Top 30 Intermediate Node.js & Express Concepts Quiz

30 questions. Pick an answer, or open “Show the answer” to read it.

Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.

1. Question 1 of 30

   What is the primary consequence of running a long-running synchronous task in a Node.js application?

   • aThe application's event loop will become blocked, making the server unresponsive.
   • bNode.js will prioritize other I/O operations, delaying the synchronous task's execution.
   • cThe task will be automatically moved to a background thread, preventing blocking.
   • dThe task will cause a memory overflow due to its single-threaded nature.
   Show the answer

   Answer: a · The application's event loop will become blocked, making the server unresponsive.

   The card states that a long-running synchronous computation will 'monopolize the single main thread, blocking the event loop entirely,' leading to an unresponsive application. Synchronous tasks are not automatically offloaded to background threads; they execute directly on the main thread, unlike asynchronous I/O operations.

   Read the full bite: The Node.js Event Loop: Concurrency on a Single Thread

2. Question 2 of 30

   A Node.js API stops responding to every request whenever a user logs in, because the login handler calls crypto.pbkdf2Sync to verify a password. What is the most likely cause?

   • apbkdf2Sync opens a new database connection for every call
   • bThe synchronous call runs on the single main thread and blocks the event loop until it finishes
   • cThe libuv threadpool size is set to zero by default
   • dSynchronous crypto functions are deprecated and throw silently
   Show the answer

   Answer: b · The synchronous call runs on the single main thread and blocks the event loop until it finishes

   pbkdf2Sync executes directly on the same thread that runs the event loop, so nothing else can be processed until it returns; the threadpool default is four, not zero, and the block has nothing to do with database connections.

   Read the full bite: Event Loop vs Crypto Module

3. Question 3 of 30

   What is the primary benefit of splitting a CPU-intensive synchronous operation into smaller pieces using setTimeout(fn, 0)?

   • aTo ensure the entire operation completes faster by leveraging asynchronous execution.
   • bTo allow the browser to process UI updates and user input between task segments.
   • cTo execute each piece of the task in parallel, improving overall performance.
   • dTo guarantee that each piece runs immediately after the previous one, without any delay.
   Show the answer

   Answer: b · To allow the browser to process UI updates and user input between task segments.

   The card states that splitting work with setTimeout(fn, 0) allows yielding control back to the event loop, enabling the browser to process user input and render updates, keeping the UI alive. Option A is incorrect because this technique adds overhead and does not necessarily speed up the overall execution time; its purpose is responsiveness, not raw speed.

   Read the full bite: JavaScript's Event Loop: Macrotasks & Microtasks

4. Question 4 of 30

   Which statement accurately describes how process.nextTick() callbacks are prioritized within the Node.js event loop?

   • aThey execute after all setTimeout(fn, 0) callbacks but before I/O operations.
   • bThey execute immediately after the current JavaScript operation, before any timers or I/O.
   • cThey are queued to run in the next full iteration of the event loop, after all other phases.
   • dThey are processed concurrently with microtasks (like Promises) in the same phase.
   Show the answer

   Answer: b · They execute immediately after the current JavaScript operation, before any timers or I/O.

   process.nextTick() callbacks are processed with the highest precedence, immediately after the current JavaScript operation completes and before the event loop proceeds to microtasks, timers, or I/O. Option D is incorrect because nextTick callbacks are processed *before* the microtask queue.

   Read the full bite: process.nextTick(): Cutting in Line on the Event Loop

5. Question 5 of 30

   What is the fundamental problem Node.js streams are designed to solve for data handling?

   • aProcessing large datasets without exhausting system memory.
   • bEnsuring data integrity during network transmission.
   • cProviding random access to data within large files.
   • dReducing the complexity of asynchronous I/O operations.
   Show the answer

   Answer: a · Processing large datasets without exhausting system memory.

   The card states streams were created to 'process data piece by piece, keeping memory usage low and constant regardless of the total data size' because loading large files entirely into memory is inefficient or impossible. While streams can simplify I/O (option D), their core purpose is memory efficiency for large data, and they are not ideal for random access (option C).

   Read the full bite: Node.js Streams: Processing Data in Chunks, Not Blobs

6. Question 6 of 30

   What is the primary advantage of using asynchronous child processes in Node.js?

   • aTo simplify the debugging of complex multi-threaded applications.
   • bTo allow multiple Node.js scripts to share memory efficiently.
   • cTo enhance the performance of I/O-bound operations.
   • dTo execute CPU-bound tasks without blocking the main event loop.
   Show the answer

   Answer: d · To execute CPU-bound tasks without blocking the main event loop.

   The card explicitly states that child processes solve the problem of CPU-intensive operations blocking the single-threaded event loop by offloading heavy work. Option B describes the purpose of worker_threads, not child processes.

   Read the full bite: Node.js Child Processes: Escaping the Main Thread

7. Question 7 of 30

   Which of the following is a significant change when migrating a Node.js project from CommonJS to ES Modules?

   • aFile extensions are no longer necessary for relative module imports.
   • bThe ability to use require() for importing third-party packages remains unchanged.
   • cModule dependencies are statically analyzed before code execution.
   • dGlobal variables like __dirname and __filename are directly available for path resolution.
   Show the answer

   Answer: c · Module dependencies are statically analyzed before code execution.

   The card states that ES Modules are a 'statically analyzable contract' where dependencies are mapped out before execution, a major shift from CommonJS's dynamic require(). Options A, B, and C are incorrect because ESM explicitly removes direct access to require(), __dirname, and __filename, and makes file extensions mandatory for relative imports.

   Read the full bite: ES Modules in Node.js: The Modern `import` System

8. Question 8 of 30

   When resolving a package, which source does npx check first before falling back to its cache or the network?

   • aThe local project's node_modules/.bin directory
   • bA globally installed copy via npm install -g
   • cThe npm registry for the latest matching version
   • dThe central package cache on your machine
   Show the answer

   Answer: a · The local project's node_modules/.bin directory

   npx prioritizes a local project binary to avoid unnecessary network requests, checking node_modules/.bin before its own cache or the registry. Option D is tempting because caching is a core feature, but local copies take precedence.

   Read the full bite: npx: Execute Packages Without Installing Them

9. Question 9 of 30

   When using a .env file for local development, what is the most critical step to prevent accidental exposure of sensitive information?

   • aRegularly updating the values in the .env file to new, unique keys
   • bEncrypting the .env file with a strong password before use
   • cEnsuring the .env file is listed in your project's .gitignore
   • dStoring only non-sensitive configuration in the .env file
   Show the answer

   Answer: c · Ensuring the .env file is listed in your project's .gitignore

   The card explicitly states that 'The biggest mistake is committing your .env file to Git, exposing all your secrets' and that your '.gitignore file must contain a line with .env to prevent committing secrets.' This makes preventing version control exposure the most critical step. Storing only non-sensitive data (D) contradicts the primary purpose of .env for secrets.

   Read the full bite: Environment Variables: Config Outside Your Code

10. Question 10 of 30

    What is the primary characteristic that distinguishes the Service Layer from the Web Layer?

    • aIt handles all direct database interactions and data persistence.
    • bIt defines application routes and manages the request/response cycle.
    • cIt is responsible for validating incoming user input and sanitizing data.
    • dIt contains the core business logic, independent of HTTP specifics.
    Show the answer

    Answer: d · It contains the core business logic, independent of HTTP specifics.

    The card explicitly states the Service Layer "contains the core business logic, orchestrating tasks without knowing about HTTP," highlighting its independence from the web protocol. Option B describes the primary function of the Web Layer, which is concerned with HTTP requests and responses.

    Read the full bite: Structuring Express Apps with Layered Architecture

11. Question 11 of 30

    What is the fundamental mechanism by which Promise.then() enables sequential asynchronous operations?

    • aEach call to .then() returns a new promise, whose resolution depends on the preceding handler's outcome.
    • bIt attaches multiple handlers to the original promise, which then execute in a defined order.
    • cIt directly executes the next handler function only after the previous one finishes.
    • dIt gathers all promises in a chain and resolves them concurrently once all are ready.
    Show the answer

    Answer: a · Each call to .then() returns a new promise, whose resolution depends on the preceding handler's outcome.

    The core mechanism for chaining is that every .then() call creates and returns a new promise, allowing the next step in the sequence to wait for the previous one's resolution. Option C describes the outcome but not the underlying mechanism of how this sequential execution is achieved. Option B describes a common misconception where multiple handlers attached to the *same* promise execute in parallel, not sequentially.

    Read the full bite: Promise.then(): Each Call Returns a New Promise

12. Question 12 of 30

    What is the primary risk of placing a .catch() block in the middle of a promise chain without implementing a specific recovery strategy?

    • aIt makes the entire promise chain synchronous, negating the performance benefits of asynchronous operations.
    • bIt can lead to subsequent .then() blocks executing with potentially invalid or missing data, as if the error never occurred.
    • cIt prevents any further .catch() blocks from being able to handle errors later in the chain.
    • dIt will automatically re-throw the error, forcing all subsequent .then() blocks to be skipped.
    Show the answer

    Answer: b · It can lead to subsequent .then() blocks executing with potentially invalid or missing data, as if the error never occurred.

    The card states that if a .catch() block mid-chain only logs an error without recovery, the promise it returns will be fulfilled, causing subsequent .then() blocks to execute as if successful, potentially leading to 'confusing bugs' with 'missing data'. Option D is incorrect because .catch() resolves by default unless an error is explicitly re-thrown.

    Read the full bite: Promise .catch(): Handling Rejections

13. Question 13 of 30

    What is a significant limitation of util.promisify when used with callback-based functions?

    • aIt only resolves with the first successful value if the callback provides multiple.
    • bIt requires the callback to be the first argument of the original function.
    • cIt cannot be used with functions that perform I/O operations.
    • dIt fails if the original function's callback does not explicitly handle errors.
    Show the answer

    Answer: a · It only resolves with the first successful value if the callback provides multiple.

    The card states that "If a callback provides multiple success values, like (err, val1, val2), promisify will only resolve with val1." Option D is incorrect because util.promisify provides its own internal callback to check for errors, not relying on the original function's error handling implementation.

    Read the full bite: Node.js util.promisify: From Callbacks to Promises

14. Question 14 of 30

    When an await keyword is encountered inside an async function, what is its primary effect?

    • aIt forces the awaited operation to run synchronously, blocking all subsequent code in the function.
    • bIt immediately returns a new Promise from the async function, continuing the awaited operation in parallel.
    • cIt causes the entire JavaScript application to pause until the awaited Promise resolves.
    • dIt pauses the execution of the async function, allowing other tasks to run, and resumes when the Promise settles.
    Show the answer

    Answer: d · It pauses the execution of the async function, allowing other tasks to run, and resumes when the Promise settles.

    The card explains that await acts as a 'pause and resume' button for the async function, allowing the JavaScript engine to do other work while the Promise settles, thus ensuring non-blocking behavior. Option C describes a blocking scenario, which async/await is designed to prevent.

    Read the full bite: Async/Await: Write Non-Blocking Code That Reads Synchronously

15. Question 15 of 30

    What is the immediate outcome when one of the promises provided to Promise.all() rejects?

    • aThe Promise.all() promise waits for all other promises to settle before rejecting with an array of all outcomes.
    • bThe Promise.all() promise attempts to retry the rejected promise before determining its final state.
    • cThe Promise.all() promise immediately rejects with the reason of the first failed promise.
    • dThe Promise.all() promise resolves with the values of the successfully completed promises, ignoring the rejected one.
    Show the answer

    Answer: c · The Promise.all() promise immediately rejects with the reason of the first failed promise.

    Promise.all() has a 'fail-fast' behavior: if any single input promise rejects, the entire Promise.all() promise immediately rejects with the reason of that first failed promise. Option A describes the behavior of Promise.allSettled(), which waits for all promises to settle regardless of their outcome.

    Read the full bite: Promise.all(): Wait for Multiple Promises at Once

16. Question 16 of 30

    Which scenario best describes the appropriate use case for path.join()?

    • aWhen you need to obtain a guaranteed absolute path to a resource, independent of the current working directory.
    • bWhen the goal is to simplify a complex path string by removing all '..' and '.' segments, resulting in the shortest possible absolute path.
    • cWhen you need to process a series of path segments, where an absolute segment should override all preceding segments.
    • dWhen you are combining path segments to build a path relative to a known base directory, such as a module's location.
    Show the answer

    Answer: d · When you are combining path segments to build a path relative to a known base directory, such as a module's location.

    path.join() is designed for constructing paths relative to a base directory you control, by concatenating segments and handling normalization. Option A and C describe the primary use cases and processing behavior of path.resolve().

    Read the full bite: path.join() vs. path.resolve(): Concatenation vs. Calculation

17. Question 17 of 30

    What is the main reason to use the WHATWG URL API instead of manual string manipulation for handling URLs?

    • aIt encrypts sensitive URL parameters for secure transmission over the network.
    • bIt provides a structured object to safely parse, access, and modify URL components.
    • cIt optimizes URL strings by shortening them for improved network performance.
    • dIt automatically validates the existence and accessibility of the URL resource.
    Show the answer

    Answer: b · It provides a structured object to safely parse, access, and modify URL components.

    The WHATWG URL API's primary benefit is converting a raw URL string into a structured object, allowing safe and predictable access and modification of its components, thereby preventing common parsing errors and security vulnerabilities. It does not validate resource existence, encrypt data, or shorten URLs for performance.

    Read the full bite: WHATWG URL API: Safely Parse URLs, Not Strings

18. Question 18 of 30

    What is the consequence if an Express middleware function neither calls next() nor sends a response?

    • aThe client's request will hang indefinitely, awaiting a response.
    • bThe server terminates the connection with an internal server error.
    • cThe application automatically proceeds to the next middleware in the sequence.
    • dThe request is silently discarded, and the client receives no feedback.
    Show the answer

    Answer: a · The client's request will hang indefinitely, awaiting a response.

    The card states, "If a middleware does neither, the request hangs." This means the client will wait indefinitely for a response. Calling next() is explicitly required for the request to proceed to the next function in the chain, making option C incorrect.

    Read the full bite: Express Middleware: The Chain of Command for Requests

19. Question 19 of 30

    For which scenario is express.Router most beneficial in an Express application?

    • aDefining routes that respond to different HTTP verbs (GET, POST, PUT) on the same URL path.
    • bApplying a single authentication middleware to every incoming request.
    • cStructuring an application with numerous routes into modular, maintainable files.
    • dCreating a separate, entirely independent web server process.
    Show the answer

    Answer: c · Structuring an application with numerous routes into modular, maintainable files.

    express.Router is designed to solve the scaling problem of growing applications by allowing developers to break routes into modular files, making the application more organized and maintainable. While routers can apply middleware, their primary benefit isn't solely for a single global middleware, which can be handled by app.use() directly.

    Read the full bite: express.Router: Group Routes into Modular Files

20. Question 20 of 30

    Which scenario would make express-generator the LEAST suitable tool for initiating an Express project?

    • aDeveloping a new web application that uses server-side rendering.
    • bRapidly prototyping an application requiring a complete file layout.
    • cCreating a simple API server that primarily returns JSON responses.
    • dSetting up a project to learn the conventional Express file structure.
    Show the answer

    Answer: c · Creating a simple API server that primarily returns JSON responses.

    The card explicitly states not to use express-generator for 'a minimal API server that doesn't require a view engine or a complex file structure,' which aligns with creating a simple API returning JSON. The other options describe scenarios where the tool is highly recommended.

    Read the full bite: Scaffold an Express App with `express-generator`

21. Question 21 of 30

    When a browser-based frontend on "app.com" fetches data from an Express API on "api.com", what is the `cors` middleware's primary function?

    • aTo encrypt the data payload of cross-origin requests, ensuring secure transmission between "app.com" and "api.com".
    • bTo add a specific header to the API's response, signaling to the browser that "app.com" can access the data.
    • cTo prevent the API from receiving requests originating from "app.com" unless explicitly allowed.
    • dTo automatically rewrite the request's origin to match the API's domain, bypassing the Same-Origin Policy.
    Show the answer

    Answer: b · To add a specific header to the API's response, signaling to the browser that "app.com" can access the data.

    The `cors` middleware's primary role is to add the `Access-Control-Allow-Origin` header to the API response, which acts as a permission slip for the browser to allow the frontend script to access the data. It does not block requests; the browser's Same-Origin Policy is what prevents access if the header is missing.

    Read the full bite: CORS Middleware: Unlocking Cross-Origin Requests in Express

22. Question 22 of 30

    Which scenario is most likely to cause a functional issue immediately after adding app.use(helmet()) to an Express app without further configuration?

    • aThe application implements custom authentication logic.
    • bThe application is running in a local development environment without HTTPS.
    • cThe application handles sensitive user data.
    • dThe application loads scripts or styles from external domains like CDNs.
    Show the answer

    Answer: d · The application loads scripts or styles from external domains like CDNs.

    The default Content-Security-Policy (CSP) in Helmet is very strict, only allowing resources from the same origin ('self'). This will block common external resources like scripts from CDNs or Google Fonts, causing functional issues until the CSP is explicitly configured. While running without HTTPS can cause issues with 'upgrade-insecure-requests', the card highlights CSP configuration for external resources as the primary and most common 'footgun'.

    Read the full bite: Helmet.js: Secure Express Apps with HTTP Headers

23. Question 23 of 30

    Which logging task is NOT a primary use case for Morgan in an Express application?

    • aFiltering and logging only HTTP requests that result in error status codes.
    • bGenerating standard access logs for successful API calls in production.
    • cTracking internal application events like database connection failures.
    • dRecording details of every incoming HTTP request for debugging.
    Show the answer

    Answer: c · Tracking internal application events like database connection failures.

    Morgan is purpose-built for logging HTTP requests and responses, providing visibility into traffic patterns. It is explicitly stated that Morgan is not a general-purpose application logger and should not be used for internal application events like database errors, which require dedicated logging libraries.

    Read the full bite: Morgan: One-Line Request Logging for Express

24. Question 24 of 30

    When cookie-parser with a secret detects a tampered signed cookie, what happens?

    • aAn unhandled exception is thrown, stopping further middleware execution.
    • bThe tampered cookie is entirely omitted from both req.cookies and req.signedCookies.
    • cThe request is automatically terminated with a 403 Forbidden error.
    • dThe cookie's value is set to false within the req.signedCookies object.
    Show the answer

    Answer: d · The cookie's value is set to false within the req.signedCookies object.

    The card explicitly states that a cookie failing signature validation will have its value set to false in req.signedCookies. This allows the application to detect tampering and decide how to proceed, rather than cookie-parser automatically rejecting the request or throwing an error.

    Read the full bite: cookie-parser: From Header String to Usable Object

25. Question 25 of 30

    In Mongoose, which component is primarily used to perform database operations like creating, querying, or updating documents?

    • aThe Model, which is compiled from a Schema and provides an interface to the database.
    • bThe native MongoDB driver directly, as Mongoose only adds validation.
    • cThe Schema, which defines the document structure and validation rules.
    • dA document instance created from the Schema, before it is saved.
    Show the answer

    Answer: a · The Model, which is compiled from a Schema and provides an interface to the database.

    The Model is described as the 'active factory' and 'primary tool' for interacting with the database to create, query, update, and delete documents. The Schema, conversely, is a 'passive object' that only defines the structure, not the operations.

    Read the full bite: Mongoose: Schemas are Blueprints, Models are Factories

26. Question 26 of 30

    Which change to an API would most likely necessitate creating a new version?

    • aOptimizing the database query for an existing endpoint to improve speed.
    • bAdding a new, optional field to an existing response payload.
    • cIntroducing a completely new endpoint to handle a new business process.
    • dSplitting a single 'address' field into 'street', 'city', and 'zipCode' fields.
    Show the answer

    Answer: d · Splitting a single 'address' field into 'street', 'city', and 'zipCode' fields.

    The card states that 'breaking changes' alter data structures or endpoint behavior, citing splitting a 'fullName' field as an example. Splitting an 'address' field is analogous, requiring clients to adapt to new fields. Adding optional fields or new endpoints are non-breaking changes, and performance optimizations do not alter the API contract.

    Read the full bite: API Versioning: Managing Change Without Breaking Clients

27. Question 27 of 30

    What is the primary benefit of including hypermedia links (next, prev) in a paginated API response?

    • aIt reduces the client's need to construct pagination URLs, simplifying navigation logic.
    • bIt allows the server to dynamically adjust the page size based on client demand.
    • cIt prevents server overload by offloading pagination logic to the client.
    • dIt ensures data consistency even when the dataset is rapidly changing.
    Show the answer

    Answer: a · It reduces the client's need to construct pagination URLs, simplifying navigation logic.

    The card explicitly states that hypermedia links allow the client to navigate without having to construct pagination URLs itself, keeping the logic on the server, which simplifies client-side navigation. Option D is incorrect because hypermedia links do not address data consistency issues in rapidly changing datasets; that's a separate challenge for simple pagination.

    Read the full bite: API Pagination: Serving Big Datasets in Chunks

28. Question 28 of 30

    When defining a relationship where a `Post` belongs to a `User` using `Post.belongsTo(User)`, where does Sequelize place the foreign key?

    • aOn the Post table, named userId.
    • bOn the User table, named postId.
    • cOn both the Post and User tables.
    • dOn a separate junction table.
    Show the answer

    Answer: a · On the Post table, named userId.

    The card states that for `A.belongsTo(A)`, the foreign key is placed on the source model, A. In this case, `Post` is the source model, so the `Post` table will receive the `userId` foreign key. A junction table is only used for many-to-many relationships.

    Read the full bite: Sequelize Associations: Who Holds the Foreign Key?

29. Question 29 of 30

    Which scenario best illustrates an appropriate use of Mongoose middleware?

    • aApplying unique business logic to a document based on a specific user's role in a single API call.
    • bEnsuring a user's password is consistently hashed before being stored in the database.
    • cBypassing Mongoose's built-in validation for performance optimization during bulk inserts.
    • dDirectly accessing and modifying a document's properties within a findOneAndUpdate query hook.
    Show the answer

    Answer: b · Ensuring a user's password is consistently hashed before being stored in the database.

    The card explicitly states that hashing passwords before saving a user document is a canonical use case for middleware, as it ensures this critical step always occurs. Option D is incorrect because the card warns that in query middleware like findOneAndUpdate, 'this' refers to the query object, not the document, making direct document field access problematic.

    Read the full bite: Mongoose Middleware (Hooks): Intercepting Database Operations

30. Question 30 of 30

    Which statement correctly distinguishes Mongoose validation from the 'unique' schema option?

    • aMongoose validation ensures data types are correct, while the unique option prevents duplicate entries at the Mongoose schema level.
    • bMongoose validation provides application-level data integrity checks, whereas the unique option configures a database index.
    • cMongoose validation runs automatically on findOneAndUpdate(), while the unique option only applies to save() calls.
    • dBoth Mongoose validation and the unique option are part of the pre('save') hook middleware.
    Show the answer

    Answer: b · Mongoose validation provides application-level data integrity checks, whereas the unique option configures a database index.

    Mongoose validation is described as an application-layer guard for data integrity, while the unique option is explicitly stated to be a helper for building a database index, not a Mongoose validation rule. The unique option's enforcement happens at the database level, not as part of Mongoose's validation middleware.

    Read the full bite: Mongoose Validation: Your Schema's Built-in Guard