CS API Development & Integration 3 — Questions and Answers
Question 1: A server responds to POST /api/orders with 201 Created. Which header should accompany the response to point at the new resource?
- Location (Correct answer)
- Referer
- Host
- Accept
Correct answer: Location
A 201 Created response conventionally includes a Location header containing the URI of the newly created resource.
Question 2: Which statement about a JWT (JSON Web Token) used as an API bearer token is TRUE?
- Its payload is encrypted and unreadable without the secret
- Its payload is only Base64URL-encoded, so anyone holding the token can read the claims (Correct answer)
- It cannot expire once issued
- It must be stored server-side in a session table
Correct answer: Its payload is only Base64URL-encoded, so anyone holding the token can read the claims
A signed JWT's payload is Base64URL-encoded, not encrypted, so signing guarantees integrity but not confidentiality.
Question 3: A webhook provider signs each delivery with an HMAC in a header. Why should the consumer verify this signature?
- To compress the payload for faster processing
- To confirm the request genuinely came from the provider and was not tampered with (Correct answer)
- To convert the payload from XML to JSON
- To renew the consumer's TLS certificate
Correct answer: To confirm the request genuinely came from the provider and was not tampered with
Verifying the HMAC with a shared secret authenticates the webhook's origin and detects payload tampering.
Question 4: Which versioning approach places the API version in the URL path?
- Accept: application/vnd.myapi.v2+json
- GET /v2/customers (Correct answer)
- X-API-Version: 2 header
- A version field inside the JSON request body
Correct answer: GET /v2/customers
Putting the version segment in the path, such as /v2/customers, is URI-based versioning.
Question 5: Under HTTP semantics, which method is defined as both safe and idempotent?
- POST
- PATCH
- GET (Correct answer)
- DELETE
Correct answer: GET
GET is safe (no state change) and idempotent, whereas DELETE is idempotent but not safe, and POST is neither.
Question 6: A microservice calls a flaky downstream API. Which pattern stops sending requests after repeated failures and lets the downstream service recover?
- Circuit breaker (Correct answer)
- Long polling
- Sticky sessions
- Content negotiation
Correct answer: Circuit breaker
A circuit breaker opens after a failure threshold, short-circuiting calls until the dependency recovers.
Question 7: Which gRPC characteristic most distinguishes it from a typical JSON REST API?
- It transfers data as HTML pages
- It uses Protocol Buffers over HTTP/2 with support for bidirectional streaming (Correct answer)
- It only works inside a single process
- It requires cookies for every call
Correct answer: It uses Protocol Buffers over HTTP/2 with support for bidirectional streaming
gRPC serializes messages with Protocol Buffers and runs over HTTP/2, enabling efficient binary transfer and streaming.
CS API Development & Integration 3
A server responds to POST /api/orders with 201 Created.
Which header should accompany the response to point at the new resource?