Unit 3: API Development and Server Actions - Practice Quiz
1 What is the main purpose of a route handler?
2 What does REST commonly describe in web development?
3 Which HTTP method is commonly used to retrieve data?
4 Which HTTP method is commonly used to create new data?
5 What does a dynamic route usually contain?
6
In a route such as /users/42, what might 42 represent?
7 What does a server receive from a client in a web request?
8 What does a server send back after processing a request?
9 Which status code usually means that a request succeeded?
10 What is a server action designed to do?
11 Which task is a suitable use for a server action?
12 What is the purpose of a form in a web application?
13 Which event commonly occurs when a user sends a form?
14 What is the main purpose of form validation?
15 Which input would usually fail validation for an email field?
16 Which HTML control is commonly used to select a file?
document
file
upload
image
17 Which object commonly represents an uploaded file in web APIs?
18 What is a data mutation?
19 What is an optimistic UI update?
20 What should an application do if an optimistic update fails on the server?
21
A route handler receives a POST /api/orders request containing JSON. Which sequence is most appropriate for creating the order?
GET response before saving the order
22
A route handler must return a JSON object containing { "status": "ok" }. Which response is most suitable?
404 status
200 status
201 status
204 status
23
Which endpoint design best follows REST conventions for retrieving one product with ID 42?
GET /api/products/42
GET /api/getProduct?id=42
POST /api/products/42
GET /api/product-action/42
24 A client requests a collection of published articles with pagination. Which design is most appropriate?
POST /api/articles/list/published/2
GET /api/articles?status=published&page=2
GET /api/fetchPublishedArticlesPageTwo
PUT /api/articles?status=published&page=2
25 A user changes the title of an existing article and sends the complete updated article representation. Which HTTP method is the best fit?
PATCH
DELETE
PUT
POST
26
Which status code best indicates that a new account was successfully created by a POST request?
204 No Content
202 Accepted
200 OK
201 Created
27
A dynamic route is defined as /api/users/[id]. A request arrives at /api/users/73. What should the handler use to identify the requested user?
73
id with value 73
user with value 73
id with value 73
28
A request to /api/posts/abc cannot find a post with ID abc. What should the dynamic route handler normally return?
201 Created response
302 Found response
204 No Content response
404 Not Found response
29 A client sends invalid JSON to an endpoint that expects a JSON body. How should the handler respond?
400 Bad Request response
200 OK response with empty data
30 An API endpoint returns a list of users but must prevent browsers and intermediaries from reusing stale data. Which response behavior is most relevant?
POST instead of GET
31 A form invokes a server action that inserts a record into a database. Which security practice is still required?
32 After a server action updates a product name, the page still displays the old cached product data. What is the most appropriate follow-up?
33 A form submits a username and a profile image to a server action. Which encoding is needed to transmit both fields correctly?
multipart/form-data
application/json only
application/x-url-path
text/plain only
34 A form should show a pending indicator while its server action is running and then disable the submit button. What is the best approach?
35 A registration form checks that an email is present in the browser. Why must the server repeat this validation?
36 A form requires a product quantity to be an integer from 1 through 10. Which server-side rule correctly enforces this requirement?
37 An upload endpoint accepts profile images. Which validation combination provides the strongest basic protection?
38
A user uploads a file named ../../avatar.png. What is the safest storage behavior?
39 A delete operation is requested for an invoice that does not exist. Which behavior is generally most useful for an idempotent API?
201 Created for every delete request
40 Two users edit the same document. Which technique best helps prevent one update from silently overwriting a newer update?
41
A Next.js App Router project contains app/reports/page.tsx. A developer adds app/reports/route.ts to expose a JSON endpoint at /reports, and the build reports a route conflict. Which change correctly resolves the conflict while preserving both interfaces?
page.tsx alongside the page's default export
app/reports/handler.ts and keep the /reports URL
app/reports/api/route.ts and expose it at /reports/api
Accept header
42
An API paginates orders sorted by createdAt DESC. New orders may share timestamps and may be inserted while clients paginate. Which cursor design most reliably prevents skipped or duplicated records?
createdAt timestamp of the final returned order
createdAt and the unique order ID
43 A client times out after sending a payment-creation request and cannot determine whether the server committed it. Which API design best permits a safe retry without creating a second payment?
GET with the payment fields encoded as query parameters
POST repeatedly and compare payment timestamps afterward
POST with an idempotency key stored under a unique constraint
PATCH because all partial updates are inherently idempotent
44
A handler is defined at app/api/docs/[[...slug]]/route.ts. Assuming the route parameters have been resolved, what values should it expect for requests to /api/docs and /api/docs/guides/install?
slug is [] first and "guides/install" second
slug is ["docs"] first and ["docs", "guides", "install"] second
slug is undefined first and ["guides", "install"] second
slug is "docs" first and ["guides", "install"] second
45
A Route Handler must verify an HMAC over the exact raw request body and then parse the same body as JSON. Which approach is valid with the Fetch Request API?
request.text() and then call request.json() on the same request
request.bodyUsed, reset it to false, and then parse the body again
46 A Route Handler must set two cookies with different attributes in one response. Which implementation preserves both cookies correctly?
Set-Cookie header
NextResponse.cookies.set once for each cookie before returning
headers.set("Set-Cookie", ...) twice on one Headers object
47
A Server Action called by an authenticated page receives accountId from submitted form data and deletes that account. What security check is essential inside the action?
accountId
48
A Server Action has the signature updateUser(userId, formData). Which expression correctly supplies userId while allowing <form action={...}> to provide the submitted FormData?
const action = updateUser.bind(null, formData, userId) so the browser can replace the bound FormData during submission
const action = updateUser.bind(null, userId)
const action = () => updateUser(formData, userId)
const action = updateUser.bind(formData, userId)
49 A registration form performs schema validation in the browser. The associated Server Action writes directly to the database without validating again. Which revision provides the correct trust boundary and supports field-level errors?
FormData with the schema in the action and return structured field errors
50
A Route Handler accepts multi-gigabyte uploads, but await request.formData() followed by await file.arrayBuffer() exhausts memory. Which architecture best addresses the problem?
Content-Length completely and buffer the body only when that header claims the file is within the configured limit
51 An endpoint transfers credits by decrementing one balance, incrementing another, and inserting a ledger entry. Which implementation preserves consistency when a database operation fails halfway through?
Promise.all
52 A user renames the same item twice before the first mutation finishes. The first request fails after the second optimistic rename has been displayed. What rollback strategy avoids overwriting the newer state?
53
A browser sends a cross-origin PUT request with Content-Type: application/json and an Authorization header. The API's PUT handler is correct, but the browser never sends the actual request. What is the most likely missing behavior?
OPTIONS handler returning the required CORS allow headers
GET handler redirecting the browser to the canonical API URL
HEAD handler returning the same body as the PUT handler
PUT request into a same-origin form submission
54
A POST /exports request starts a long-running export and returns before processing is complete. Which response most accurately represents the REST semantics?
204 No Content with a Retry-After request header
304 Not Modified with the identifier of the queued operation
201 Created with the completed export file in the body
202 Accepted with a location for checking job status
55 Two administrators retrieve version 7 of a document. One updates it to version 8; the other then submits changes based on version 7. Which HTTP mechanism best prevents the second update from silently overwriting the first?
Cache-Control: no-store and return 409 for every update
If-None-Match with * and return 304 on mismatch
Last-Modified in the request body and return 202 on mismatch
If-Match with the version 7 ETag and return 412 on mismatch
56
A multi-tenant handler uses /api/tenants/[tenantId]/invoices/[invoiceId]. The session proves the user belongs to tenant A, but the URL specifies tenant B. What should the handler do before retrieving the invoice?
B
invoiceId alone because invoice identifiers are globally unique
B because dynamic parameters are generated by the framework router
B with tenant A and continue without reporting it
57
A successful DELETE operation has no representation to return. Which response is valid according to HTTP semantics?
200 while declaring a nonzero body length but sending no body
204 with no response body
204 with a JSON confirmation body
304 with an empty response body
58
A Server Action wraps its mutation and redirect("/dashboard") inside a broad try...catch. Successful submissions unexpectedly return the generic error state instead of navigating. What is the correct fix?
finally so it executes after both success and failure
redirect with revalidatePath inside the catch block
redirect after the try...catch once the mutation succeeds
59 A client optimistically inserts comments using temporary IDs. The server returns the persisted comment with a canonical ID and normalized text. What is the correct reconciliation behavior?
60
An upload endpoint stores files using the client-provided File.name under a public directory. Which design best mitigates path traversal, collisions, and misleading file-type metadata?
../ once from the filename and trust the remaining extension
Did this save you a night before the exam?
LPU Notes is free, and it stays free. Ads cover part of the server bill. The rest comes out of a student's own pocket: the domain, the storage, and keeping the site up through the weeks everyone needs it at once.
The payment button didn't load. An ad blocker or a filtered network is the usual reason. to try again.
Nothing here is ever locked, and nothing unlocks. Chip in only if it was worth it. What it pays for →