CS 340 Client/Server Development Midterm Exam Practice
Questions and Detailed Solutions Latest Update 2026/2027 |
REST APIs, CRUD Operations, Verified Answers - 170
Questions
This midterm examination assesses advanced understanding of client/server architectures, RESTful API design,
CRUD operations, HTTP semantics, security, and performance optimization. It emphasizes practical reasoning,
protocol analysis, and architectural trade-offs in modern web development. It contains 170 multiple-choice
questions, each with four distractors and a fully worked rationale that explains why the keyed answer is correct.
Questions are organized into clearly labelled sections that mirror the major content areas of the course. Targeted
learning outcomes include: Design and evaluate RESTful APIs with appropriate HTTP methods, status codes, and
resource modeling.; Analyze client-server communication patterns, including statelessness, caching, and
idempotency.; Implement and critique CRUD operations in the context of distributed systems and security.; Apply
best practices for API versioning, authentication, and performance optimization.. Every item has been reviewed
for clinical accuracy, current guidelines, and clarity so that students can study with confidence and self-correct as
they work through the bank. Use it as a high-yield review immediately before the exam, or as a structured practice
tool during the unit - the rationales double as concise teaching notes. The recommended writing time is 3 hours,
with a passing score of 70%. Aligned with Aligned with ABET computing accreditation standards and ACM/IEEE
CS curriculum guidelines. standards and reflects the question style commonly seen on accredited program
examinations. Students consistently achieving above the cut score on this bank have historically gone on to earn
Section 1: General (Questions 1-170)
1 A RESTful API uses the following endpoint: POST /api/v1/orders.
The client sends a request with an Idempotency-Key header. The
server processes the request but the response is lost due to a network
error. The client retries with the same Idempotency-Key. What is
the most correct server behavior?
A) Return 200 OK with the original response from the first request.
B) Return 409 Conflict because the resource already exists.
C) Return 201 Created and create a duplicate order.
D) Return 500 Internal Server Error because the server cannot
distinguish retries.
Answer: A
Rationale: Idempotency keys allow the server to safely retry requests,
storing the original response keyed by the header. Returning the stored
response ensures no duplicate processing. 409 or 500 would be
incorrect because the key enables idempotent handling, and
duplicating would violate idempotency.
,2 Given an HTTP response with headers: ETag: "abc123",
Cache-Control: no-cache, and a subsequent GET request with
If-None-Match: "abc123", what should the server respond?
A) 200 OK with a new representation.
B) 304 Not Modified with an empty body.
C) 412 Precondition Failed.
D) 200 OK with a cached copy from the client's cache.
Answer: B
Rationale: The ETag matches, so the server should return 304 Not
Modified, indicating the cached version is valid. No-cache requires
revalidation but allows the 304 response. 200 would be redundant;
412 is for failed preconditions; 200 with cached copy is not a server
response.
3 A developer is designing a REST API for a banking application.
They need to ensure that a transfer operation is atomic and cannot
be executed twice. Which HTTP method and design pattern best
fulfill this requirement?
A) PUT /transfers/{id} with a client-generated UUID.
B) POST /transfers with an Idempotency-Key header.
C) PATCH /transfers/{id} with a version number.
D) DELETE /transfers/{id} with a conditional header.
Answer: B
Rationale: POST with an Idempotency-Key is the standard pattern for
creating resources where the client needs to prevent duplicates. PUT
requires a known resource ID and is idempotent but not suitable for
server-generated IDs. PATCH and DELETE do not address atomic
creation semantics.
4 In a microservices architecture, service A calls service B
synchronously. To improve resilience, you decide to implement a
circuit breaker. Which of the following is a critical benefit?
A) It ensures eventual consistency across services.
,B) It prevents cascading failures by short-circuiting calls to a failing
service.
C) It automatically retries failed requests with exponential backoff.
D) It provides a distributed transaction coordinator.
Answer: B
Rationale: A circuit breaker trips when failures exceed a threshold,
preventing further calls and allowing the service to recover, thus
avoiding cascading failures. It does not handle consistency, retries, or
transactions.
5 Which of the following is a key advantage of using gRPC over
REST for inter-service communication?
A) It uses human-readable JSON for payloads.
B) It leverages HTTP/2 for multiplexing and binary serialization.
C) It is natively supported by web browsers.
D) It simplifies debugging with curl commands.
Answer: B
Rationale: gRPC uses HTTP/2 and Protocol Buffers, enabling
multiplexing and efficient binary serialization. It is not
human-readable, not browser-native, and requires specialized tools for
debugging.
6 A REST API uses token-based authentication. The server signs a
JWT with a secret key. Which of the following is a critical security
consideration?
A) The JWT should be stored in localStorage for persistence.
B) The JWT should have a short expiration time and be transmitted
over HTTPS.
C) The JWT should contain the user's password for verification.
D) The JWT should be sent as a query parameter for easy access.
Answer: B
Rationale: Short expiration times limit the window of misuse, and
HTTPS prevents interception. Storing in localStorage is vulnerable to
, XSS; including passwords or sending via query parameters is
insecure.
7 A client sends a POST request to /api/articles with a JSON body.
The server returns 201 Created with a Location header. What does
the Location header typically contain?
A) The URL of the newly created resource.
B) The URL of the client's current page.
C) The URL of the server's root endpoint.
D) The URL of the last modified resource.
Answer: A
Rationale: In REST, a 201 response should include a Location header
pointing to the URI of the newly created resource, enabling the client
to fetch it. The other options are not standard.
8 An API endpoint GET /api/users?page=2&limit=10 implements
pagination. Which of the following is a recommended practice for
providing navigation?
A) Return all results in a single response for simplicity.
B) Include Link headers with rel="next", "prev", etc.
C) Use POST to retrieve the next page.
D) Embed the entire dataset in the response for caching.
Answer: B
Rationale: RFC 5988 defines Link headers for pagination, allowing
clients to discover related pages without hardcoding URLs. Returning
all results defeats pagination, POST is for non-idempotent operations,
and embedding everything is inefficient.
9 In a client-server application, the server uses a REST API that
supports both JSON and XML. Which HTTP mechanism is used to
negotiate the response format?
A) The Accept header in the request.
B) The Content-Type header in the request.
Questions and Detailed Solutions Latest Update 2026/2027 |
REST APIs, CRUD Operations, Verified Answers - 170
Questions
This midterm examination assesses advanced understanding of client/server architectures, RESTful API design,
CRUD operations, HTTP semantics, security, and performance optimization. It emphasizes practical reasoning,
protocol analysis, and architectural trade-offs in modern web development. It contains 170 multiple-choice
questions, each with four distractors and a fully worked rationale that explains why the keyed answer is correct.
Questions are organized into clearly labelled sections that mirror the major content areas of the course. Targeted
learning outcomes include: Design and evaluate RESTful APIs with appropriate HTTP methods, status codes, and
resource modeling.; Analyze client-server communication patterns, including statelessness, caching, and
idempotency.; Implement and critique CRUD operations in the context of distributed systems and security.; Apply
best practices for API versioning, authentication, and performance optimization.. Every item has been reviewed
for clinical accuracy, current guidelines, and clarity so that students can study with confidence and self-correct as
they work through the bank. Use it as a high-yield review immediately before the exam, or as a structured practice
tool during the unit - the rationales double as concise teaching notes. The recommended writing time is 3 hours,
with a passing score of 70%. Aligned with Aligned with ABET computing accreditation standards and ACM/IEEE
CS curriculum guidelines. standards and reflects the question style commonly seen on accredited program
examinations. Students consistently achieving above the cut score on this bank have historically gone on to earn
Section 1: General (Questions 1-170)
1 A RESTful API uses the following endpoint: POST /api/v1/orders.
The client sends a request with an Idempotency-Key header. The
server processes the request but the response is lost due to a network
error. The client retries with the same Idempotency-Key. What is
the most correct server behavior?
A) Return 200 OK with the original response from the first request.
B) Return 409 Conflict because the resource already exists.
C) Return 201 Created and create a duplicate order.
D) Return 500 Internal Server Error because the server cannot
distinguish retries.
Answer: A
Rationale: Idempotency keys allow the server to safely retry requests,
storing the original response keyed by the header. Returning the stored
response ensures no duplicate processing. 409 or 500 would be
incorrect because the key enables idempotent handling, and
duplicating would violate idempotency.
,2 Given an HTTP response with headers: ETag: "abc123",
Cache-Control: no-cache, and a subsequent GET request with
If-None-Match: "abc123", what should the server respond?
A) 200 OK with a new representation.
B) 304 Not Modified with an empty body.
C) 412 Precondition Failed.
D) 200 OK with a cached copy from the client's cache.
Answer: B
Rationale: The ETag matches, so the server should return 304 Not
Modified, indicating the cached version is valid. No-cache requires
revalidation but allows the 304 response. 200 would be redundant;
412 is for failed preconditions; 200 with cached copy is not a server
response.
3 A developer is designing a REST API for a banking application.
They need to ensure that a transfer operation is atomic and cannot
be executed twice. Which HTTP method and design pattern best
fulfill this requirement?
A) PUT /transfers/{id} with a client-generated UUID.
B) POST /transfers with an Idempotency-Key header.
C) PATCH /transfers/{id} with a version number.
D) DELETE /transfers/{id} with a conditional header.
Answer: B
Rationale: POST with an Idempotency-Key is the standard pattern for
creating resources where the client needs to prevent duplicates. PUT
requires a known resource ID and is idempotent but not suitable for
server-generated IDs. PATCH and DELETE do not address atomic
creation semantics.
4 In a microservices architecture, service A calls service B
synchronously. To improve resilience, you decide to implement a
circuit breaker. Which of the following is a critical benefit?
A) It ensures eventual consistency across services.
,B) It prevents cascading failures by short-circuiting calls to a failing
service.
C) It automatically retries failed requests with exponential backoff.
D) It provides a distributed transaction coordinator.
Answer: B
Rationale: A circuit breaker trips when failures exceed a threshold,
preventing further calls and allowing the service to recover, thus
avoiding cascading failures. It does not handle consistency, retries, or
transactions.
5 Which of the following is a key advantage of using gRPC over
REST for inter-service communication?
A) It uses human-readable JSON for payloads.
B) It leverages HTTP/2 for multiplexing and binary serialization.
C) It is natively supported by web browsers.
D) It simplifies debugging with curl commands.
Answer: B
Rationale: gRPC uses HTTP/2 and Protocol Buffers, enabling
multiplexing and efficient binary serialization. It is not
human-readable, not browser-native, and requires specialized tools for
debugging.
6 A REST API uses token-based authentication. The server signs a
JWT with a secret key. Which of the following is a critical security
consideration?
A) The JWT should be stored in localStorage for persistence.
B) The JWT should have a short expiration time and be transmitted
over HTTPS.
C) The JWT should contain the user's password for verification.
D) The JWT should be sent as a query parameter for easy access.
Answer: B
Rationale: Short expiration times limit the window of misuse, and
HTTPS prevents interception. Storing in localStorage is vulnerable to
, XSS; including passwords or sending via query parameters is
insecure.
7 A client sends a POST request to /api/articles with a JSON body.
The server returns 201 Created with a Location header. What does
the Location header typically contain?
A) The URL of the newly created resource.
B) The URL of the client's current page.
C) The URL of the server's root endpoint.
D) The URL of the last modified resource.
Answer: A
Rationale: In REST, a 201 response should include a Location header
pointing to the URI of the newly created resource, enabling the client
to fetch it. The other options are not standard.
8 An API endpoint GET /api/users?page=2&limit=10 implements
pagination. Which of the following is a recommended practice for
providing navigation?
A) Return all results in a single response for simplicity.
B) Include Link headers with rel="next", "prev", etc.
C) Use POST to retrieve the next page.
D) Embed the entire dataset in the response for caching.
Answer: B
Rationale: RFC 5988 defines Link headers for pagination, allowing
clients to discover related pages without hardcoding URLs. Returning
all results defeats pagination, POST is for non-idempotent operations,
and embedding everything is inefficient.
9 In a client-server application, the server uses a REST API that
supports both JSON and XML. Which HTTP mechanism is used to
negotiate the response format?
A) The Accept header in the request.
B) The Content-Type header in the request.
