Node.js Professional Standards & Competencies 3 — Questions and Answers
Question 1: What is the professional approach to structuring a large Node.js application to promote maintainability?
- Put all code in a single server.js file for simplicity
- Organize code into feature-based or layer-based modules with clear separation of concerns (Correct answer)
- Use only global variables to share state between modules
- Avoid using any npm packages to reduce complexity
Correct answer: Organize code into feature-based or layer-based modules with clear separation of concerns
Modular architecture with clear separation of concerns makes large codebases easier to navigate, test, and maintain.
Question 2: When writing a Node.js library for public npm, what professional standard should guide your choice of dependencies?
- Include as many dependencies as possible to provide rich functionality
- Minimize dependencies to reduce the attack surface and installation size for consumers (Correct answer)
- Always use the latest unstable version of each dependency
- Avoid declaring dependencies in package.json
Correct answer: Minimize dependencies to reduce the attack surface and installation size for consumers
Fewer dependencies mean less exposure to supply-chain attacks and a lighter footprint for library consumers.
Question 3: What does 'graceful shutdown' mean in the context of a professional Node.js service?
- Immediately killing the process with SIGKILL on shutdown
- Stopping acceptance of new requests, finishing in-flight requests, then exiting cleanly (Correct answer)
- Restarting the process on every incoming SIGTERM signal
- Deleting the node_modules folder before the process exits
Correct answer: Stopping acceptance of new requests, finishing in-flight requests, then exiting cleanly
Graceful shutdown ensures no requests are dropped mid-processing when the service is restarted or scaled down.
Question 4: A Node.js API returns detailed stack traces to the client in production. What professional issue does this present?
- It helps users debug problems faster
- It exposes internal implementation details and potential attack vectors to malicious users (Correct answer)
- It reduces server response time
- It is required by the Node.js runtime in production mode
Correct answer: It exposes internal implementation details and potential attack vectors to malicious users
Stack traces reveal file paths, library versions, and code structure that attackers can exploit.
Question 5: Which practice is a professional standard for Node.js API versioning?
- Change the API without notice on every deployment
- Prefix routes with a version identifier (e.g., /api/v1/) and maintain older versions during transition periods (Correct answer)
- Use query parameters like ?version=old for backward compatibility
- Never version APIs — always make breaking changes in place
Correct answer: Prefix routes with a version identifier (e.g., /api/v1/) and maintain older versions during transition periods
URL-based versioning clearly signals breaking changes to consumers and allows parallel support of multiple versions.
Question 6: What is the professional standard for logging in a Node.js microservice?
- Use console.log everywhere with no structure
- Emit structured JSON logs with severity levels, correlation IDs, and timestamps (Correct answer)
- Write logs only to local files that are never forwarded
- Disable all logging to improve performance
Correct answer: Emit structured JSON logs with severity levels, correlation IDs, and timestamps
Structured JSON logs are machine-parseable, enabling log aggregation tools to filter, search, and alert effectively.
Question 7: How should a professional Node.js developer handle a dependency that has a known high-severity vulnerability and no patch yet available?
- Ignore it until npm audit stops reporting it
- Assess exploitability, apply mitigations or workarounds, and track the vulnerability for a patch (Correct answer)
- Delete the package from package.json without replacing its functionality
- Downgrade Node.js to a version that does not run npm audit
Correct answer: Assess exploitability, apply mitigations or workarounds, and track the vulnerability for a patch
Risk-based assessment and interim mitigations are the professional response when a patch is not yet available.
Node.js Professional Standards & Competencies 3
What is the professional approach to structuring a large Node.js application to promote maintainability?