Web applications

1.Which HTTP method is defined as idempotent but not safe?

2.A bike-share app sends POST /rentals when a rider unlocks a bike. On a flaky cell connection the client times out and retries, and some riders get billed for two rentals. What is the best fix?

3.A clinic scheduler API receives a request whose access token expired an hour ago. Which status code fits best?

4.A grain co-op API needs an endpoint that lists the deliveries made by one member. Which design follows common REST conventions?

5.A JSON API for ferry ticketing creates a new booking from a POST. What response is most conventional on success?

6.A tenant maintenance portal sends PUT /tenants/7 with only a new phone number in the body. Afterward the tenant's email is null. What is the most likely explanation?

7.What does the Content-Type header on an HTTP request tell the server?

8.Which statement about 4xx and 5xx status codes is correct?

9.A recipe site had a Delete link on its admin page that sent GET /recipes/88/delete. A link-prefetching browser extension wiped out many recipes. What is the root problem?

10.A user submits a form on a county library site for the first time. Which order best describes the request's path?

11.After a deploy, a payroll service's load balancer returns 502 Bad Gateway on every request, and the app logs show no new entries at all. What is the most likely cause?

12.A grant report export in a nonprofit's admin tool fails with 504 Gateway Timeout after 60 seconds. The app logs show the same request finishing successfully at 75 seconds. What should you do?

13.The front end of a plant nursery shop shows 'Unexpected token < in JSON at position 0' when loading the cart. What is the most likely cause?

14.On a gym class booking app, the network tab shows the PATCH to update a booking returns 200 with the new time, but the screen still shows the old time. Where should you look first?

15.You need to trace one failed checkout for a coffee roaster's subscription service across the proxy, the app, and a background worker. What helps most?

16.Under load, a parking permit portal's requests hang and then fail. Database CPU is low, and the app logs say 'timed out waiting for a connection from the pool'. What is the most likely cause?

17.A single user of a music lesson scheduler reports that the Save button does nothing. Other users are fine. What do you do first?

18.Photo uploads to a print shop work on a developer's laptop but fail in production with 413 Payload Too Large. The app sets a 50 MB limit. What is the most likely cause?

19.A school lunch ordering page shows a spinner forever. The network tab shows the API request still pending after two minutes, with no status code. Which layer should you suspect first?

20.A hiking permit form checks the group size in the browser and blocks values over 12. Why must the server check it again?

21.What is the main benefit of client-side form validation?

22.Customers of a dog grooming booking site are sometimes charged twice after double-clicking Pay. What is the most robust fix?

23.After submitting a bakery preorder form, customers who refresh the confirmation page get a prompt to resubmit, and some create duplicate orders. Which pattern fixes this?

24.A wedding RSVP API returns 422 with a list of errors keyed by field name. How should the form handle this response?

25.A language exchange site checks whether a username is free with an API call, then submits the signup. Two people still ended up with the same username. What is the right fix?

26.A newsletter platform has subscribers '[email protected] ' and '[email protected]' as separate rows, despite a unique index on email. What should change?

27.A volunteer enters the name '<script>alert(1)</script>' on a food bank portal, and the script runs when staff view the volunteer list. What is the right fix?

28.What does the HttpOnly attribute on a session cookie do?

29.A museum membership site uses cookie sessions. How does setting SameSite=Lax on the session cookie help?

30.During a security review of a tutoring marketplace, you notice the session id stays the same before and after login. Why is that a problem?

31.A timesheet tool issues stateless JSON Web Tokens (JWTs) valid for 7 days. A manager disables a fired employee's account, but the employee can still use the API. Why?

32.A team wants to store the access token for its moving company quote app in localStorage. What is the main risk?

33.Why do single-page and mobile apps add PKCE (Proof Key for Code Exchange) to the OAuth authorization code flow?

34.How should a dental office's patient portal store user passwords?

35.A city council agenda site logs users in at auth.agendas.example and sets a session cookie with no Domain attribute. The editor at edit.agendas.example never sees the cookie. Why?

36.On an insurance claims portal, a logged-in customer changes /claims/1001 in the URL to /claims/1002 and sees another customer's claim. What is the fix?

37.A theater box office login form is being hit with thousands of password guesses per minute across many accounts. What is a sensible first defense?

38.What does CORS (cross-origin resource sharing) control?

39.A kayak rental's booking API works from curl and from a server script, but the React front end on a different origin gets a CORS error. What is the most likely cause?

40.A survey tool's front end sends a JSON POST to its API on another origin. The browser first sends OPTIONS, which returns 405, and the POST is never sent. What should you fix?

41.A chess club ratings site calls its API with fetch and credentials: 'include'. The API replies with Access-Control-Allow-Origin: *. The browser blocks the response. Why?

42.Which pair of URLs has the same origin?

43.To get past CORS errors quickly, a developer on a home inspection reports app makes the API echo back any Origin header and allow credentials. Why is this dangerous?

44.A vet clinic's single-page app and its API are run by the same team on different hosts. Which change removes the need for CORS?

45.What does Cache-Control: no-cache on a response mean?

46.After a deploy of a farm share box site, some users get a broken page: the new HTML loads, but app.js is the old version, cached for a week. What is the standard fix?

47.A flower delivery site put its account page behind a content delivery network (CDN). Users began seeing other people's names in the header. What is the most likely cause?

48.A browser holds a cached copy of a translation agency's rate sheet with an ETag. What happens when it revalidates and nothing has changed?

49.A hardware store caches product prices in Redis with a 10-minute time to live. When staff change a price, the site shows the old one for up to 10 minutes. What is the best fix?

50.A youth soccer league's schedule is cached for 5 minutes. Each time the entry expires, hundreds of requests miss at once and the database spikes. What helps most?

51.A tax prep site picks its page language from Accept-Language. After adding a content delivery network, some English speakers get Spanish pages. Which fix keeps the pages cacheable?

52.What does stale-while-revalidate=60 in a Cache-Control header allow?

53.Which response from a campground reservation site is the best candidate for caching at a shared content delivery network?

54.On an apartment listings site, users want to share a link to a search with filters applied and page 3 selected. Where should that state live?

55.A recycling pickup app marks a pickup as done in the UI before the server responds. The request then fails. What should the client do?

56.Two admins of a bowling league site edit the same team in different tabs. The second save silently overwrites the first admin's changes. What is a standard fix?

57.A conference talk search sends a request on each keystroke. Sometimes the results shown match an earlier, shorter query. What is the cause and fix?

58.A ski rental's checkout sends the cart total computed in the browser, and the server charges that amount. What is wrong with this design?

59.A coworking desk booking app caches API data on the client. After a user cancels a booking, the list still shows it until a manual reload. What is the usual fix?

60.Members of a makerspace check out tools through a web app. Where should the source of truth for which tools are available live?

61.What is a key benefit of server-side rendering for the public results page of a county election office?

62.A choir's sheet music library has pages that change only when an editor publishes new music, a few times a month. Which rendering approach fits best?

63.A React app for a laundromat shows hydration warnings, and the pickup time briefly flips to a different value. The server formats times in UTC. What is the likely cause?

64.What is a common drawback of rendering a public marketing page entirely on the client?

65.An art supply store's product pages get heavy traffic. Prices change a few times a day. Which approach balances speed and freshness?

66.Which rendering approach is a poor fit for a bus pass account dashboard that shows each rider's balance?

67.A developer on a pet adoption site reads a private API key inside a component, and the key now shows up in the browser's JavaScript bundle. What is the right fix?

68.You need to rename a column from fullname to display_name in a payroll database with no downtime during a rolling deploy. Which plan is safest?

69.A migration that adds an index to a large orders table blocks writes for 20 minutes during a deploy of a concert ticketing site. What would have avoided this?

70.A release for a blood drive signup site drops a column that the previous app version still reads. During the rolling deploy, errors spike. What is the right practice?

71.Why keep database migrations in the same repository as the app code?

72.In a bridal shop's order system, deleting a customer left order rows pointing to a customer id that no longer exists. What prevents this?

73.A clinic scheduler often runs: WHERE clinic_id = ? AND starts_at BETWEEN ? AND ? ORDER BY starts_at. Which index serves it best?

74.How should a municipal water billing app store amounts like 42.17 dollars?

75.A dental office stores appointment times as local time with no zone. After the clocks change for daylight saving, some reminders go out an hour off. What is the better design?

76.A deploy of a bike-share app ran a schema migration, then the new code had a bug and was rolled back. What practice makes this rollback safe?

77.A farmers market vendor page lists 50 vendors and their stall names. The logs show 51 SQL queries per page load. What is happening, and how do you fix it?

78.A GraphQL API for a used bookstore resolves each book's author separately, causing hundreds of queries per request. What is the standard fix?

79.A recipe site's listing uses LIMIT 20 OFFSET n. Page 1 is fast, but page 5,000 takes seconds. Why?

80.People scrolling a newest-first activity feed in a community garden app see the same post twice when new posts arrive. The feed uses offset pagination. What fixes this?

81.A keyset-paginated list of payments sorts by created_at and fetches the next page with WHERE created_at < last_seen. Some payments never appear. Why?

82.An admin list for a seed catalog shows 'Page 1 of 48,213'. The COUNT(*) behind it takes longer than the page query itself. What is a reasonable change?

83.A GET /members endpoint for a rowing club returns all 200,000 members when no page size is given. What should the endpoint do?

84.How can a team catch N+1 queries before they reach production?

85.A vet clinic list page loads 30 patient records, and each row includes a large scanned-document column the page never shows. What is the simplest improvement?

86.A real estate photo site lets agents upload 200 MB videos through the app server, which ties up its workers. What is a common better design?

87.A job board accepts resume uploads. How should it check that a file is really a PDF?

88.A community forum serves user-uploaded files from its main domain. Someone uploads an HTML file with a script that steals session data when opened. What is the right mitigation?

89.An upload handler for a translation agency saves files under the client-supplied filename. A file named '../../config/app.env' overwrote a config file. What is the fix?

90.A pet adoption site creates three thumbnail sizes inside the upload request, and large photos often time out. What is the better approach?

91.A rental listing form uploads photos as soon as they are picked, before the listing is saved. Storage costs keep rising. What is the likely cause?

92.A plain HTML form on a makerspace site posts a file input, but the server receives only the file's name. What is missing?

93.A survey tool sends a confirmation email inside the signup request, and the mail provider sometimes takes 8 seconds. What is the usual fix?

94.After a worker crashed and restarted, some parents in a youth soccer league got the same reminder email twice. The queue delivers at least once. What should the job do?

95.A coffee roaster's app enqueues a send-receipt job inside a database transaction. Sometimes the worker cannot find the order. Why?

96.A ferry ticketing job that calls a partner API fails now and then. One bad record makes its job fail every time. How should retries be set up?

97.A school district's report card export takes several minutes. How should the API respond to the request that starts it?

98.A nightly billing task for a municipal water app runs inside the web process. After scaling to three replicas, customers were billed three times. What is the fix?

99.A job for a moving company enqueues the full quote object. When the worker runs an hour later, it emails a price the customer already changed. What is a better practice?

100.The job queue for a print shop's order pipeline keeps growing all afternoon. What do you check first?

101.What do feature flags let a team do when shipping a new checkout flow?

102.A release adds a new endpoint and a front end that calls it. The front end deployed first, and users got 404s for ten minutes. What ordering avoids this?

103.What is the purpose of a canary release?

104.Right after a deploy, checkout errors on a ski rental site jump from 0.1 percent to 6 percent. What do you do first?

105.During a rolling deploy, new app instances get traffic before they can reach the database, and those requests fail. What should be fixed?

106.A change works in staging but crashes in production on the first request because an environment variable is missing. What practice catches this earlier?

107.A new mobile app version stops reading a field in an API response. When can the API safely stop sending that field?

108.A team ships a migration together with code. Which order is safest for an additive change, like a new nullable column that the new code writes to?