3.4 — Exercise Questions: Express.js

Practice questions for all six subtopics in Section 3.4. Short-answer, prediction, and coding tasks. Try each without reopening the lesson files first.

How to use this material (instructions)

1. Read lessons in order — README.md, then 3.4.a -> 3.4.f.
2. Answer closed-book first — write bullets or a few lines, then compare to the lesson.
3. Type code in a real project — create a small Express app and test your answers with curl or Postman.
4. Interview prep — pair with 3.4-Interview-Questions.md.
5. Quick review — 3.4-Quick-Revision.md.

---

3.4.a — What is Express.js? (Q1–Q8)

Q1. In one sentence, what is Express.js?

Q2. Name four things Express provides that the raw http module does not.

Q3. What does it mean that Express is "unopinionated"? Give one advantage and one disadvantage.

Q4. True or false: Express replaces Node's http module. Explain.

Q5. What is the middleware pattern in Express? Write the function signature.

Q6. Name two scenarios where you might choose Fastify over Express.

Q7. Name two scenarios where you might choose NestJS over Express.

Q8. What is the biggest change coming in Express 5.x regarding error handling?

---

3.4.b — Setting Up Express Server (Q9–Q20)

Q9. Write a minimal Express server (5 lines) that responds with "Hello" on GET /.

Q10. What does const app = express() return? What type is it?

Q11. What does app.listen() return, and why might you store it in a variable?

Q12. Why should you write process.env.PORT || 3000 instead of hardcoding 3000?

Q13. What is the purpose of the dotenv package? Where should you call require('dotenv').config()?

Q14. Why is it a best practice to separate app.js (Express config) from server.js (listen)?

Q15. What is the difference between res.send('Hello') and res.json({ message: 'Hello' })?

Q16. What Content-Type does res.send({ a: 1 }) set?

Q17. What happens if you call res.send() twice in the same route handler?

Q18. Write a 404 catch-all middleware. Where must it be placed relative to your routes?

Q19. How many parameters does an Express error-handling middleware have? What are they?

Q20. What does nodemon do, and how do you add it to a project?

---

3.4.c — Returning Responses (Q21–Q32)

Q21. What Content-Type does res.send('<h1>Hi</h1>') set? What about res.send({ x: 1 })?

Q22. Why should APIs prefer res.json() over res.send() for sending objects?

Q23. What does res.status(201).json({ id: 1 }) do? Break it into two steps.

Q24. What does res.sendStatus(204) do? What is the response body?

Q25. What is the difference between a 301 and 302 redirect? When would you use each?

Q26. What does res.download(filePath) do differently from res.sendFile(filePath)?

Q27. Write a route that sets a custom header X-Request-Id and returns JSON.

Q28. Write a route that sets an HTTP-only, secure cookie named session with value abc123.

Q29. What npm package do you need to read cookies from incoming requests?

Q30. Why should you disable the X-Powered-By header in production?

Q31. Design a consistent API response format for both success and error cases. Show JSON examples.

Q32. Write a helper function sendSuccess(res, data, statusCode) that wraps your response format.

---

3.4.d — Query Parameters and URL Parameters (Q33–Q42)

Q33. Given the route /users/:id, what does req.params contain for GET /users/42?

Q34. Given /users/:userId/posts/:postId, what does req.params contain for GET /users/5/posts/99?

Q35. What does the ? in /api/report/:format? do?

Q36. Given GET /search?q=express&page=2, what does req.query contain?

Q37. Are req.params and req.query values strings or numbers? Why does this matter?

Q38. When should you use route params vs query params? Give three examples of each.

Q39. Write a route that supports pagination with ?page= and ?limit= query parameters, with defaults of page 1 and limit 10.

Q40. Write a route /users/:id that validates the ID is a positive integer and returns 400 if not.

Q41. What does the wildcard route /api/* match? What is req.params[0]?

Q42. Why should wildcard routes be placed after specific routes?

---

3.4.e — HTTP Methods and Request Body (Q43–Q56)

Q43. List the five main HTTP methods and what CRUD operation each maps to.

Q44. Which HTTP methods are idempotent? Which are not?

Q45. What is the difference between PUT and PATCH? Give a concrete example.

Q46. What middleware must you add before your routes to parse JSON request bodies?

Q47. What does express.urlencoded({ extended: true }) parse? What is extended for?

Q48. After adding express.json(), what type are the values in req.body for a JSON payload?

Q49. Write a complete POST route for /api/todos that validates title exists in the body and returns 201 with the created todo.

Q50. Write a PATCH route for /api/todos/:id that only updates fields present in req.body.

Q51. What is the difference between app.all('/path', handler) and app.use('/path', handler)?

Q52. Why must you return after res.status(400).json(...) in a route handler?

Q53. What does req.headers['authorization'] return? Why is the key lowercase?

Q54. Name four properties on req besides params, query, and body.

Q55. Hands-on: Build a complete CRUD API for a "task" resource with the following endpoints:

• POST /api/tasks — create
• GET /api/tasks — list all
• GET /api/tasks/:id — get one
• PUT /api/tasks/:id — replace
• PATCH /api/tasks/:id — partial update
• DELETE /api/tasks/:id — remove

Q56. Test your CRUD API from Q55 using curl commands. Write the command for each operation.

---

3.4.f — Serving Static Files (Q57–Q66)

Q57. What does app.use(express.static('public')) do?

Q58. If public/ contains styles.css, what URL serves that file?

Q59. What does app.use('/assets', express.static('public')) change about the URL?

Q60. Why should you use path.join(__dirname, 'public') instead of just 'public'?

Q61. If you have two static middleware lines, which directory is checked first?

Q62. What is the maxAge option for, and what value would you set for cache-busted (hashed) assets?

Q63. What does the dotfiles: 'deny' option do? Why is it the default?

Q64. Describe the SPA fallback pattern. Why does the wildcard route go after API routes and static middleware?

Q65. What is the fallthrough option? What happens when it is false and a file is not found?

Q66. Hands-on: Set up an Express server that:

• Serves static files from a public/ folder
• Has one API route at GET /api/data that returns JSON
• Falls back to index.html for all other GET requests
• Test by accessing /, /about, /api/data, and /styles.css

---

Cross-topic challenges (Q67–Q72)

Q67. Explain the full lifecycle of a request: client sends POST /api/users with JSON body → Express processes → response sent. Name every step.

Q68. What is the difference between req.url, req.path, and req.originalUrl?

Q69. Write a route that combines route params and query params: GET /api/teams/:teamId/members?role=admin&page=1.

Q70. A developer writes app.get('/api/*', ...) before app.get('/api/users', ...). What happens when GET /api/users is called? How do you fix it?

Q71. You see Error: Can't set headers after they are sent to the client. What causes this? How do you prevent it?

Q72. Design the URL structure for a blog API: list posts, get single post, list comments on a post, search posts by tag, paginate results. Specify params vs query for each.

---

Answer hints

Q	Hint
Q4	False — Express wraps the http module, does not replace it
Q5	(req, res, next) => { ... }
Q8	Rejected promises auto-forwarded to error handler
Q16	application/json
Q17	Error: "Can't set headers after they are sent"
Q19	4 — (err, req, res, next)
Q24	Status 204, body is the string "No Content"
Q37	Always strings — causes bugs with === against numeric database IDs
Q44	GET, PUT, DELETE, PATCH = idempotent; POST = not idempotent
Q48	Preserves JSON types (numbers, arrays, booleans) unlike params/query
Q51	app.all = exact path; app.use = prefix match
Q60	Relative paths resolve from cwd, not from the file location
Q65	fallthrough: false returns 404 immediately instead of calling next()

---

<- Back to 3.4 — Express.js (README)