IT 253 Client/Server Development Comprehensive Final Exam
Practice Questions and Detailed Solutions Latest Update
2026/2027 | Database Connectivity, Web Applications, Verified
Answers - 200 Questions
Comprehensive final examination covering advanced client/server architectures, database connectivity, and web
application development. Topics include connection pooling, ORM optimization, RESTful API design, security,
and deployment strategies. It contains 200 multiple-choice questions, each with four distractors and a fully
worked rationale that explains why the keyed answer is correct. Questions are organized into clearly labelled
sections that mirror the major content areas of the course. Targeted learning outcomes include: Analyze and
optimize client/server communication patterns; Design secure and efficient database connectivity layers; Evaluate
and implement web application architectures; Troubleshoot and debug distributed system issues. Every item has
been reviewed for clinical accuracy, current guidelines, and clarity so that students can study with confidence and
self-correct as they work through the bank. Use it as a high-yield review immediately before the exam, or as a
structured practice tool during the unit - the rationales double as concise teaching notes. The recommended
writing time is 3 hours, with a passing score of 70%. Aligned with This exam adheres to the rigorous standards of
top-tier US research universities, ensuring depth and currency in computer science education. standards and
reflects the question style commonly seen on accredited program examinations. Students consistently achieving
above the cut score on this bank have historically gone on to earn A+ on the corresponding course exam. Read
every stem carefully - distractors are written to look plausible, and the best answer is sometimes the one that
Section 1: General (Questions 1-200)
1 In a high-throughput client/server system, connection pooling is
used to manage database connections. Which of the following
scenarios would MOST likely cause a connection leak that degrades
performance over time?
A) The pool's maximum connection count is set too low, causing
requests to queue.
B) The application fails to return connections to the pool in a finally
block after an exception.
C) The database server is restarted, invalidating cached connections.
D) The connection pool's idle timeout is shorter than the database's
wait timeout.
Answer: B
Rationale: A connection leak occurs when connections are not returned
to the pool, typically because the application does not release them in
a finally block. This leads to pool exhaustion over time. Other options
cause temporary issues but not a progressive leak.
,2 When designing a RESTful API for a client/server application,
which HTTP status code and response combination BEST handles a
request that attempts to update a resource that has been modified
since the client last fetched it, assuming optimistic locking?
A) 200 OK with the updated resource
B) 409 Conflict with a message indicating the version mismatch
C) 422 Unprocessable Entity with validation errors
D) 412 Precondition Failed with the current resource state
Answer: D
Rationale: 412 Precondition Failed is used when a precondition (e.g.,
If-Match header) fails, indicating the resource has changed. It should
return the current state so the client can resolve the conflict. 409
Conflict is more general, while 422 is for semantic errors.
3 A development team is migrating a monolithic application to a
microservices architecture. They need to ensure that a service can
connect to a database without hardcoding credentials. Which
solution is MOST secure and consistent with modern cloud-native
practices?
A) Store credentials in environment variables on each container
B) Use a secrets management service (e.g., HashiCorp Vault) to
dynamically issue short-lived credentials
C) Encrypt credentials in the application's configuration file
D) Share a single database user across all services for simplicity
Answer: B
Rationale: Secrets management services provide dynamic, short-lived
credentials, reducing risk of exposure. Environment variables can
leak, config files are often committed to version control, and shared
users violate least privilege.
,4 Consider a client/server application using an Object-Relational
Mapping (ORM) framework. Which N+1 query problem mitigation
technique is MOST effective when you need to load a list of entities
and their related collections?
A) Enable lazy loading for all relationships
B) Use a join fetch or eager loading in the initial query
C) Increase the database connection pool size
D) Use a separate query for each collection and merge in memory
Answer: B
Rationale: Join fetch or eager loading retrieves related data in a single
query, avoiding the N+1 problem. Lazy loading causes additional
queries, and merging in memory still requires multiple queries. Pool
size does not address the issue.
5 In a distributed client/server system, which strategy BEST ensures
idempotency when a client retries a POST request to create a
resource after a network timeout?
A) Return 200 OK on the retry if the resource already exists
B) Have the client generate a unique idempotency key and the server
store it with the created resource
C) Use a timestamp in the request body to differentiate retries
D) Rely on the database's unique constraint on the resource name
Answer: B
Rationale: An idempotency key allows the server to recognize retries
and return the original result without creating duplicates. Timestamps
or unique constraints are not reliable for idempotency across
distributed systems.
6 A client/server application uses a message queue to decouple
services. Which pattern BEST handles the situation where a
consumer crashes after reading a message but before processing it
fully, ensuring no message loss?
A) Use auto-acknowledgment when the message is received
, B) Use manual acknowledgment and redeliver unacknowledged
messages after a timeout
C) Store processed messages in a separate database
D) Use a dead-letter queue for all messages that fail once
Answer: B
Rationale: Manual acknowledgment ensures the message is not
considered processed until the consumer completes. If the consumer
crashes, the broker redelivers after a timeout. Auto-ack loses
messages, and dead-letter queues are for repeated failures.
7 Which of the following is the MOST significant security risk when
a client/server application uses JSON Web Tokens (JWT) for
authentication?
A) Token expiration is set to 24 hours
B) The token is stored in browser local storage
C) The token contains a large payload with user metadata
D) The server does not maintain a token revocation list
Answer: D
Rationale: JWTs are stateless; without a revocation list, a
compromised token remains valid until expiration. Local storage is a
risk, but revocation is a more fundamental design flaw. Expiration and
payload size are less critical.
8 In a client/server application using a relational database, which
index type is MOST appropriate for optimizing queries that filter on
a range of values (e.g., WHERE date BETWEEN '2026-01-01' AND
'2026-01-31')?
A) B-tree index
B) Hash index
C) Bitmap index
D) Full-text index
Answer: A
Practice Questions and Detailed Solutions Latest Update
2026/2027 | Database Connectivity, Web Applications, Verified
Answers - 200 Questions
Comprehensive final examination covering advanced client/server architectures, database connectivity, and web
application development. Topics include connection pooling, ORM optimization, RESTful API design, security,
and deployment strategies. It contains 200 multiple-choice questions, each with four distractors and a fully
worked rationale that explains why the keyed answer is correct. Questions are organized into clearly labelled
sections that mirror the major content areas of the course. Targeted learning outcomes include: Analyze and
optimize client/server communication patterns; Design secure and efficient database connectivity layers; Evaluate
and implement web application architectures; Troubleshoot and debug distributed system issues. Every item has
been reviewed for clinical accuracy, current guidelines, and clarity so that students can study with confidence and
self-correct as they work through the bank. Use it as a high-yield review immediately before the exam, or as a
structured practice tool during the unit - the rationales double as concise teaching notes. The recommended
writing time is 3 hours, with a passing score of 70%. Aligned with This exam adheres to the rigorous standards of
top-tier US research universities, ensuring depth and currency in computer science education. standards and
reflects the question style commonly seen on accredited program examinations. Students consistently achieving
above the cut score on this bank have historically gone on to earn A+ on the corresponding course exam. Read
every stem carefully - distractors are written to look plausible, and the best answer is sometimes the one that
Section 1: General (Questions 1-200)
1 In a high-throughput client/server system, connection pooling is
used to manage database connections. Which of the following
scenarios would MOST likely cause a connection leak that degrades
performance over time?
A) The pool's maximum connection count is set too low, causing
requests to queue.
B) The application fails to return connections to the pool in a finally
block after an exception.
C) The database server is restarted, invalidating cached connections.
D) The connection pool's idle timeout is shorter than the database's
wait timeout.
Answer: B
Rationale: A connection leak occurs when connections are not returned
to the pool, typically because the application does not release them in
a finally block. This leads to pool exhaustion over time. Other options
cause temporary issues but not a progressive leak.
,2 When designing a RESTful API for a client/server application,
which HTTP status code and response combination BEST handles a
request that attempts to update a resource that has been modified
since the client last fetched it, assuming optimistic locking?
A) 200 OK with the updated resource
B) 409 Conflict with a message indicating the version mismatch
C) 422 Unprocessable Entity with validation errors
D) 412 Precondition Failed with the current resource state
Answer: D
Rationale: 412 Precondition Failed is used when a precondition (e.g.,
If-Match header) fails, indicating the resource has changed. It should
return the current state so the client can resolve the conflict. 409
Conflict is more general, while 422 is for semantic errors.
3 A development team is migrating a monolithic application to a
microservices architecture. They need to ensure that a service can
connect to a database without hardcoding credentials. Which
solution is MOST secure and consistent with modern cloud-native
practices?
A) Store credentials in environment variables on each container
B) Use a secrets management service (e.g., HashiCorp Vault) to
dynamically issue short-lived credentials
C) Encrypt credentials in the application's configuration file
D) Share a single database user across all services for simplicity
Answer: B
Rationale: Secrets management services provide dynamic, short-lived
credentials, reducing risk of exposure. Environment variables can
leak, config files are often committed to version control, and shared
users violate least privilege.
,4 Consider a client/server application using an Object-Relational
Mapping (ORM) framework. Which N+1 query problem mitigation
technique is MOST effective when you need to load a list of entities
and their related collections?
A) Enable lazy loading for all relationships
B) Use a join fetch or eager loading in the initial query
C) Increase the database connection pool size
D) Use a separate query for each collection and merge in memory
Answer: B
Rationale: Join fetch or eager loading retrieves related data in a single
query, avoiding the N+1 problem. Lazy loading causes additional
queries, and merging in memory still requires multiple queries. Pool
size does not address the issue.
5 In a distributed client/server system, which strategy BEST ensures
idempotency when a client retries a POST request to create a
resource after a network timeout?
A) Return 200 OK on the retry if the resource already exists
B) Have the client generate a unique idempotency key and the server
store it with the created resource
C) Use a timestamp in the request body to differentiate retries
D) Rely on the database's unique constraint on the resource name
Answer: B
Rationale: An idempotency key allows the server to recognize retries
and return the original result without creating duplicates. Timestamps
or unique constraints are not reliable for idempotency across
distributed systems.
6 A client/server application uses a message queue to decouple
services. Which pattern BEST handles the situation where a
consumer crashes after reading a message but before processing it
fully, ensuring no message loss?
A) Use auto-acknowledgment when the message is received
, B) Use manual acknowledgment and redeliver unacknowledged
messages after a timeout
C) Store processed messages in a separate database
D) Use a dead-letter queue for all messages that fail once
Answer: B
Rationale: Manual acknowledgment ensures the message is not
considered processed until the consumer completes. If the consumer
crashes, the broker redelivers after a timeout. Auto-ack loses
messages, and dead-letter queues are for repeated failures.
7 Which of the following is the MOST significant security risk when
a client/server application uses JSON Web Tokens (JWT) for
authentication?
A) Token expiration is set to 24 hours
B) The token is stored in browser local storage
C) The token contains a large payload with user metadata
D) The server does not maintain a token revocation list
Answer: D
Rationale: JWTs are stateless; without a revocation list, a
compromised token remains valid until expiration. Local storage is a
risk, but revocation is a more fundamental design flaw. Expiration and
payload size are less critical.
8 In a client/server application using a relational database, which
index type is MOST appropriate for optimizing queries that filter on
a range of values (e.g., WHERE date BETWEEN '2026-01-01' AND
'2026-01-31')?
A) B-tree index
B) Hash index
C) Bitmap index
D) Full-text index
Answer: A
