IT 253 Client/Server Development Midterm Exam Practice
Questions and Detailed Solutions Latest Update 2026/2027 | SQL
Integration, Server Applications, Verified Answers - 190
Questions
This midterm examination assesses advanced proficiency in client/server architectures, SQL integration,
server-side application development, and database connectivity. It emphasizes architectural patterns, transaction
management, security, and performance optimization in modern enterprise environments. It contains 190
multiple-choice questions, each with four distractors and a fully worked rationale that explains why the keyed
answer is correct. Questions are organized into clearly labelled sections that mirror the major content areas of
the course. Targeted learning outcomes include: Design and implement robust client/server applications with
layered architecture; Integrate SQL databases with server applications using best practices for security and
performance; Analyze and optimize transaction isolation, connection pooling, and caching strategies; Evaluate
trade-offs between synchronous and asynchronous communication in distributed systems. Every item has been
reviewed for clinical accuracy, current guidelines, and clarity so that students can study with confidence and
self-correct as they work through the bank. Use it as a high-yield review immediately before the exam, or as a
structured practice tool during the unit - the rationales double as concise teaching notes. The recommended
writing time is 3 hours, with a passing score of 75%. Aligned with Compliant with the rigorous standards of the
ACM/IEEE computing curricula and accredited US university programs. standards and reflects the question style
commonly seen on accredited program examinations. Students consistently achieving above the cut score on this
Section 1: General (Questions 1-190)
1 In a three-tier client/server architecture, which deployment strategy
best preserves the principle of separation of concerns while
minimizing network round-trips for a data-intensive reporting
module?
A) Embed SQL queries directly in the client-side code to reduce
server load
B) Use stored procedures on the database server and access them via
a thin service layer
C) Implement business logic in the client and use the middle tier
solely for authentication
D) Render reports directly from the database using linked servers
Answer: B
Rationale: Stored procedures encapsulate data logic, reducing network
traffic and preserving separation of concerns. Direct client SQL (A)
violates separation. Client-side business logic (C) and linked servers
(D) compromise scalability and maintainability.
,2 Consider a Node.js server using the pg library. Which pattern
correctly prevents SQL injection while allowing dynamic sorting?
A) String concatenation with parameterized values for all parts
B) Parameterized values for data, whitelist validation for identifiers
C) Client-side escaping of all user inputs
D) Using ORM methods without any additional validation
Answer: B
Rationale: Parameterized queries secure data values, but identifiers like
column names cannot be parameterized; whitelist validation prevents
injection. Concatenation (A) is unsafe. Client-side escaping (C) is
bypassable. ORM alone (D) doesn't cover all cases.
3 A transaction isolation level is set to READ COMMITTED. Under
concurrent access, which anomaly is still possible?
A) Dirty read
B) Non-repeatable read
C) Phantom read
D) Lost update
Answer: C
Rationale: READ COMMITTED prevents dirty reads but allows
non-repeatable reads and phantoms because locks are released after
each statement. Phantom reads (C) occur when a range query returns
different rows on re-execution. Dirty reads (A) are prevented;
non-repeatable reads (B) are possible, but the question asks which is
still possible-phantom is a classic example, and lost updates (D) can
also occur but are not the primary anomaly defined by isolation levels.
4 When scaling a read-heavy relational database, which strategy
provides the best balance between consistency and performance
without requiring application code changes?
A) Synchronous replication to a single standby
B) Asynchronous replication with read replicas and a load balancer
C) Sharding by user ID with cross-shard queries
,D) In-memory caching at the application layer
Answer: B
Rationale: Asynchronous replication to read replicas offloads
SELECTs with minimal code changes, offering near-real-time
consistency. Synchronous replication (A) reduces performance.
Sharding (C) requires code changes for cross-shard queries. Caching
(D) adds complexity and stale data risks.
5 In a RESTful API, which HTTP status code is most appropriate
when a client sends a request that violates a business rule but is
syntactically valid?
A) 400 Bad Request
B) 422 Unprocessable Entity
C) 409 Conflict
D) 403 Forbidden
Answer: A
Rationale: While 422 is used for semantic errors, many APIs use 400
for any client error. Given the options, 400 is the most universally
applicable. 409 (C) is for conflicts with resource state, 403 (D) is for
authorization failures.
6 Which statement accurately describes the trade-off between
optimistic and pessimistic concurrency control in a high-contention
environment?
A) Optimistic control reduces rollbacks in high-contention scenarios
B) Pessimistic control increases lock contention but minimizes
rollbacks
C) Optimistic control is best for write-heavy workloads with
frequent conflicts
D) Pessimistic control is preferred when reads vastly outnumber
writes
Answer: B
, Rationale: Pessimistic locking prevents conflicts by holding locks,
reducing rollbacks but increasing contention. Optimistic control (A,
C) performs poorly under high contention due to frequent rollbacks.
Pessimistic control (D) is not preferred for read-heavy workloads;
optimistic is.
7 A developer is designing a microservices architecture. Which data
management pattern ensures that services do not tightly couple to a
shared database schema?
A) Database per service
B) Shared database with a single schema
C) Saga pattern for distributed transactions
D) API gateway for aggregation
Answer: A
Rationale: Database per service gives each service its own schema,
enforcing boundaries and avoiding coupling. Shared database (B)
creates tight coupling. Saga (C) handles transactions, not schema
decoupling. API gateway (D) is for communication.
8 In a Node.js application using connection pooling, what is the
primary purpose of setting a low `connectionTimeoutMillis`?
A) To prevent idle connections from being closed
B) To fail fast when the database is unreachable
C) To reduce the number of connections created
D) To speed up query execution
Answer: B
Rationale: `connectionTimeoutMillis` defines how long to wait for a
connection before throwing an error, enabling fast failure when the
DB is down. It doesn't prevent idle closure (A), reduce connections
(C), or speed queries (D).
Questions and Detailed Solutions Latest Update 2026/2027 | SQL
Integration, Server Applications, Verified Answers - 190
Questions
This midterm examination assesses advanced proficiency in client/server architectures, SQL integration,
server-side application development, and database connectivity. It emphasizes architectural patterns, transaction
management, security, and performance optimization in modern enterprise environments. It contains 190
multiple-choice questions, each with four distractors and a fully worked rationale that explains why the keyed
answer is correct. Questions are organized into clearly labelled sections that mirror the major content areas of
the course. Targeted learning outcomes include: Design and implement robust client/server applications with
layered architecture; Integrate SQL databases with server applications using best practices for security and
performance; Analyze and optimize transaction isolation, connection pooling, and caching strategies; Evaluate
trade-offs between synchronous and asynchronous communication in distributed systems. Every item has been
reviewed for clinical accuracy, current guidelines, and clarity so that students can study with confidence and
self-correct as they work through the bank. Use it as a high-yield review immediately before the exam, or as a
structured practice tool during the unit - the rationales double as concise teaching notes. The recommended
writing time is 3 hours, with a passing score of 75%. Aligned with Compliant with the rigorous standards of the
ACM/IEEE computing curricula and accredited US university programs. standards and reflects the question style
commonly seen on accredited program examinations. Students consistently achieving above the cut score on this
Section 1: General (Questions 1-190)
1 In a three-tier client/server architecture, which deployment strategy
best preserves the principle of separation of concerns while
minimizing network round-trips for a data-intensive reporting
module?
A) Embed SQL queries directly in the client-side code to reduce
server load
B) Use stored procedures on the database server and access them via
a thin service layer
C) Implement business logic in the client and use the middle tier
solely for authentication
D) Render reports directly from the database using linked servers
Answer: B
Rationale: Stored procedures encapsulate data logic, reducing network
traffic and preserving separation of concerns. Direct client SQL (A)
violates separation. Client-side business logic (C) and linked servers
(D) compromise scalability and maintainability.
,2 Consider a Node.js server using the pg library. Which pattern
correctly prevents SQL injection while allowing dynamic sorting?
A) String concatenation with parameterized values for all parts
B) Parameterized values for data, whitelist validation for identifiers
C) Client-side escaping of all user inputs
D) Using ORM methods without any additional validation
Answer: B
Rationale: Parameterized queries secure data values, but identifiers like
column names cannot be parameterized; whitelist validation prevents
injection. Concatenation (A) is unsafe. Client-side escaping (C) is
bypassable. ORM alone (D) doesn't cover all cases.
3 A transaction isolation level is set to READ COMMITTED. Under
concurrent access, which anomaly is still possible?
A) Dirty read
B) Non-repeatable read
C) Phantom read
D) Lost update
Answer: C
Rationale: READ COMMITTED prevents dirty reads but allows
non-repeatable reads and phantoms because locks are released after
each statement. Phantom reads (C) occur when a range query returns
different rows on re-execution. Dirty reads (A) are prevented;
non-repeatable reads (B) are possible, but the question asks which is
still possible-phantom is a classic example, and lost updates (D) can
also occur but are not the primary anomaly defined by isolation levels.
4 When scaling a read-heavy relational database, which strategy
provides the best balance between consistency and performance
without requiring application code changes?
A) Synchronous replication to a single standby
B) Asynchronous replication with read replicas and a load balancer
C) Sharding by user ID with cross-shard queries
,D) In-memory caching at the application layer
Answer: B
Rationale: Asynchronous replication to read replicas offloads
SELECTs with minimal code changes, offering near-real-time
consistency. Synchronous replication (A) reduces performance.
Sharding (C) requires code changes for cross-shard queries. Caching
(D) adds complexity and stale data risks.
5 In a RESTful API, which HTTP status code is most appropriate
when a client sends a request that violates a business rule but is
syntactically valid?
A) 400 Bad Request
B) 422 Unprocessable Entity
C) 409 Conflict
D) 403 Forbidden
Answer: A
Rationale: While 422 is used for semantic errors, many APIs use 400
for any client error. Given the options, 400 is the most universally
applicable. 409 (C) is for conflicts with resource state, 403 (D) is for
authorization failures.
6 Which statement accurately describes the trade-off between
optimistic and pessimistic concurrency control in a high-contention
environment?
A) Optimistic control reduces rollbacks in high-contention scenarios
B) Pessimistic control increases lock contention but minimizes
rollbacks
C) Optimistic control is best for write-heavy workloads with
frequent conflicts
D) Pessimistic control is preferred when reads vastly outnumber
writes
Answer: B
, Rationale: Pessimistic locking prevents conflicts by holding locks,
reducing rollbacks but increasing contention. Optimistic control (A,
C) performs poorly under high contention due to frequent rollbacks.
Pessimistic control (D) is not preferred for read-heavy workloads;
optimistic is.
7 A developer is designing a microservices architecture. Which data
management pattern ensures that services do not tightly couple to a
shared database schema?
A) Database per service
B) Shared database with a single schema
C) Saga pattern for distributed transactions
D) API gateway for aggregation
Answer: A
Rationale: Database per service gives each service its own schema,
enforcing boundaries and avoiding coupling. Shared database (B)
creates tight coupling. Saga (C) handles transactions, not schema
decoupling. API gateway (D) is for communication.
8 In a Node.js application using connection pooling, what is the
primary purpose of setting a low `connectionTimeoutMillis`?
A) To prevent idle connections from being closed
B) To fail fast when the database is unreachable
C) To reduce the number of connections created
D) To speed up query execution
Answer: B
Rationale: `connectionTimeoutMillis` defines how long to wait for a
connection before throwing an error, enabling fast failure when the
DB is down. It doesn't prevent idle closure (A), reduce connections
(C), or speed queries (D).
