Node.js Professional Standards & Competencies 4 — Questions and Answers
Question 1: Which testing strategy reflects professional competency for a Node.js REST API?
- Only test the UI layer manually in a browser
- Combine unit tests for business logic, integration tests for routes, and end-to-end tests for critical flows (Correct answer)
- Write only end-to-end tests because they cover everything
- Skip tests and rely on user feedback in production
Correct answer: Combine unit tests for business logic, integration tests for routes, and end-to-end tests for critical flows
A layered testing strategy (unit + integration + e2e) balances coverage, speed, and confidence at each level.
Question 2: What is the professional standard for committing secrets like database passwords into a Git repository?
- Acceptable if the repository is private
- Never commit secrets; use environment variables, secret managers, or vault services instead (Correct answer)
- Encode secrets in Base64 before committing
- Store secrets in comments so they are easy to find
Correct answer: Never commit secrets; use environment variables, secret managers, or vault services instead
Secrets in Git history can be exposed even if later deleted, and private repos can become public or be cloned.
Question 3: When releasing a new major version of an npm package, what professional documentation practice is expected?
- No documentation is needed for new versions
- Publish a changelog or migration guide detailing breaking changes and upgrade steps (Correct answer)
- Rename the package on npm without documentation
- Only update the version number in package.json
Correct answer: Publish a changelog or migration guide detailing breaking changes and upgrade steps
A changelog and migration guide help consumers understand what changed and how to upgrade safely.
Question 4: Which practice demonstrates professional competency in Node.js performance monitoring?
- Checking server metrics only when users report slowness
- Implementing APM tools (e.g., New Relic, Datadog) and setting proactive alerts on latency and error rate thresholds (Correct answer)
- Profiling the application once at launch and never again
- Measuring performance only in the development environment
Correct answer: Implementing APM tools (e.g., New Relic, Datadog) and setting proactive alerts on latency and error rate thresholds
Proactive monitoring with alerting thresholds catches regressions before they impact users at scale.
Question 5: A Node.js service uses a third-party library that has not been updated in 3 years. What is the professional approach?
- Use it indefinitely as long as it appears to work
- Evaluate actively maintained alternatives, check for known CVEs, and plan a migration if risk is high (Correct answer)
- Immediately remove it without replacement
- Fork it and publish under a different name without review
Correct answer: Evaluate actively maintained alternatives, check for known CVEs, and plan a migration if risk is high
Unmaintained dependencies accumulate unpatched vulnerabilities; proactive evaluation reduces supply-chain risk.
Question 6: What does the Node.js community consider a best practice for handling asynchronous errors in Express middleware?
- Letting unhandled promise rejections crash the process silently
- Passing errors to next(err) so Express's error-handling middleware can process them (Correct answer)
- Using process.exit(0) inside each route handler on error
- Returning HTTP 200 with an error field in the JSON body for all errors
Correct answer: Passing errors to next(err) so Express's error-handling middleware can process them
Passing errors to next(err) delegates to Express's centralized error handler, keeping error handling consistent.
Question 7: Which approach reflects professional rate-limiting competency in a public-facing Node.js API?
- Allow unlimited requests from any IP to maximize availability
- Implement rate limiting per IP or API key using middleware like express-rate-limit, with clear 429 responses (Correct answer)
- Block all requests after the server reaches 50% CPU usage
- Require users to wait 1 second between requests enforced client-side only
Correct answer: Implement rate limiting per IP or API key using middleware like express-rate-limit, with clear 429 responses
Server-side rate limiting protects against abuse and DDoS while providing clear feedback via HTTP 429 responses.
Node.js Professional Standards & Competencies 4
Which testing strategy reflects professional competency for a Node.js REST API?