CS Fundamentals quiz — 75 questions with answers and explanations

Answer: B

Average O(1), worst case O(n). A good hash function spreads keys evenly so each bucket holds only a few elements. When many keys collide into the same bucket, the operation degenerates into a linear scan of that bucket's list.

Answer: D

An array stores elements contiguously, so indexed access is O(1), but inserting/deleting in the middle requires shifting elements, so O(n). A linked list only needs to relink pointers for insert/delete — O(1) once you hold the pointer to the position — but accessing the k-th element must traverse from the head, so O(n).

Answer: C

The stack allocates by function call frame: entering a function pushes a frame, returning reclaims it automatically, and the cost is just moving a pointer. The heap allocates scattered blocks whose lifetime is decided by the programmer or the garbage collector, is slower, and can fragment. Local variables usually live on the stack; data that outlives the call lives on the heap.

Answer: A

A process owns its own address space and is isolated from others by the OS. A thread is a scheduling unit inside a process: threads share the heap, code, and file descriptors, with only their own stack and registers. Consequence: threads exchange data directly but need synchronization, while processes must go through IPC, but a fault in one process doesn't corrupt another.

Answer: C

When latency matters more than absolute integrity. TCP guarantees reliability and ordering by retransmitting lost packets, but that means one lost packet blocks the entire stream behind it. For voice, live video or games, data that arrives late has lost its value, so skipping a lost frame is better than waiting for it.

Answer: D

Because encryption is reversible. Anyone who gets the key — an attacker or an internal employee — can recover every password in plaintext. Hashing is one-way: the system only needs to hash what the user types and compare, never knowing the original value. You must use a password-specific hash function (bcrypt, scrypt, Argon2) with salt.

Answer: B

DNS resolution. Networks route by IP address, not by domain name, so the browser must ask a resolver to turn the domain into an IP first. Only then do the TCP handshake, TLS handshake, and the HTTP request follow.

Answer: D

Faster reads, slower writes, more storage. An index is a pre-sorted structure (usually a B-tree) that lets a query find rows without scanning the whole table. In exchange, every insert, update, or delete has to update both the table and every related index, and indexes take up extra disk and cache.

Answer: D

A class should have only one reason to change. Robert C. Martin later phrased it more precisely: a module should be responsible to only one group of users or one stakeholder. This is not the "a class does only one thing" rule in the sense of counting methods.

Answer: C

A stub returns canned answers so the test can run — it serves as input. A mock does more than answer: it records how it was called, and the test asserts on those interactions. In short: stubs verify state, mocks verify behavior.

Answer: C

DELETE /users/42. The core REST principle is that the path describes resources with nouns (usually plural), while the action is expressed by the HTTP method. Putting verbs in the path turns the API into a REST-flavoured RPC and loses the method's semantic guarantees.

Answer: B

To represent binary data using text characters, for channels that can only carry text such as email, JSON, or URLs. Base64 is not encryption: there is no key, anyone can decode it, and it also inflates the data by about 33%.

Answer: D

O(n²). The outer loop runs n times, each time performing all n steps of the inner loop, so the total number of operations is n × n. If the two loops are placed sequentially instead of nested, the cost is only n + n, i.e. O(n).

Answer: A

A stack is LIFO — the last element in is the first out, with operations at the same end. A queue is FIFO — first in first out, added at one end and removed at the other. Both have O(1) push and pop; the difference is in the removal order, not the cost.

Answer: D

A synchronous function blocks the calling thread until there's a result. An asynchronous function immediately returns an object representing the future result (promise, future, task), the calling thread continues, and the actual value is delivered once the task finishes. Asynchrony doesn't make the task faster, it just avoids wasting time waiting.

Answer: A

301 Moved Permanently. It tells the client and search engines that the URL has changed for good: ranking value is transferred to the new address and the browser caches it to go straight there next time. 302 means temporary, so search engines keep the old URL in the index.

Answer: A

Every user, process, or service is granted exactly the permissions needed to do its job, no more. The goal is to limit damage: when a component is compromised, the attacker only inherits that narrow scope rather than full system access.

Answer: C

A primary key is the row's official identity: it accepts no NULL and a table has exactly one. A unique constraint only guarantees no duplicate values, allows NULL (usually many NULLs), and a table can have as many unique constraints as it wants. Both are implemented with a unique index.

Answer: D

Because for reference types == compares addresses, not contents: it asks "do these two variables point to the same object?". Two separate objects live in different memory regions, so it always returns false. To compare contents you need equals, which compares field by field, or a deep comparison function.

Answer: B

daysUntilExpiry. A good name answers two questions right at the point of use: what this value is, and what its unit is. The other three names force the reader to trace back to the declaration to understand — a cost that repeats for every reader, forever after.

Answer: C

Build-generated files (node_modules, dist, target) and files containing secrets (.env, private keys, certificates). Build files can be regenerated, so they only bloat the repo and cause meaningless conflicts. Secrets are worse: once committed, they live in history forever and must be revoked rather than just deleted.

Answer: C

Because big-O notation describes the growth rate as n gets large, not the actual runtime. As n grows, the highest-order term dominates: at n = 1,000,000 the constant 100 is completely negligible. The point of the notation is comparing algorithms at scale, not predicting milliseconds.

Answer: B

To distinguish services on the same machine. The IP address delivers the packet to the right host, while the port number tells the OS which process to hand the packet to. That way one server can run web on port 443, database on 5432 and SSH on 22 at the same time on a single IP.

Answer: C

Because URLs leak in many places even when the connection is encrypted: server and proxy access logs, browser history, bookmarks, the Referer header sent to third-party pages, and analytics data. Sensitive data belongs in the body of a POST or in a header, never in the path.

Answer: A

Because of the information-theoretic lower bound. With n elements there are n! possible orderings; each comparison yields one bit of information, so it eliminates at most half the possibilities. At least log₂(n!) comparisons are needed, and by Stirling's approximation log₂(n!) = Θ(n log n).

Answer: B

A fixed-size min-heap of 10. Scan the stream once, comparing each number to the heap root (the smallest in the current top): skip if smaller, otherwise replace the root and rebalance. Time O(n log k), memory O(k) — no need to keep all the data.

Answer: A

Load factor = number of elements / number of buckets. It measures how full the table is. The higher the load factor, the greater the chance two keys land in the same bucket, the longer the collision chains, and the further lookups drift from O(1). Past a threshold (often 0.75), the implementation allocates a larger table and rehashes.

Answer: B

Java only has pass by value. When passing an object, what gets copied is the reference, not the object. So mutating the object's fields inside a method is visible outside, but assigning the parameter to a new object leaves the caller's variable pointing at the old object. The correct phrasing is "pass reference by value".

Answer: B

Because counter + 1 is not atomic but three operations: read, add, write. If thread B reads the value before thread A writes its result, both compute from the same old value and write the same result — one increment is lost. This is a lost-update race condition.

Answer: B

Enforce a global lock ordering. The four Coffman conditions are mutual exclusion, hold and wait, no preemption, and circular wait — breaking just one ends the deadlock. The easiest condition to break in application code is circular wait: if every thread acquires locks in the same order, a wait cycle cannot form.

Answer: B

403 Forbidden. Per RFC 9110, 401 means the request lacks valid authentication credentials — the server doesn't know who you are yet, and it must include a WWW-Authenticate header. 403 means the server knows who you are and still refuses. Logged in but lacking permission is exactly the second case.

Answer: B

HTTP/2 uses multiplexing: many request/response pairs run in parallel as streams over one TCP connection, removing the head-of-line blocking at HTTP/1.1's application layer. But all streams still share a single TCP connection, so one lost packet makes TCP hold back all the data behind it — head-of-line blocking moves down to the transport layer.

Answer: A

Because the length function counts code units, not visual characters. JavaScript and Java count UTF-16 code units, and emoji outside the BMP need two units (a surrogate pair). Also, a "family" emoji or skin-tone emoji is multiple code points joined by ZWJ or a modifier — it looks like one character but is really a whole cluster.

Answer: B

Because real numbers use the IEEE-754 standard, represented in base 2. In base 2, 0.1 and 0.2 are infinite repeating fractions, so they must be truncated and rounded when stored in 64 bits. The sum of the two rounded values comes out to 0.30000000000000004, which differs from the double closest to 0.3.

Answer: A

Idempotent means performing a request N times leaves the server state identical to performing it once. GET, PUT, DELETE are idempotent by spec; POST is not. This matters because the network is unreliable: when a response is lost, the client can only safely retry if the operation is idempotent.

Answer: C

Prepared statements with bound parameters. The database parses the statement structure first, then receives parameters as pure data — malicious strings never get a chance to be interpreted as syntax. Filtering characters or using keyword blocklists are supplementary measures with gaps; they don't replace parameterization.

Answer: C

Because of cost and feedback speed. Unit tests run in milliseconds, need no infrastructure, and when they fail they point straight at the broken function. E2e tests need the whole system running, take tens of seconds to minutes, are easily flaky due to network latency or timing, and when they go red you still have to investigate to find which layer broke.

Answer: C

CORS protects users and is enforced by the browser. It is a controlled relaxation of the same-origin policy: the browser still sends the request, but only lets JavaScript read the response if the server returns a matching Access-Control-Allow-Origin header. The server itself is not protected at all — curl can still call the API as usual.

Answer: A

XSS lets the attacker run JavaScript in the context of your page, so they can read the DOM, non-httpOnly cookies, and tokens in localStorage. CSRF cannot run any code — it just tricks the victim's browser into sending a request that already carries the login cookie, and the attacker cannot read the response.

Answer: C

Because a JWT is a stateless token. The server validates it by checking the signature and expiry inside the token itself, with no session table lookup. That is exactly the scalability benefit, but it also means there is no record to mark as "revoked" — the token stays valid until it expires.

Answer: D

Isolation guarantees that concurrently running transactions cannot observe each other's intermediate state. The guarantee is a spectrum rather than a single level: from Read Uncommitted to Serializable, each step eliminates another anomaly (dirty read, non-repeatable read, phantom read) at the cost of reduced concurrency.

Answer: B

It happens when you fetch a list of N records with one query, then loop over each record to run another query for its related data — N+1 calls in total. The fix is eager loading: a single JOIN, or a second query of the form WHERE id IN (...) that gathers all the related data in one round trip.

Answer: D

Because rebase rewrites history: each commit is replayed onto a new base, becoming a different commit with a different hash. Others still hold the old commit chain, so when you force push, their next pull mixes the two chains and produces duplicate commits or conflicts that are hard to resolve. Rule of thumb: rebase your own private branch, merge shared branches.

Answer: B

Coupling is the level of dependency between modules — low coupling means changing one module rarely forces changes in another. Cohesion is how tightly things are bound inside a module — high cohesion means everything in it serves one shared responsibility. The design goal is low coupling and high cohesion, and the two usually go together.

Answer: C

Renaming a field in the response. Clients reading user_name will get undefined and break silently. By contrast, adding an optional field to the response, adding a parameter with a default value, or adding a new endpoint are all backward compatible because old clients are not forced to know about them.

Answer: C

O(n). Each recursive call pushes a frame onto the stack, and a frame is only reclaimed when the call returns, so at the deepest point n frames exist simultaneously. The iterative version of the same algorithm uses only O(1) space.

Answer: C

A hash set. Membership check is O(1) on average because the hash function yields the position directly, independent of the number of elements. A plain array is O(n), and a sorted array with binary search is O(log n) — both lose when checks are frequent.

Answer: B

Store in UTC, convert to local time at the display layer. UTC is an absolute reference, unaffected by daylight saving time or timezone policy changes, so comparisons and sorting are always correct. In PostgreSQL use timestamptz; at the application layer, normalize right at the input and output boundary.

Answer: B

A shallow copy creates a new object but only copies the values at the outermost level; properties that are nested objects keep the old reference, so modifying them through the copy affects the original. A deep copy recursively duplicates the entire object tree, so the two are completely independent.

Answer: D

Because atomicity doesn't compose. The read is atomic, the write is atomic, but the gap between them isn't protected — another thread can read the same value and write first, causing your result to be overwritten. This is the check-then-act pattern and needs a compound atomic operation or a lock.

Answer: D

A hash map combined with a doubly linked list. The hash map maps keys to nodes for O(1) lookup. The doubly linked list keeps access order: on each use, the node is unlinked from its old position and inserted at the head, both O(1) thanks to pointers in both directions.

Answer: C

Because strings are immutable. Each concatenation doesn't modify the old string but creates a new one and copies all the content over. Concatenating n times means total copied volume of 1 + 2 + 3 + … + n, i.e. O(n²), and it also produces n intermediate strings that add pressure on the garbage collector.

Answer: B

Two reasons. First is cost: creating an OS thread takes time and about 1 MB of stack, while a pool reuses existing threads. Second, and more important, is load control: the pool caps the number of concurrent threads, so a sudden spike in requests just makes the queue longer instead of spawning ten thousand threads and crashing the process.

Answer: B

max-age specifies how long the cached copy stays fresh — during that window the browser reuses it without sending any request. ETag is a revalidation mechanism: once freshness expires, the browser sends If-None-Match, and if the content hasn't changed the server returns an empty 304. It saves bandwidth but still costs a round trip.

Answer: D

Because it's the target of password-guessing attacks. Without a limit, a script tries thousands of passwords per minute and only needs to hit one account. Abuse of other endpoints costs resources; abuse of the login endpoint costs accounts.

Answer: A

202 Accepted. It says the request is valid and has been received, but processing isn't done yet. It should come with a task identifier and a path for the client to check status, e.g. the header Location: /jobs/abc123. The client gets an immediate response instead of holding the connection open.

Answer: B

When you have measured and confirmed that JOIN cost is a real bottleneck, reads far outnumber writes, and you accept that duplicated data may drift apart briefly. Denormalization is a trade-off optimization, not a starting point for design.

Answer: D

It only proves that every line of code was executed at least once during the test run. It says nothing about whether the tests assert anything correctly. A test suite that calls every function and checks no results still reaches 100%.

Answer: C

Comments that explain WHY: why this approach was chosen, which constraint forced it, and that the more obvious approach was tried and how it broke. WHAT comments are redundant because the code already says it, and worse, they drift from the code after a few edits without anyone noticing.

Answer: D

Because small independent commits enable three things a large commit cannot: reviewing each change that has meaning on its own, reverting exactly the broken part without losing what works, and using git bisect to quickly pinpoint the offending commit. A commit mixing a feature, a refactor and a bug fix can no longer be split apart.

Answer: B

One test per scenario, with the test name clearly describing the input and the expected result, and the expected result written out explicitly rather than recomputed using the function's own logic. When a test fails, its name alone should tell you which branch broke.

Answer: C

Because you must answer two questions at once: where the source data changed, and which cached copies depend on it. Caches usually live in many layers — browser, CDN, application tier, database — controlled by different parties, so deleting too little leaves stale data while deleting too much throws away the whole benefit of caching.

Answer: D

The data must already be sorted, and the middle element must be reachable in O(1). Without the first condition, comparisons can't tell you which half to discard. Without the second — for example on a linked list — each step requires traversal to the middle, and the log n advantage disappears.

Answer: B

Because the cost of every operation is proportional to the tree height. A balanced tree has height O(log n), but inserting already-sorted data into a tree that doesn't self-balance leaves every node with only a right child, the tree degenerates into a linked list, and lookup becomes O(n).

Answer: B

Because a race condition only arises when there's a concurrent write with a read, or a concurrent write with a write. Immutable data is never written after initialization, so every thread always sees the same consistent value and no synchronization is needed.

Answer: B

Server-Sent Events. They're designed exactly for one-way streaming from server to client, they run over plain HTTP so they pass through existing proxies and infrastructure, and the browser reconnects automatically when the connection drops. WebSocket is more powerful but bidirectional, which is overkill here.

Answer: C

So builds are reproducible. A lock file pins the exact version of every dependency, including transitive ones, along with hashes to verify content. Without it, ^1.2.3 may resolve to 1.2.3 on your machine and 1.9.0 on CI, producing bugs that only show up in one place.

Answer: A

Because JSON.parse parses JSON numbers into IEEE-754 double Number by default, so it can only represent every integer exactly up to the safe range of 2^53 - 1 (about 9,007 trillion). 64-bit ids from a database typically exceed that threshold, and the value may be rounded to the nearest number — silently wrong, with no error thrown.

Answer: D

Three parts: a stable error code so the client can branch on it programmatically, a human-readable message, and per-field details when the error is caused by input data. Don't expose stack traces or internal details — those belong in server-side logs.

Answer: D

The WHERE deleted_at IS NULL condition becomes an implicit constraint every query must remember. Forget it in one place and deleted data shows up. On top of that, unique constraints no longer hold — a deleted email still occupies the slot so the user can't sign up again — and the table grows over time.

Answer: B

Because a test that has never failed hasn't been verified. It may be green for the wrong reason — asserting the wrong variable, a missing await, or never reaching the branch under test. Seeing it red for the right reason and then green is evidence that it's actually measuring what you want it to measure.

Answer: B

It reduces nesting. Instead of wrapping the main logic in multiple layers of if that check preconditions, invalid cases are handled and returned immediately at the top of the function. What remains is the main path, flat at the outermost indentation level and readable top to bottom.

Answer: A

Because of the generational hypothesis: most objects die young. Splitting the heap lets you collect frequently a small region holding new objects, where nearly everything is already dead and reclamation is cheap. The old region holds objects that survived multiple collections and is collected far less often, since its garbage ratio is low.

Answer: A

When there is a problem the system cannot handle on its own and human intervention is needed — lost database connection, corrupted data, a feature down. Invalid user input is a normal flow, not an ERROR. Logging ERROR for things that require no action trains the whole team to ignore alerts.

Answer: D

When it is a conscious choice rather than the result of carelessness: you know exactly what you are trading off, the decision and its rationale are recorded, and there is a concrete repayment plan. Debt taken on to reach a market validation in time is reasonable; debt that accumulates because nobody was paying attention is not a decision but an accident.