js process.
    • cA request for a specific resource (e.g., a user by ID) finds no matching entry.
    • dAn unexpected database connection failure occurs during a data retrieval operation.
    Show the answer

    Answer: c · A request for a specific resource (e.g., a user by ID) finds no matching entry.

    The card specifies that global error handlers are for unexpected or system-level errors. Expected, non-exceptional business logic failures, such as a 'user not found' scenario, are cleaner to handle directly within the route handler with a specific status code.

    Read the full bite: Express Error Middleware: Your App's Safety Net

14. Question 14 of 30

    A client sends an API request, but the network fails before receiving a response. Which action is safest to retry without unintended side effects?

    • aRetrying a DELETE request for a specific user, even if the user might already be gone.
    • bRetrying a PUT request to increment a numerical value on a resource.
    • cRetrying a POST request to create a new order, assuming the server will prevent duplicates.
    • dRetrying a PATCH request to partially update a resource's status.
    Show the answer

    Answer: a · Retrying a DELETE request for a specific user, even if the user might already be gone.

    B is correct because DELETE is an idempotent method; sending it multiple times has the same final effect on the server's state (the resource remains deleted). A is incorrect because POST is not inherently idempotent, and retrying it can create duplicate resources unless the server is specifically designed with an idempotency key. D is incorrect because while PUT is an idempotent method for *setting* a value, an "increment" operation is not idempotent as each retry would change the value further, similar to the "incrementing" example given for non-idempotent operations.

    Read the full bite: Idempotency in REST APIs: Safe to Retry?

15. Question 15 of 30

    What is a primary challenge when configuring API rate limiting for public services?

    • aStoring request counts efficiently across multiple server instances without an external database.
    • bEnsuring the rate limiting middleware does not introduce significant latency.
    • cAccurately identifying individual users when multiple users share an IP address.
    • dPreventing attackers from bypassing limits by rapidly changing their IP address.
    Show the answer

    Answer: c · Accurately identifying individual users when multiple users share an IP address.

    The card states that a 'main footgun' is misconfiguration that blocks legitimate users, 'especially those behind a shared network... that makes many users appear to come from a single IP address.' This directly describes the challenge of identifying individual users behind shared IPs. While storing counts across instances (A) is a consideration for scaling, the card notes it's solvable with external stores, and it's not highlighted as the 'main footgun' for blocking legitimate users.

    Read the full bite: API Rate Limiting: Protecting Your Express Endpoints

16. Question 16 of 30

    When designing a public API that needs to evolve without breaking existing clients, which HATEOAS characteristic is most crucial?

    • aIt provides built-in mechanisms for client authentication and authorization.
    • bIt enforces a consistent data structure across all API endpoints.
    • cIt significantly reduces the network overhead by minimizing response payload size.
    • dIt enables clients to dynamically discover available actions and adapt to server-side URL changes.
    Show the answer

    Answer: d · It enables clients to dynamically discover available actions and adapt to server-side URL changes.

    HATEOAS's primary benefit is decoupling clients from servers by providing links for next actions, allowing clients to adapt dynamically to changes in URL structures. It does not primarily enforce data structure consistency, reduce payload size (it can add bloat), or handle authentication.

    Read the full bite: HATEOAS: Let Your API Tell You What's Next

17. Question 17 of 30

    If an error occurs during an operation within a Sequelize managed transaction, what is the immediate outcome?

    • aOnly the specific operation that failed is undone, leaving prior changes intact.
    • bThe transaction commits all successful operations and logs the error for manual review.
    • cThe database attempts to fix the inconsistency by retrying the failed operation.
    • dSequelize automatically rolls back all changes made within that transaction.
    Show the answer

    Answer: d · Sequelize automatically rolls back all changes made within that transaction.

    The card states, "If any error is thrown inside the callback, Sequelize automatically rolls back all changes made within the transaction." This ensures the 'all-or-nothing' principle. Option B is incorrect because transactions prevent partial commits; if any part fails, the entire unit is undone.

    Read the full bite: Sequelize Transactions: All-or-Nothing Database Writes

18. Question 18 of 30

    For which scenario would MongoDB's $lookup aggregation stage generally be preferred over Mongoose's populate() method?

    • aWhen defining a one-to-many relationship using Schema.Types.ObjectId and a ref.
    • bWhen performing complex data analysis or generating large-scale reports.
    • cWhen the goal is to replace document IDs with full documents in the application memory.
    • dWhen fetching a primary document along with its direct, single-level dependencies.
    Show the answer

    Answer: b · When performing complex data analysis or generating large-scale reports.

    The card states to "Avoid populate() for complex reporting or large-scale data analysis where a native MongoDB aggregation pipeline using $lookup would be more performant by running on the database server." Options A, C, and D describe appropriate use cases or mechanisms for Mongoose's populate().

    Read the full bite: Mongoose Population: Linking Documents Across Collections

19. Question 19 of 30

    When a Sequelize model has a defaultScope and you apply another named scope, what happens to their where clauses?

    • aSequelize throws an error due to conflicting query conditions.
    • bBoth where clauses are merged using an AND operator.
    • cThe defaultScope's where clause is ignored, and only the named scope's is used.
    • dThe named scope's where clause completely replaces the defaultScope's.
    Show the answer

    Answer: b · Both where clauses are merged using an AND operator.

    The card explicitly states that when multiple scopes are applied, their 'where' and 'include' attributes are merged. The example demonstrates this by combining the 'active' from defaultScope and 'deleted' from a named scope with an AND operator.

    Read the full bite: Sequelize Scopes: Reusable Query Shortcuts

20. Question 20 of 30

    Why is OAuth 2.0 not suitable as a standalone protocol for user authentication?

    • aIt lacks robust cryptographic features essential for secure identity verification.
    • bIt only confirms the application's permission to access resources, not the user's identity or presence.
    • cIts primary security mechanisms are designed for server-to-server data transfer, not user login flows.
    • dIt inherently requires users to share their passwords directly with the client application.
    Show the answer

    Answer: b · It only confirms the application's permission to access resources, not the user's identity or presence.

    The card states that an access token "only proves the application has permission; it doesn't prove the user is currently present or who they are," making option B correct. Option D describes a deprecated and insecure grant type that OAuth 2.0 aims to prevent, not a general characteristic of the protocol.

    Read the full bite: OAuth 2.0: Delegated Authorization, Not Authentication

21. Question 21 of 30

    Which scenario best illustrates the appropriate use of Passport's generic OAuth2 strategy?

    • aCreating a new authentication method for a Node.js application that does not adhere to the OAuth 2.0 standard.
    • bConsolidating the configuration for several well-known OAuth 2.0 providers into a single, unified strategy.
    • cBuilding an authentication system for a custom-built internal enterprise application that uses OAuth 2.0.
    • dIntegrating with a popular social login provider like Google or GitHub to streamline development.
    Show the answer

    Answer: c · Building an authentication system for a custom-built internal enterprise application that uses OAuth 2.0.

    The generic strategy is intended for custom or niche OAuth 2.0 providers that lack a dedicated Passport strategy, such as internal enterprise systems. Using it for popular services like Google is a common misconception, as specific strategies exist for those and handle their unique requirements.

    Read the full bite: Passport.js: The Generic OAuth2 Strategy

22. Question 22 of 30

    Which scenario typically does not require CSRF protection?

    • aA user updating their profile via a POST request in a cookie-authenticated web application.
    • bAn API endpoint authenticated with a JWT in the Authorization header, used to modify user data.
    • cA form submission that changes a user's password in a traditional web application.
    • dA user deleting an item from their shopping cart using a DELETE request in a session-based application.
    Show the answer

    Answer: b · An API endpoint authenticated with a JWT in the Authorization header, used to modify user data.

    The card states that CSRF protection is generally not needed for APIs authenticated with tokens (like JWTs) sent in an Authorization header, because browsers do not automatically attach these headers to cross-site requests. The other options describe state-changing actions in cookie-authenticated contexts, which are vulnerable to CSRF.

    Read the full bite: CSRF Tokens: Preventing Unwanted State Changes on Your Behalf

23. Question 23 of 30

    When storing a JWT in a browser, which option provides the strongest defense against Cross-Site Scripting (XSS) attacks?

    • aUsing local storage combined with a strict Content Security Policy (CSP).
    • bUtilizing an HttpOnly cookie, making the token inaccessible to client-side scripts.
    • cStoring the token in session storage, which automatically clears upon tab closure.
    • dEmploying a standard cookie without the HttpOnly flag, relying on browser's automatic transmission.
    Show the answer

    Answer: b · Utilizing an HttpOnly cookie, making the token inaccessible to client-side scripts.

    The HttpOnly flag prevents client-side JavaScript from accessing the cookie, thereby neutralizing XSS-based token theft. Although a strict Content Security Policy (CSP) can reduce XSS risk with local storage, it's not a complete guarantee and the token remains readable by malicious scripts if an XSS vulnerability is exploited.

    Read the full bite: JWT Storage: Cookies (CSRF Risk) vs. Local Storage (XSS Risk)

24. Question 24 of 30

    Which scenario best describes the intended use of Node.js's process.on('uncaughtException') handler?

    • aTo replace multiple try...catch blocks throughout the codebase with a single, centralized error handling mechanism.
    • bTo execute asynchronous operations like sending detailed error reports to a remote server or performing complex data rollbacks.
    • cTo perform synchronous cleanup tasks and log diagnostic information before the application process exits.
    • dTo gracefully recover from any unhandled error and allow the application to continue processing requests.
    Show the answer

    Answer: c · To perform synchronous cleanup tasks and log diagnostic information before the application process exits.

    The card emphasizes that the 'uncaughtException' handler is for synchronous, last-resort cleanup before the process terminates, not for resuming application flow. Attempting to continue after such an error is dangerous due to a corrupted application state, making option C the correct choice and option D a common misconception.

    Read the full bite: Node.js Uncaught Exceptions: Clean Up, Don't Continue

25. Question 25 of 30

    Which characteristic is the primary reason for advocating a limited and strategic use of End-to-End (E2E) tests?

    • aTheir execution is slow, they can be brittle, and debugging failures is complex.
    • bThey are most effective at catching bugs in individual UI components.
    • cThey cannot accurately simulate real user interactions across multiple services.
    • dThey are designed to test only isolated backend API endpoints.
    Show the answer

    Answer: a · Their execution is slow, they can be brittle, and debugging failures is complex.

    The card explicitly states that E2E tests are slow to run, can be flaky, and are difficult to debug, making them unsuitable for widespread use. While E2E tests involve the UI, their main purpose is to verify the entire integrated system, not individual UI components.

    Read the full bite: E2E Testing: The Final Check, Not The Whole Strategy

26. Question 26 of 30

    How does Nock achieve isolation from external HTTP services during testing?

    • aIt creates a local server that mimics the external service's API.
    • bIt caches previous responses from the external service to reuse them.
    • cIt prevents network requests from being made by blocking all HTTP traffic.
    • dIt intercepts outgoing HTTP requests by patching Node.js's native modules.
    Show the answer

    Answer: d · It intercepts outgoing HTTP requests by patching Node.js's native modules.

    Nock works by patching Node.js's native http and https modules, allowing it to intercept outgoing requests before they reach the network and return a predefined mock response. Option A describes a different mocking strategy, not Nock's core mechanism.

    Read the full bite: Nock: Intercept and Mock Node.js HTTP Requests

27. Question 27 of 30

    A developer uses SharedArrayBuffer for high-performance parallel processing but omits Atomics operations. What is the most likely outcome?

    • aThe SharedArrayBuffer will fail to initialize, preventing any data sharing.
    • bThe application will experience race conditions, leading to corrupted or unpredictable data.
    • cData will be automatically copied between workers, negating performance benefits.
    • dThe browser will automatically fall back to standard message passing for communication.
    Show the answer

    Answer: b · The application will experience race conditions, leading to corrupted or unpredictable data.

    The card explicitly states that 'without Atomics to coordinate, you'll get race conditions and corrupted data.' Atomics are crucial for ensuring atomic operations on shared memory, preventing concurrent access issues. SharedArrayBuffer itself does not fail to initialize or revert to copying data.

    Read the full bite: SharedArrayBuffer: True Shared Memory for JS Threads

28. Question 28 of 30

    What is a direct implication of V8's "stop-the-world" garbage collection strategy?

    • aIt can lead to temporary application freezes while memory cleanup occurs.
    • bIt guarantees that JavaScript execution remains uninterrupted for maximum throughput.
    • cIt enables precise control over when memory is reclaimed, preventing memory leaks.
    • dIt allows for manual memory management by developers to optimize performance.
    Show the answer

    Answer: a · It can lead to temporary application freezes while memory cleanup occurs.

    The card states that "stop-the-world" means the engine "pauses the entire application" to perform cleanup, and that "its pauses can impact performance." This directly implies temporary freezes. Option B is incorrect because "stop-the-world" means execution is interrupted, not continuous.

    Read the full bite: V8's Garbage Collector: A Performance Pillar

29. Question 29 of 30

    What is the primary architectural advantage of using Socket.IO namespaces?

    • aThey offer a more efficient way to broadcast messages to specific user groups than rooms.
    • bThey establish entirely separate WebSocket connections for each isolated channel.
    • cThey simplify client-side event listener organization for improved code structure.
    • dThey enable applying separate authentication and middleware logic to distinct application sections.
    Show the answer

    Answer: d · They enable applying separate authentication and middleware logic to distinct application sections.

    Namespaces provide broad architectural separation, allowing distinct middleware and authentication for different application areas (like /admin) over a single connection. Option B is incorrect because namespaces explicitly operate over a single WebSocket connection, not multiple ones, to improve efficiency.

    Read the full bite: Socket.IO Namespaces: Channels on One Connection

30. Question 30 of 30

    Under which scenario is a Socket.IO adapter most crucial for a production application?

    • aTo manage persistent user sessions and authentication across different client devices.
    • bTo enable automatic reconnection and state recovery for clients after a network interruption.
    • cTo provide real-time data synchronization for a single-server application.
    • dTo ensure broadcast messages reach clients connected to any server in a multi-instance setup.
    Show the answer

    Answer: d · To ensure broadcast messages reach clients connected to any server in a multi-instance setup.

    The card states that an adapter is essential "any time you run your Socket.IO application on more than one process or server" to prevent broadcasts from failing across instances. Option B is a tempting distractor because the card explicitly mentions that the standard Redis adapter *does not* support connection state recovery, making it an incorrect function for this specific adapter.

    Read the full bite: Socket.IO Adapters: Scaling Beyond One Server