API GraphQL & SOAP Testing 2 — Questions and Answers
Question 1: What is a WSDL file used for in SOAP web services?
- Define the database schema
- Describe the SOAP service's operations, messages, and endpoint location in XML (Correct answer)
- Encrypt SOAP messages
- Set SOAP rate limits
Correct answer: Describe the SOAP service's operations, messages, and endpoint location in XML
WSDL (Web Services Description Language) is an XML document that describes what operations a SOAP service offers, their inputs/outputs, and where to call them.
Question 2: What is the GraphQL introspection query used for?
- Authenticate with the GraphQL server
- Query the schema to discover available types, fields, and operations (Correct answer)
- Monitor GraphQL performance
- Test GraphQL mutations
Correct answer: Query the schema to discover available types, fields, and operations
Introspection allows clients to query the GraphQL server's own schema meta-information, enabling tools to auto-generate documentation and queries.
Question 3: What is the 'N+1 query problem' in GraphQL testing?
- Running one extra test per endpoint
- Fetching a list then making N additional queries for each item's related data (Correct answer)
- Using one extra authentication call
- Making N backup requests per mutation
Correct answer: Fetching a list then making N additional queries for each item's related data
The N+1 problem occurs when a GraphQL resolver fetches a list (1 query) then makes a separate database call for each item (N queries), severely hurting performance.
Question 4: What is a GraphQL 'subscription' used for?
- Paying for GraphQL API access
- Receiving real-time data push updates from the server over WebSocket (Correct answer)
- Subscribing to API changelog notifications
- Defining optional query fields
Correct answer: Receiving real-time data push updates from the server over WebSocket
GraphQL subscriptions use WebSocket connections to push real-time updates from the server to the client when data changes occur.
Question 5: What security concern should testers check when introspection is enabled on a production GraphQL API?
- Slow query performance
- Exposing the full schema to attackers, revealing sensitive types and mutations (Correct answer)
- Incorrect HTTP status codes
- Missing CORS headers
Correct answer: Exposing the full schema to attackers, revealing sensitive types and mutations
Enabled introspection in production lets attackers map the entire API schema, discovering sensitive fields and operations to target.
Question 6: Which testing tool provides a browser-based IDE specifically for testing GraphQL APIs?
- Swagger UI
- GraphiQL (Correct answer)
- Postman only
- Insomnia only
Correct answer: GraphiQL
GraphiQL is the official browser-based IDE for GraphQL that provides schema exploration, query autocompletion, and real-time testing.
API GraphQL & SOAP Testing 2
What is a WSDL file used for in SOAP web services?