HTTP interview questions — Medium
408 medium-level HTTP questions from our API Testing bank, each with the correct answer and an explanation of why it is correct.
What this covers
HTTP appears throughout API Testing interviews. At medium level, interviewers are typically checking that you have used it in practice: what you configured, what broke, and how you knew it worked. Work through these, then explain your answer out loud; the second part is what interviews actually test.
20 example questions
1. On a release readiness call: Which status family indicates a client error?
- A. 2xx.
- B. 4xx.correct
- C. 3xx.
- D. 5xx.
Why: 4xx are client errors; 5xx server errors, 2xx success, 3xx redirect.
2. "Asks the server which methods/headers are permitted" — in HTTP, this describes which of the following?
- A. Path parameter.
- B. 405 Method Not Allowed.
- C. Accept header.
- D. OPTIONS method.correct
Why: OPTIONS method: Asks the server which methods/headers are permitted.
3. "Variable segment inside the URL path identifying a resource" — in HTTP, this describes which of the following?
- A. OPTIONS method.
- B. ETag.
- C. Query parameter.
- D. Path parameter.correct
Why: path parameter: Variable segment inside the URL path identifying a resource.
4. "Response identifier enabling conditional requests and caching" — in HTTP, this describes which of the following?
- A. Accept header.
- B. 302 Found.
- C. ETag.correct
- D. OPTIONS method.
Why: ETag: Response identifier enabling conditional requests and caching.
5. "Cached response is still valid; no body returned" — in HTTP, this describes which of the following?
- A. 304 Not Modified.correct
- B. 502 Bad Gateway.
- C. 302 Found.
- D. 415 Unsupported Media Type.
Why: 304 Not Modified: Cached response is still valid; no body returned.
6. "Upstream server returned an invalid response to a gateway" — in HTTP, this describes which of the following?
- A. 302 Found.
- B. 304 Not Modified.
- C. 502 Bad Gateway.correct
- D. Query parameter.
Why: 502 Bad Gateway: Upstream server returned an invalid response to a gateway.
7. "Server rejects the request body's content type" — in HTTP, this describes which of the following?
- A. 415 Unsupported Media Type.correct
- B. Path parameter.
- C. 502 Bad Gateway.
- D. 405 Method Not Allowed.
Why: 415 Unsupported Media Type: Server rejects the request body's content type.
8. "Request conflicts with current resource state" — in HTTP, this describes which of the following?
- A. OPTIONS method.
- B. Query parameter.
- C. 409 Conflict.correct
- D. CORS.
Why: 409 Conflict: Request conflicts with current resource state.
9. Which statement correctly describes HTTP?
- A. Status 201 means the request was rejected by the server.
- B. The Content-Type header specifies the client's preferred language.
- C. Status 403 Forbidden means the authenticated client lacks permission for the resource.correct
- D. Status 401 means the user is authenticated but lacks permission.
Why: 403 is an authorization failure, not an authentication failure.
10. Which of the following statements about HTTP is TRUE?
- A. Status 401 means the user is authenticated but lacks permission.
- B. Status 500 indicates the client sent invalid JSON.
- C. Idempotency keys let clients safely retry POST requests without duplicating effects.correct
- D. GET requests are designed to modify server state.
Why: Servers deduplicate requests carrying the same idempotency key.
11. Identify the accurate statement about HTTP:
- A. POST is not idempotent: repeating it may create multiple resources.correct
- B. Status 201 means the request was rejected by the server.
- C. POST is guaranteed idempotent by the HTTP specification.
- D. PATCH always replaces the entire resource representation.
Why: Duplicate POSTs can create duplicates unless idempotency keys are used.
12. "Temporary redirect to another URI" — in HTTP, this describes which of the following?
- A. 502 Bad Gateway.
- B. 302 Found.correct
- C. OPTIONS method.
- D. Accept header.
Why: 302 Found: Temporary redirect to another URI.
13. "Key-value data appended to the URL after ?" — in HTTP, this describes which of the following?
- A. 502 Bad Gateway.
- B. Query parameter.correct
- C. Accept header.
- D. 304 Not Modified.
Why: query parameter: Key-value data appended to the URL after ?.
14. "Browser mechanism controlling cross-origin API access" — in HTTP, this describes which of the following?
- A. 302 Found.
- B. 409 Conflict.
- C. CORS.correct
- D. Path parameter.
Why: CORS: Browser mechanism controlling cross-origin API access.
15. While onboarding a junior QA, you explain: 201 Created is typically returned by which method?
- A. GET.
- B. POST creating a resource.correct
- C. DELETE.
- D. HEAD.
Why: A successful resource-creating POST commonly returns 201.
16. In a CI/CD pipeline review, consider this: Which method is idempotent and used to replace a resource?
- A. POST.
- B. PUT.correct
- C. PATCH.
- D. CONNECT.
Why: PUT replaces a resource and is idempotent.
17. In HTTP, which of the following is described as: "Upstream server returned an invalid response to a gateway"?
- A. 502 Bad Gateway.correct
- B. ETag.
- C. OPTIONS method.
- D. 409 Conflict.
Why: 502 Bad Gateway: Upstream server returned an invalid response to a gateway.
18. In HTTP, which of the following is described as: "Asks the server which methods/headers are permitted"?
- A. 502 Bad Gateway.
- B. CORS.
- C. OPTIONS method.correct
- D. 304 Not Modified.
Why: OPTIONS method: Asks the server which methods/headers are permitted.
19. Which HTTP concept matches this description: "Server rejects the request body's content type"?
- A. CORS.
- B. 409 Conflict.
- C. Query parameter.
- D. 415 Unsupported Media Type.correct
Why: 415 Unsupported Media Type: Server rejects the request body's content type.
20. In the context of HTTP, which of the following is a correct statement?
- A. Status 429 indicates a server-side crash.
- B. POST is not idempotent: repeating it may create multiple resources.correct
- C. GET requests are designed to modify server state.
- D. Status 403 means the resource was moved permanently.
Why: Duplicate POSTs can create duplicates unless idempotency keys are used.