Question bank

Pick an answer to see if you're right — with an explanation.

APIsEasy
Which status code best fits a successful POST that created a new resource?
a200 OK
b201 Created
c204 No Content
d302 Found
APIsEasy
Which status code tells a client it is sending too many requests?
a403
b409
c503
d429
APIsEasy
Which URL follows REST naming conventions for fetching one order?
aGET /v1/orders/9812
bGET /v1/getOrder?id=9812
cPOST /v1/orders/get/9812
dGET /v1/order_fetch/9812
APIsEasy
What are the three dot-separated parts of a JWT?
akey.value.checksum
buser.role.expiry
cheader.payload.signature
diss.sub.aud
APIsMedium
Which HTTP method is NOT idempotent by definition?
aPUT
bDELETE
cGET
dPOST
APIsMedium
A logged-in user requests an admin-only endpoint. Which status code is correct?
a401 Unauthorized
b403 Forbidden
c404 Not Found
d400 Bad Request
APIsMedium
What does FastAPI return if this endpoint receives `{"qty": "abc"}`?
class Item(BaseModel):
    qty: int

@app.post('/items')
def add(item: Item):
    return item
a500 Internal Server Error
b200 with qty set to 0
c422 with details of the validation error
d400 with an empty body
APIsMedium
Which OAuth2 flow suits a backend service calling another API with no user involved?
aClient Credentials
bAuthorization Code with PKCE
cImplicit
dResource Owner Password
APIsHard
Why is cursor (keyset) pagination preferred over large offsets on big tables?
aCursors allow jumping to any page number
bOffsets are not supported by SQL
cCursors are easier to implement in the client
d`WHERE id > last_id` uses an index, while big OFFSETs scan and discard many rows
APIsHard
Why does this webhook check use `hmac.compare_digest` instead of `==`?
expected = hmac.new(secret, body, hashlib.sha256).hexdigest()
ok = hmac.compare_digest(expected, received)
aIt is faster than ==
bIt compares in constant time, preventing timing attacks
cIt also decodes Base64
d== cannot compare hex strings