Level 4 exam — Node.js

Exam — fresh questions

12 questions to validate the level: REST API and CRUD, authentication and security, real-time Socket.IO, validation, errors and tests.
Answer everything, then click Check: your score and explanations will appear.

4.1 · Recall

1. In a REST API, what carries the action (create, read, delete)?

The URL, with a verb (/getProduits, /supprimerProduit) The status code returned by the server A comment in the source code The HTTP method (GET, POST, PUT, DELETE) on a resource URL

URL = plural resource; the action comes from the HTTP method.

4.2 · Recall

2. How to store a user password correctly?

By hashing it with bcrypt (one-way, salted), never storing it plain In a text file next to the code Plain in the database, to recover it easily With homemade reversible encryption

Compare at login without ever decrypting; never homemade.

4.3 · Recall

3. What does a WebSocket allow compared to classic HTTP?

A persistent bidirectional connection where the server pushes instantly Prettier HTML pages Faster file storage Longer requests to write

Connection continuously open, messages in both directions.

4.1 · Application

4. Salim creates a product via POST /api/v1/produits. Which codes does the front end expect?

No code, the body is enough 201 if created, 400 if the body is invalid 200 in all cases, including on error 302 then 418 in all cases

201 after creation, 400 if invalid, 404 if resource missing.

4.1 · Application

5. Salim's API grows: where to place the product-creation logic?

In the JSON response itself In the front-end HTML file In the controller, the route delegating via express.Router() In bulk in app.js with everything else

Routes (URLs) → controllers (logic) → models (data).

4.2 · Application

6. A request arrives without a token on /mon-compte (Salim's protected route). Response?

Redirect to a video 401 (missing/invalid token), via the verification middleware 200 with the data anyway 500 without explanation

401 = unauthenticated; 403 = authenticated but not allowed.

4.3 · Application

7. Salim wants a chat per shop. How to isolate conversations?

Send messages by e-mail Poll the API every 100 ms from each client Broadcast each message to all connected clients without distinction Create one room per shop (socket.join) and broadcast with io.to(boutique)

Rooms: who joins what, broadcast at the right scope.

4.4 · Application

8. A client sends { prix: -5 } without a name to Salim's API. What to do?

Validate with the schema (Zod/Joi) and reject with 400 and a clear message Return the full stack trace to the client Store as is, we'll see later Crash the server to raise the alarm

Validate before processing; clear 400, never a sensitive leak.

4.4 · Application

9. Where to place Salim's Express error-handling middleware?

In the client's browser None needed, try/catch everywhere is enough Last, after the routes, with 4 parameters (err, req, res, next) First, before express.json()

Centralised last: a single error format for the whole API.

4.2 · Arbitration

10. Salim finds his JWT secret hardcoded in a commit pushed to Git. First reflex?

Copy it into the README too, to find it again Remove Helmet to compensate Leave it, nobody looks at repositories Move it to an environment variable (ignored .env), regenerate the secret and revoke the old one

Secret outside code and outside Git; immediate rotation after exposure.

4.3 · Arbitration

11. 40 sellers poll the API “anything new?” every second and the server saturates. Salim's call?

Poll even more often to be more real-time Open WebSockets (Socket.IO): the server pushes when there is something new Stop all real-time features for good Return empty 200 to relieve the server

Push via an open connection instead of re-asking in a loop.

4.4 · Arbitration

12. On the eve of a release, Salim hesitates to write tests (“it already works”). What to decide?

Test nothing and ship fast, we'll test after the incident Test by hand once, without automating anything At minimum write tests on critical routes (400 + success) and re-run them on each change Remove validation to save time

Non-regression: the green suite before each merge frees up changes.

What's next?

Score ≥ 80%: move on to Level 5 — professional Node.js (TypeScript, performance, Docker, deployment) and industrialise your APIs.
Score 50-79%: revisit the failed sections (CRUD 4.1, auth 4.2, real time 4.3, hardening 4.4), re-read the explanations above, then retake the test.
Score < 50%: restart the level from 4.1, coding each template (router, auth, chat, tests), then retry the exam with a fresh mind.