HTTP interview questions — Hard
209 hard-level HTTP questions from our API Testing bank, each with the correct answer and an explanation of why it is correct.
What this covers
HTTP appears throughout API Testing interviews. At hard level, interviewers are typically checking depth under pressure — edge cases, failure modes, performance characteristics, and the trade-offs you accepted. Work through these, then explain your answer out loud; the second part is what interviews actually test.
7 example questions
1. On a release readiness call: Which status family indicates a client error?
- A. 2xx.
- B. 3xx.
- C. 5xx.
- D. 4xx.correct
Why: 4xx are client errors; 5xx server errors, 2xx success, 3xx redirect.
2. Which of the following statements about HTTP is FALSE?
- A. The Authorization header carries credentials such as Bearer tokens.
- B. HTTPS encrypts HTTP traffic using TLS.
- C. Status 401 means the user is authenticated but lacks permission.correct
- D. Status 400 Bad Request means the client sent a malformed or invalid request.
Why: The selected statement is false. The other options are accurate statements about HTTP.
3. Which statement about HTTP is NOT correct?
- A. HTTPS is identical to HTTP with no encryption involved.correct
- B. Status 201 Created indicates a resource was successfully created, typically after POST.
- C. GET requests should be safe and idempotent, retrieving data without side effects.
- D. Status 400 Bad Request means the client sent a malformed or invalid request.
Why: The selected statement is false. The other options are accurate statements about HTTP.
4. Identify the INCORRECT statement about HTTP:
- A. Status 401 Unauthorized means authentication is missing or invalid.
- B. Status 429 indicates a server-side crash.correct
- C. HTTP status code 200 means the request succeeded.
- D. Status 201 Created indicates a resource was successfully created, typically after POST.
Why: The selected statement is false. The other options are accurate statements about HTTP.
5. While onboarding a junior QA, you explain: Which method is idempotent and used to replace a resource?
- A. POST.
- B. PUT.correct
- C. PATCH.
- D. CONNECT.
Why: PUT replaces a resource and is idempotent.
6. Regarding HTTP, which of the following is a false statement?
- A. Status 503 Service Unavailable means the server is temporarily unable to handle requests.
- B. POST is guaranteed idempotent by the HTTP specification.correct
- C. PUT is idempotent: sending the same request multiple times yields the same result.
- D. The Content-Type header declares the media type of the request or response body.
Why: The selected statement is false. The other options are accurate statements about HTTP.
7. In a QA certification mock exam: 201 Created is typically returned by which method?
- A. GET.
- B. POST creating a resource.correct
- C. DELETE.
- D. HEAD.
Why: A successful resource-creating POST commonly returns 201.