Top 30 Easy Node.js & Express Interview Questions and Answers for Freshers

Question 1

Which statement best describes how Node.js handles I/O for thousands of concurrent connections?

Accepted Answer

Network sockets are watched by the OS, while blocking tasks like DNS and file reads use a small internal thread pool.

Answer

It spawns a new OS thread for every incoming connection to process requests in parallel.

Answer

All I/O operations, including file reads and DNS lookups, are handled directly by the event loop without blocking.

Answer

The event loop busy-waits in a while loop, polling each file descriptor until data is available.

Question 2

Why is it a problem to list a library your source code imports at runtime under devDependencies?

Accepted Answer

A production install that skips devDependencies leaves it missing, causing runtime errors

Answer

devDependencies are always installed, so it makes no difference

Answer

npm will refuse to install the package at all

Answer

It forces the package to be loaded twice

Question 3

What does Node do first when it encounters require('fs')?

Accepted Answer

Matches it against built-in core modules, which take precedence

Answer

Downloads it from the npm registry on demand

Answer

Treats it as a relative path from the current file

Answer

Searches node_modules directories upward for an fs package

Question 4

Which statement about a Promise's state transitions is correct?

Accepted Answer

Once settled as fulfilled or rejected, the state is permanent and cannot change

Answer

A rejected Promise can later return to pending if retried

Answer

then callbacks execute synchronously the instant resolve is called

Answer

A Promise can be both fulfilled and rejected to cover all cases

Question 5

Why is calling fs.readFileSync inside an Express request handler a problem under concurrent load?

Accepted Answer

It blocks the single event loop thread, stalling all other pending requests

Answer

It spawns a new thread per request, exhausting the thread pool

Answer

It silently returns stale cached data from previous reads

Answer

It throws an error because sync calls are forbidden in handlers

Question 6

What does path.join provide that naive string concatenation of path segments does not?

Accepted Answer

Platform-correct separators plus normalization of redundant slashes and segments

Answer

Faster disk reads by caching the joined path

Answer

Guaranteed protection against all directory traversal attacks

Answer

Automatic encryption of the resulting file path

Question 7

In a bare http module server, what is the consequence of never calling res.end inside the request listener?

Accepted Answer

The client connection hangs because the response is never finalized

Answer

Node automatically sends an empty 200 after a timeout

Answer

The request is silently retried by the http module

Answer

The server crashes with an unhandled exception

Question 8

In a minimal Express app, what does omitting the app.listen call result in?

Accepted Answer

The server never binds to a port, so no requests are served

Answer

Express throws an error at startup demanding a port

Answer

Routes respond but on a random default port

Answer

The app serves only the root route and ignores others

Question 9

Why is express.static(path.join(__dirname, 'public')) preferred over express.static('public')?

Accepted Answer

A bare relative path resolves against the variable working directory and can break

Answer

Only the absolute form enables HTTP caching headers

Answer

The absolute form serves files faster from disk

Answer

The relative form exposes the public folder to directory traversal

Question 10

For the route app.get('/users/:id') hit by /users/42?active=true, which is correct?

Accepted Answer

req.params.id is '42' and req.query.active is 'true'

Answer

Both id and active come from req.params

Answer

req.query.id is '42' and req.params.active is 'true'

Answer

Both id and active come from req.query

Question 11

In an Express middleware, what is the consequence of neither sending a response nor calling next?

Accepted Answer

The request hangs indefinitely because nothing advances or ends it

Answer

Express automatically calls next after a short delay

Answer

Express throws a synchronous error immediately

Answer

The next route handler runs anyway

Question 12

A teammate posts JSON to your endpoint but req.body is undefined. The route is defined and the client sets Content-Type correctly. What is the most likely cause?

Accepted Answer

express.json() was registered after the route definition

Answer

JSON bodies require express.urlencoded() instead

Answer

Express cannot parse JSON without the body-parser package

Answer

req.body only works for GET requests

Question 13

Your logging middleware prints correctly but every request to the server eventually times out with no response. What did the middleware most likely fail to do?

Accepted Answer

Call next() to pass control to the next handler

Answer

Import the console module

Answer

Return a Promise from the function

Answer

Set a Content-Type header

Question 14

Which combination correctly follows REST conventions for creating a new user?

Accepted Answer

POST /users, read fields from req.body, respond 201

Answer

GET /createUser?name=Ada, read req.query, respond 200

Answer

PUT /user, read req.body, respond 200

Answer

POST /users/create, read req.params, respond 204

Question 15

For GET /products/42?sort=price, where do the id 42 and the sort value come from respectively?

Accepted Answer

req.params.id and req.query.sort

Answer

req.params.id and req.body.sort

Answer

req.body.id and req.query.sort

Answer

req.query.id and req.params.sort

Question 16

An API returns 200 OK for every successful response, including resource creation. What semantic information is being lost?

Accepted Answer

That a new resource was created, which 201 (with a Location header) signals

Answer

That the response is cacheable

Answer

That the request was authenticated

Answer

That the body is JSON

Question 17

After defining productSchema, which line gives you the constructor used to create and query Product documents?

Accepted Answer

mongoose.model('Product', productSchema)

Answer

productSchema.compile('Product')

Answer

mongoose.connect('Product')

Answer

new mongoose.Schema(productSchema)

Question 18

A user logs in successfully, then requests an admin-only endpoint and is rejected. Which HTTP status best fits, and why?

Accepted Answer

403 Forbidden, because they are authenticated but lack permission

Answer

404 Not Found, to hide the endpoint

Answer

400 Bad Request, because the role is missing

Answer

401 Unauthorized, because their token is invalid

Question 19

An attacker decodes a JWT, edits the role claim to admin, and re-encodes it without the secret. What happens at verification?

Accepted Answer

Verification fails because the signature no longer matches the altered payload

Answer

It is accepted because the payload is valid base64url

Answer

It is accepted until the token expires

Answer

The server cannot read the payload since it is encrypted

Question 20

Your POST /login handler reads req.body but it is always undefined. What is the most likely cause?

Accepted Answer

The express.json body-parsing middleware is not mounted

Answer

You forgot to await req.body

Answer

Express does not support req.body for login routes

Answer

The route uses GET instead of POST internally

Question 21

You write a test that sends an HTTP request to a route handler which queries a real test database. Which category is this?

Accepted Answer

An integration test, because it exercises the route and database together

Answer

A unit test, because it targets one route

Answer

An end-to-end test, because it uses HTTP

Answer

A smoke test, because it touches the database

Question 22

Your Jest test compares the function's returned object using expect(result).toBe(expectedObject) and it fails despite identical contents. Why?

Accepted Answer

toBe checks reference identity, so use toEqual for deep object comparison

Answer

Jest cannot compare objects at all

Answer

The test needs an await before expect

Answer

toBe is not a valid Jest matcher

Question 23

A reviewer says adding Helmet makes the Express app secure. What is the most accurate correction?

Accepted Answer

Helmet sets protective HTTP headers as one defense layer but does not fix application logic or validate input

Answer

Helmet validates and sanitizes all incoming user input

Answer

Helmet replaces the need for HTTPS

Answer

Helmet primarily configures CORS policies

Question 24

In an EJS template, which choice most directly prevents stored XSS when displaying a user-submitted comment?

Accepted Answer

Use the escaping interpolation <%= comment %> so HTML is encoded as text

Answer

Store the comment in a separate database table

Answer

Use the raw output tag <%- comment %> for fidelity

Answer

Validate the comment length before saving it

Question 25

What is the core advantage of streaming a large file to a client instead of reading it fully into memory first?

Accepted Answer

Memory stays bounded and bytes can start flowing before the whole file is read

Answer

Streaming removes the need to handle errors

Answer

Streaming compresses the file automatically

Answer

Streaming guarantees the file transfers in a single TCP packet

Question 26

How does the cluster module improve a Node web server's throughput on a multi-core machine?

Accepted Answer

It forks multiple worker processes sharing one port so requests spread across cores

Answer

It increases the size of the single process's heap

Answer

It makes each individual request execute on multiple cores simultaneously

Answer

It converts the event loop into a multi-threaded scheduler

Question 27

Why can't a server send a chat message to a client over plain HTTP without the client asking first?

Accepted Answer

HTTP is request-driven; the server has no way to initiate communication or keep a persistent connection open to push data.

Answer

HTTP doesn't allow multiple messages in a single connection.

Answer

HTTP connections don't support binary data, only text messages.

Answer

The client must close its connection after each request, preventing the server from sending responses.

Question 28

In a multiplayer game, when a player moves their character, which Socket.IO method should the server use to notify other players of the movement?

Accepted Answer

socket.broadcast.emit(), so all players except the mover see the new position.

Answer

socket.emit() called in a loop for each other player's socket.

Answer

io.emit(), so every connected player globally receives the movement.

Answer

socket.emit(), so only that player sees their own position.

Question 29

Why can't you initialize Socket.IO directly on the Express app object and use app.listen()?

Accepted Answer

Socket.IO needs the raw HTTP server object to upgrade connections to WebSocket, which app.listen() hides from you.

Answer

Socket.IO can only run on HTTPS servers, not plain HTTP.

Answer

Express apps don't support WebSocket upgrades at all.

Answer

app.listen() automatically initializes Socket.IO internally.

Question 30

Why is hardcoding an API key in your source code and committing it to a public GitHub repo dangerous?

Accepted Answer

The API key can be found by inspecting the git history, and anyone with it can access your API quota or services.

Answer

Hardcoding is unsafe only in production; development hardcoding is acceptable.

Answer

It only matters if the key is visible in the README, not in source files.

Answer

GitHub automatically scans and disables hardcoded secrets, preventing the threat.