Back-End Development — Questions and Answers

Question 1: Which index type is most efficient for equality lookups on low-cardinality columns in a relational database?

B-tree index
Hash index
Full-text index
Bitmap index (Correct answer)

Correct answer: Bitmap index

Bitmap indexes are highly efficient for low-cardinality columns (e.g., gender, status) because they represent values as bit arrays enabling fast bitwise operations.

Question 2: What is a CSRF attack and how is it typically prevented?

A session hijacking attack prevented by HTTPS
Cross-Site Request Forgery — prevented by using CSRF tokens in forms and state-changing requests (Correct answer)
A code injection attack prevented by input sanitization
A database attack prevented by encryption

Correct answer: Cross-Site Request Forgery — prevented by using CSRF tokens in forms and state-changing requests

CSRF tricks authenticated users into unknowingly submitting malicious requests; CSRF tokens ensure only forms served by the legitimate site can submit state-changing requests.

Question 3: An API is what?

A framework for frontend development
A database management software
A set of rules and protocols for building software applications (Correct answer)
A programming language for building web applications

Correct answer: A set of rules and protocols for building software applications

Explanation: An API (Application Programming Interface) is a set of rules, protocols, and tools for building software applications. It defines how software components should interact and allows applications to communicate with one another.

Question 4: What is the principle of least privilege in back-end security?

Giving all users admin rights to improve productivity
Granting users and services only the minimum permissions needed to perform their tasks (Correct answer)
Using a single shared database account for all services
Encrypting all user data regardless of sensitivity

Correct answer: Granting users and services only the minimum permissions needed to perform their tasks

The principle of least privilege limits damage from breaches or bugs by ensuring each user and service has only the access rights required for their specific function.

Question 5: Which approach is considered best practice when returning collections in a REST API?

Return only the first 10 records by default with no indication
Always return all records
Return paginated results with metadata (Correct answer)
Require the client to specify an exact count

Correct answer: Return paginated results with metadata

Paginated responses with metadata (total count, page, limit) allow clients to efficiently navigate large datasets.

Question 6: What is 'event sourcing' in back-end architecture?

Storing all state changes as an ordered, immutable sequence of events (Correct answer)
Logging only the final state of an entity after each change
Generating synthetic test events for load and performance testing
Pulling events from external third-party APIs into an internal system

Correct answer: Storing all state changes as an ordered, immutable sequence of events

Event sourcing persists every state change as an event so the current state can always be rebuilt by replaying the event log.

Question 7: In Apache Kafka, what is a 'partition'?

A dedicated disk volume used for message persistence
A logical grouping of brokers for high availability
An ordered, immutable sequence of messages within a topic (Correct answer)
A consumer group boundary that isolates message processing

Correct answer: An ordered, immutable sequence of messages within a topic

A Kafka partition is an ordered log segment of a topic that enables parallel reads and writes, providing the foundation for Kafka's scalability.

Question 8: What is the purpose of database query optimization techniques like selecting only needed columns?

To reduce the number of tables in the database
To minimize the amount of data transferred from the database, reducing memory use and network overhead (Correct answer)
To prevent SQL injection attacks
To ensure queries use the correct data types

Correct answer: To minimize the amount of data transferred from the database, reducing memory use and network overhead

Using SELECT column1, column2 instead of SELECT * limits data retrieval to only needed fields, reducing memory consumption, network bandwidth, and the chance of exposing sensitive columns.

Question 9: Which of the following is a primary benefit of containerizing a full-stack application with Docker?

It replaces the need for a database in production
It automatically scales the app based on CPU usage
It compiles JavaScript to native machine code
It ensures consistent environments across development, testing, and production (Correct answer)

Correct answer: It ensures consistent environments across development, testing, and production

Docker containers bundle the app and its dependencies so the same image runs identically on any machine.

Question 10: In full-stack development, what does 'horizontal scaling' mean?

Increasing the number of database columns in a table
Adding more server instances to distribute the load (Correct answer)
Splitting a monolith into microservices
Upgrading a single server with more CPU and RAM

Correct answer: Adding more server instances to distribute the load

Horizontal scaling adds more machines running the same application to handle increased traffic.

Question 11: What is service discovery in a microservices architecture?

Automatically generating API documentation for services
The process of registering services with a central database
Monitoring which services are healthy or unhealthy
The mechanism by which services dynamically find and communicate with each other without hard-coded addresses (Correct answer)

Correct answer: The mechanism by which services dynamically find and communicate with each other without hard-coded addresses

Service discovery allows microservices to locate each other dynamically using a registry (like Consul or Kubernetes DNS), adapting to instances starting, stopping, or moving.

Question 12: What is the difference between authentication and authorization?

They are the same concept with different names
Authorization happens before authentication
Authentication verifies identity; authorization determines permissions (Correct answer)
Authentication checks what you can do; authorization checks who you are

Correct answer: Authentication verifies identity; authorization determines permissions

Authentication is the process of verifying who a user is, while authorization determines what resources and actions that authenticated user is permitted to access.

Question 13: What does 'salting' a password mean in cryptographic terms?

Encrypting the password with a symmetric key
Adding a fixed string to all passwords before hashing
Hashing the password multiple times
Appending a unique random value to each password before hashing to prevent rainbow table attacks (Correct answer)

Correct answer: Appending a unique random value to each password before hashing to prevent rainbow table attacks

A salt is a unique random value added to each password before hashing, ensuring that identical passwords produce different hashes and making precomputed rainbow table attacks useless.

Question 14: In Node.js, what mechanism allows non-blocking I/O operations despite JavaScript being single-threaded?

Shared memory across V8 instances
Operating system process forking on every request
Multi-threading via worker_threads only
The event loop and libuv async I/O library (Correct answer)

Correct answer: The event loop and libuv async I/O library

Node.js delegates I/O to libuv, which uses OS-level async mechanisms, and the event loop picks up callbacks when operations complete.

Question 15: Which message delivery semantic guarantees that each message is processed exactly once with no duplicates and no losses?

Exactly-once delivery (Correct answer)
At-most-once delivery
At-least-once delivery
Best-effort delivery

Correct answer: Exactly-once delivery

Exactly-once delivery semantics combine deduplication and guaranteed delivery to ensure every message is processed precisely one time, making it the strongest and hardest-to-implement guarantee.

Question 16: What does the HTTP 422 Unprocessable Entity status code mean in a REST API context?

The server encountered an internal error
The server understood the request but could not process it due to semantic errors (Correct answer)
The resource was not found
The client is unauthenticated

Correct answer: The server understood the request but could not process it due to semantic errors

HTTP 422 indicates the request is well-formed but contains semantic errors, such as validation failures on the payload.

Question 17: What does TTL (Time to Live) mean in the context of caching?

The time limit for an API request to complete
The maximum time a database query is allowed to run
The duration after which a cached item expires and must be refreshed from the source (Correct answer)
The total time a server has been running

Correct answer: The duration after which a cached item expires and must be refreshed from the source

TTL defines how long a cached value remains valid before it is considered stale and must be re-fetched or recomputed from the original data source.

Question 18: What does 'at-least-once delivery' mean in a messaging system?

A message is delivered exactly one time to exactly one consumer
A message is delivered one or more times, potentially resulting in duplicates (Correct answer)
A message is delivered to at least half of all registered consumers
A message is delivered only if the consumer is currently online

Correct answer: A message is delivered one or more times, potentially resulting in duplicates

At-least-once delivery guarantees no messages are lost but may redeliver messages after failures, requiring consumers to handle duplicates.

Question 19: What is a refresh token and how does it work alongside an access token?

A token that replaces the session cookie
A token that refreshes database connections
A token that refreshes the UI automatically when data changes
A long-lived token used to obtain new short-lived access tokens without re-authentication (Correct answer)

Correct answer: A long-lived token used to obtain new short-lived access tokens without re-authentication

Refresh tokens are long-lived credentials stored securely that allow clients to obtain new short-lived access tokens when they expire, without requiring the user to log in again.

Question 20: What is the CAP theorem in distributed systems?

A theorem stating that distributed systems need Caching, APIs, and Performance
A network protocol for consistent data replication
A principle stating that a distributed system can guarantee at most two of: Consistency, Availability, and Partition Tolerance simultaneously (Correct answer)
A cloud cost optimization framework

Correct answer: A principle stating that a distributed system can guarantee at most two of: Consistency, Availability, and Partition Tolerance simultaneously

The CAP theorem proves that when a network partition occurs, a distributed system must choose between remaining consistent (all nodes see the same data) or remaining available (all requests receive a response).

Question 21: How do you use SQL to select every column from the "Persons" table?

SELECT * FROM Persons (Correct answer)
SELECT [all] FROM Persons
SELECT Persons
SELECT *.Persons

Correct answer: SELECT * FROM Persons

Explanation: To select all columns from a table named "Persons" in SQL, you would use the following SELECT statement: SELECT * FROM Persons;

Question 22: What is content compression and which algorithm is most commonly used for HTTP responses?

Minifying JavaScript files — UglifyJS compression
Reducing the size of HTTP response bodies — Gzip or Brotli compression (Correct answer)
Encrypting response payloads — AES compression
Resizing images for mobile devices — JPEG compression

Correct answer: Reducing the size of HTTP response bodies — Gzip or Brotli compression

Gzip and Brotli compress HTTP response bodies (HTML, JSON, JS, CSS) before transmission, often reducing payload size by 60-80% and significantly improving transfer speeds.

Question 23: What is rendering on a server?

The process of generating HTML on the server and sending it to the client (Correct answer)
The process of generating HTML on the client and sending it to the server
The process of generating JavaScript on the server and sending it to the client
The process of generating CSS on the server and sending it to the client

Correct answer: The process of generating HTML on the server and sending it to the client

Explanation: Server-side rendering (SSR) is the process of generating HTML on the server and sending it to the client rather than relying on client-side JavaScript to render content dynamically in the browser.

Question 24: What is async/await and why is it important for back-end I/O performance in Node.js?

A syntax for writing synchronous code in a more readable way without any performance benefit
A framework for managing background worker processes
A multi-threading mechanism for parallel CPU computation in Node.js
Syntax sugar over Promises that allows non-blocking I/O operations, keeping the event loop free to handle other requests while waiting (Correct answer)

Correct answer: Syntax sugar over Promises that allows non-blocking I/O operations, keeping the event loop free to handle other requests while waiting

async/await enables writing asynchronous code that reads like synchronous code while keeping Node.js's single-threaded event loop free during I/O waits, allowing the server to handle thousands of concurrent requests efficiently.

Question 25: What is connection timeout and why should it be set in back-end applications?

The interval between health check pings
The time a user session remains active before logout
The duration a cached database connection remains open
The maximum time to wait for a database or external service connection before giving up and returning an error (Correct answer)

Correct answer: The maximum time to wait for a database or external service connection before giving up and returning an error

Setting connection timeouts prevents threads from blocking indefinitely on unresponsive services, allowing the application to fail fast, release resources, and return a meaningful error to the client.

Question 26: In a stateless REST architecture, where is session information typically stored?

In a shared file on the server's filesystem
Inside the database as a global table
On the client side, often in a token or cookie (Correct answer)
In a server-side in-memory variable

Correct answer: On the client side, often in a token or cookie

REST is stateless, meaning each request must carry all needed context; this is typically accomplished with tokens (e.g., JWT) or cookies sent by the client.

Question 27: What is the purpose of HTTPS Strict Transport Security (HSTS)?

To restrict server access to trusted IP addresses
To force browsers to always connect to the site using HTTPS, even if HTTP is requested (Correct answer)
To enforce strong passwords on HTTPS connections
To encrypt cookies on the server side

Correct answer: To force browsers to always connect to the site using HTTPS, even if HTTP is requested

HSTS instructs browsers to always use HTTPS for a domain for a specified duration, preventing protocol downgrade attacks and cookie hijacking over HTTP.

Question 28: What is the thundering herd problem in caching?

A situation where many requests simultaneously hit the origin/database when a popular cached item expires (Correct answer)
A memory leak caused by indefinitely growing cache size
Many servers crashing simultaneously under high load
A network failure caused by too many connected clients

Correct answer: A situation where many requests simultaneously hit the origin/database when a popular cached item expires

The thundering herd occurs when a highly-requested cached item expires simultaneously for all callers, causing a surge of requests to hit the database at once before the cache is repopulated.

Question 29: What is the difference between UNION and UNION ALL in SQL?

UNION ALL requires matching column names; UNION does not
UNION is faster because it skips sorting; UNION ALL sorts results
UNION ALL only works on tables; UNION works on any query
UNION removes duplicate rows; UNION ALL keeps all rows including duplicates (Correct answer)

Correct answer: UNION removes duplicate rows; UNION ALL keeps all rows including duplicates

UNION performs a DISTINCT operation to eliminate duplicate rows in the combined result set, while UNION ALL returns every row from both queries including duplicates.

Question 30: What is Redis and what is it commonly used for in back-end applications?

An in-memory data store used for caching, session management, real-time leaderboards, and message brokering (Correct answer)
A front-end state management library
A cloud object storage service
A relational database for storing structured data

Correct answer: An in-memory data store used for caching, session management, real-time leaderboards, and message brokering

Redis is an in-memory key-value store with data structures like strings, hashes, lists, and sets, widely used to cache expensive computations, store sessions, and power real-time features.

Back-End Development

A comprehensive assessment covering core back-end development skills including APIs, databases, security, performance optimization, caching strategies, and distributed systems architecture.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds