Question bank
Pick an answer to see if you're right — with an explanation.
All topicsPythonSQL / MySQLData ScienceNumPyPandasMatplotlibMachine LearningDeep LearningArtificial IntelligenceLarge Language ModelsDjangoAPIsGit & GitHubPower BIExcelStatistics
APIsEasy
Which status code best fits a successful POST that created a new resource?
a200 OK
b201 Created
c204 No Content
d302 Found
Explanation: 201 Created signals a new resource, ideally with a Location header pointing to it.
APIsEasy
Which status code tells a client it is sending too many requests?
a403
b409
c503
d429
Explanation: 429 Too Many Requests is the standard rate-limit response, often with Retry-After.
APIsEasy
Which URL follows REST naming conventions for fetching one order?
aGET /v1/orders/9812
bGET /v1/getOrder?id=9812
cPOST /v1/orders/get/9812
dGET /v1/order_fetch/9812
Explanation: Use plural nouns and put the identifier in the path; the HTTP method provides the verb.
APIsEasy
What are the three dot-separated parts of a JWT?
akey.value.checksum
buser.role.expiry
cheader.payload.signature
diss.sub.aud
Explanation: A JWT is header.payload.signature, each Base64URL-encoded.
APIsMedium
Which HTTP method is NOT idempotent by definition?
aPUT
bDELETE
cGET
dPOST
Explanation: Repeating a POST can create duplicates; PUT, DELETE and GET leave the same state however often they are repeated.
APIsMedium
A logged-in user requests an admin-only endpoint. Which status code is correct?
a401 Unauthorized
b403 Forbidden
c404 Not Found
d400 Bad Request
Explanation: The user is authenticated but lacks permission, so 403; 401 is for missing or invalid credentials.
APIsMedium
What does FastAPI return if this endpoint receives `{"qty": "abc"}`?
class Item(BaseModel):
qty: int
@app.post('/items')
def add(item: Item):
return item
a500 Internal Server Error
b200 with qty set to 0
c422 with details of the validation error
d400 with an empty body
Explanation: Pydantic validation fails and FastAPI automatically responds with 422 and a list of field errors.
APIsMedium
Which OAuth2 flow suits a backend service calling another API with no user involved?
aClient Credentials
bAuthorization Code with PKCE
cImplicit
dResource Owner Password
Explanation: Client Credentials is designed for machine-to-machine access.
APIsHard
Why is cursor (keyset) pagination preferred over large offsets on big tables?
aCursors allow jumping to any page number
bOffsets are not supported by SQL
cCursors are easier to implement in the client
d`WHERE id > last_id` uses an index, while big OFFSETs scan and discard many rows
Explanation: Deep offsets get slower and unstable as data changes; keyset pagination stays fast and consistent.
APIsHard
Why does this webhook check use `hmac.compare_digest` instead of `==`?
expected = hmac.new(secret, body, hashlib.sha256).hexdigest()
ok = hmac.compare_digest(expected, received)
aIt is faster than ==
bIt compares in constant time, preventing timing attacks
cIt also decodes Base64
d== cannot compare hex strings
Explanation: A normal comparison stops at the first differing character, leaking timing information an attacker can exploit.