IT 260 Web-Oriented Services Midterm Exam Practice
Questions and Detailed Solutions Latest Update 2026/2027 |
HTTP Protocols, API Development, Verified Answers - 160
Questions
This midterm examination assesses mastery of advanced concepts in web-oriented services, emphasizing deep
understanding of HTTP semantics, RESTful API design, security mechanisms, and modern API development
practices. Candidates are expected to synthesize knowledge across multiple domains, evaluate trade-offs, and
apply principles to novel scenarios. It contains 160 multiple-choice questions, each with four distractors and a
fully worked rationale that explains why the keyed answer is correct. Questions are organized into clearly labelled
sections that mirror the major content areas of the course. Targeted learning outcomes include: Analyze and
interpret HTTP request/response semantics, including caching, conditional requests, and content negotiation.;
Design and evaluate RESTful APIs with proper resource modeling, status code usage, and versioning strategies.;
Implement and critique security mechanisms such as OAuth 2.0, JWT, and CORS in distributed systems.; Apply
performance optimization techniques including caching strategies, pagination, and compression.. Every item has
been reviewed for clinical accuracy, current guidelines, and clarity so that students can study with confidence and
self-correct as they work through the bank. Use it as a high-yield review immediately before the exam, or as a
structured practice tool during the unit - the rationales double as concise teaching notes. The recommended
writing time is 3 hours, with a passing score of 70%. Aligned with Aligned with ACM/IEEE Computer Science
curricula and ABET accreditation standards for computing programs. standards and reflects the question style
Section 1: General (Questions 1-160)
1 A client sends a GET request with an If-None-Match header. The
server responds with 304 Not Modified. Which statement about the
response body and cache behavior is correct?
A) The response includes a new representation body to update the
cache.
B) The response has no body, and the client should use its cached
copy.
C) The response must include a new ETag to replace the old one.
D) The server is indicating that the resource has been permanently
moved.
Answer: B
Rationale: A 304 Not Modified response indicates that the resource has
not changed since the last request; hence, it contains no body, and the
client can continue using its cached representation. The ETag remains
valid and does not need replacement. This status is not a redirect
(301/302).
,2 In designing a RESTful API for a library system, which resource
modeling approach best adheres to REST constraints while
supporting complex queries?
A) POST /books/search with a JSON body containing query filters.
B) GET /books?author=...&published_after=...&sort=title
C) GET /books/search?query=...
D) POST /books/query with action parameter.
Answer: B
Rationale: RESTful design emphasizes using query parameters on the
resource collection endpoint (GET /books) for filtering, sorting, and
pagination. This keeps the resource model clean and leverages HTTP
semantics. Using POST for search or adding /search endpoints are
common anti-patterns that obscure the resource-oriented nature of the
API.
3 An API returns a collection of items with pagination. Which HTTP
header is most appropriate for conveying the total number of items?
A) Content-Range
B) X-Total-Count
C) Link
D) Accept-Ranges
Answer: A
Rationale: The Content-Range header is used to indicate the total
number of items in a collection when returning partial content (e.g.,
with Range requests). It follows the format 'items 0-9/100'.
X-Total-Count is a custom header, not standardized. Link provides
navigation URLs, and Accept-Ranges indicates partial content
support.
4 Which OAuth 2.0 grant type is most appropriate for a
server-to-server integration where the client acts on its own behalf,
without user involvement?
A) Authorization Code
,B) Implicit
C) Client Credentials
D) Resource Owner Password Credentials
Answer: C
Rationale: The Client Credentials grant is designed for
machine-to-machine communication where the client (application) is
the resource owner. It requires only client ID and secret. Authorization
Code is for user delegation, Implicit is deprecated for SPAs, and
Resource Owner Password is discouraged for security reasons.
5 A developer is designing a public API and wants to support
versioning. Which strategy provides the most explicit versioning
without breaking existing clients?
A) URL path versioning: /v1/books
B) Query parameter versioning: /books?version=1
C) Custom header versioning: X-API-Version: 1
D) Media type versioning: Accept: application/vnd.books.v1+json
Answer: D
Rationale: Media type versioning (content negotiation) is considered
the most explicit and flexible, as it keeps the URI stable and allows
multiple representations of the same resource. URL path versioning is
common but can lead to URI proliferation. Query parameter and
custom header versioning are less transparent and can be overlooked.
6 Which HTTP status code is most appropriate for a request that is
syntactically correct but semantically invalid (e.g., a booking
request for a past date)?
A) 400 Bad Request
B) 422 Unprocessable Entity
C) 409 Conflict
D) 403 Forbidden
Answer: B
, Rationale: 422 Unprocessable Entity is used when the server
understands the request but cannot process it due to semantic errors,
such as business rule violations. 400 is for malformed syntax, 409 is
for conflicts with current state, and 403 indicates lack of permission.
7 A REST API uses JWT for authentication. Which claim is used to
specify the token's expiration time?
A) nbf
B) iat
C) exp
D) aud
Answer: C
Rationale: The 'exp' (expiration time) claim identifies the time after
which the JWT must not be accepted. 'nbf' is not before, 'iat' is issued
at, and 'aud' is audience. Proper validation of 'exp' is crucial to prevent
token replay.
8 A web application makes cross-origin requests to an API. Which
response header is required to allow a specific origin to access the
resource?
A) Access-Control-Allow-Origin
B) Access-Control-Allow-Methods
C) Access-Control-Allow-Headers
D) Access-Control-Max-Age
Answer: A
Rationale: Access-Control-Allow-Origin is the header that specifies
which origins are permitted to access the resource. The other headers
control allowed methods, headers, and preflight caching, but without
the origin header, the browser will block the response.
9 Which HTTP caching directive instructs caches to revalidate the
response with the origin server before serving a cached copy?
A) no-store
Questions and Detailed Solutions Latest Update 2026/2027 |
HTTP Protocols, API Development, Verified Answers - 160
Questions
This midterm examination assesses mastery of advanced concepts in web-oriented services, emphasizing deep
understanding of HTTP semantics, RESTful API design, security mechanisms, and modern API development
practices. Candidates are expected to synthesize knowledge across multiple domains, evaluate trade-offs, and
apply principles to novel scenarios. It contains 160 multiple-choice questions, each with four distractors and a
fully worked rationale that explains why the keyed answer is correct. Questions are organized into clearly labelled
sections that mirror the major content areas of the course. Targeted learning outcomes include: Analyze and
interpret HTTP request/response semantics, including caching, conditional requests, and content negotiation.;
Design and evaluate RESTful APIs with proper resource modeling, status code usage, and versioning strategies.;
Implement and critique security mechanisms such as OAuth 2.0, JWT, and CORS in distributed systems.; Apply
performance optimization techniques including caching strategies, pagination, and compression.. Every item has
been reviewed for clinical accuracy, current guidelines, and clarity so that students can study with confidence and
self-correct as they work through the bank. Use it as a high-yield review immediately before the exam, or as a
structured practice tool during the unit - the rationales double as concise teaching notes. The recommended
writing time is 3 hours, with a passing score of 70%. Aligned with Aligned with ACM/IEEE Computer Science
curricula and ABET accreditation standards for computing programs. standards and reflects the question style
Section 1: General (Questions 1-160)
1 A client sends a GET request with an If-None-Match header. The
server responds with 304 Not Modified. Which statement about the
response body and cache behavior is correct?
A) The response includes a new representation body to update the
cache.
B) The response has no body, and the client should use its cached
copy.
C) The response must include a new ETag to replace the old one.
D) The server is indicating that the resource has been permanently
moved.
Answer: B
Rationale: A 304 Not Modified response indicates that the resource has
not changed since the last request; hence, it contains no body, and the
client can continue using its cached representation. The ETag remains
valid and does not need replacement. This status is not a redirect
(301/302).
,2 In designing a RESTful API for a library system, which resource
modeling approach best adheres to REST constraints while
supporting complex queries?
A) POST /books/search with a JSON body containing query filters.
B) GET /books?author=...&published_after=...&sort=title
C) GET /books/search?query=...
D) POST /books/query with action parameter.
Answer: B
Rationale: RESTful design emphasizes using query parameters on the
resource collection endpoint (GET /books) for filtering, sorting, and
pagination. This keeps the resource model clean and leverages HTTP
semantics. Using POST for search or adding /search endpoints are
common anti-patterns that obscure the resource-oriented nature of the
API.
3 An API returns a collection of items with pagination. Which HTTP
header is most appropriate for conveying the total number of items?
A) Content-Range
B) X-Total-Count
C) Link
D) Accept-Ranges
Answer: A
Rationale: The Content-Range header is used to indicate the total
number of items in a collection when returning partial content (e.g.,
with Range requests). It follows the format 'items 0-9/100'.
X-Total-Count is a custom header, not standardized. Link provides
navigation URLs, and Accept-Ranges indicates partial content
support.
4 Which OAuth 2.0 grant type is most appropriate for a
server-to-server integration where the client acts on its own behalf,
without user involvement?
A) Authorization Code
,B) Implicit
C) Client Credentials
D) Resource Owner Password Credentials
Answer: C
Rationale: The Client Credentials grant is designed for
machine-to-machine communication where the client (application) is
the resource owner. It requires only client ID and secret. Authorization
Code is for user delegation, Implicit is deprecated for SPAs, and
Resource Owner Password is discouraged for security reasons.
5 A developer is designing a public API and wants to support
versioning. Which strategy provides the most explicit versioning
without breaking existing clients?
A) URL path versioning: /v1/books
B) Query parameter versioning: /books?version=1
C) Custom header versioning: X-API-Version: 1
D) Media type versioning: Accept: application/vnd.books.v1+json
Answer: D
Rationale: Media type versioning (content negotiation) is considered
the most explicit and flexible, as it keeps the URI stable and allows
multiple representations of the same resource. URL path versioning is
common but can lead to URI proliferation. Query parameter and
custom header versioning are less transparent and can be overlooked.
6 Which HTTP status code is most appropriate for a request that is
syntactically correct but semantically invalid (e.g., a booking
request for a past date)?
A) 400 Bad Request
B) 422 Unprocessable Entity
C) 409 Conflict
D) 403 Forbidden
Answer: B
, Rationale: 422 Unprocessable Entity is used when the server
understands the request but cannot process it due to semantic errors,
such as business rule violations. 400 is for malformed syntax, 409 is
for conflicts with current state, and 403 indicates lack of permission.
7 A REST API uses JWT for authentication. Which claim is used to
specify the token's expiration time?
A) nbf
B) iat
C) exp
D) aud
Answer: C
Rationale: The 'exp' (expiration time) claim identifies the time after
which the JWT must not be accepted. 'nbf' is not before, 'iat' is issued
at, and 'aud' is audience. Proper validation of 'exp' is crucial to prevent
token replay.
8 A web application makes cross-origin requests to an API. Which
response header is required to allow a specific origin to access the
resource?
A) Access-Control-Allow-Origin
B) Access-Control-Allow-Methods
C) Access-Control-Allow-Headers
D) Access-Control-Max-Age
Answer: A
Rationale: Access-Control-Allow-Origin is the header that specifies
which origins are permitted to access the resource. The other headers
control allowed methods, headers, and preflight caching, but without
the origin header, the browser will block the response.
9 Which HTTP caching directive instructs caches to revalidate the
response with the origin server before serving a cached copy?
A) no-store
