Mobile App Development Backend Integration and Data Syllabus

Backend Integration and Data syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Backend Integration and Data in Mobile App Development, not a summary of it.

1. 1

   Consuming REST APIs

   4 topics

   • HTTP Methods and Status Codes
   • Request and Response Modeling
   • Pagination and Caching
   • Error Handling and Retries
2. 2

   GraphQL and Realtime

   3 topics

   • GraphQL Queries and Mutations
   • WebSockets and Subscriptions
   • Realtime Databases
3. 3

   Authentication and Authorization

   4 topics

   • OAuth 2.0 and OpenID Connect
   • JWT and Token Management
   • Biometric Authentication
   • Social Sign-In
4. 4

   Backend-as-a-Service

   3 topics

   • Firebase (Auth, Firestore, Storage)
   • Supabase and Appwrite
   • Cloud Functions
5. 5

   Local and Sync Strategies

   3 topics

   • SQLite and ORMs
   • Conflict Resolution and Sync
   • Secure Local Storage

Backend Integration and Data flashcards for Mobile App Development

25 of 51 cards from the Backend Integration and Data deck — real questions with worked answers.

1. Which HTTP method is idempotent and safe, retrieving a resource without modifying server state?

   GET. It is both safe (no side effects) and idempotent (repeating it yields the same result).

2. Contrast the HTTP methods PUT and PATCH.

   PUT replaces an entire resource and is idempotent. PATCH applies a partial modification to a resource and is not guaranteed to be idempotent.

3. What do the HTTP status code classes 2xx, 3xx, 4xx, and 5xx each signify?

   2xx = success, 3xx = redirection, 4xx = client error, 5xx = server error.

4. What is the difference between HTTP status codes 401 and 403?

   401 Unauthorized means authentication is missing or invalid (not logged in). 403 Forbidden means the user is authenticated but lacks permission for the resource.

5. Which HTTP status code indicates a resource was created successfully, and which indicates a request was accepted for asynchronous processing?

   201 Created for successful creation; 202 Accepted for a request accepted but not yet processed.

6. What does HTTP status 429 mean and which header typically accompanies it?

   429 Too Many Requests indicates rate limiting; the Retry-After header tells the client how long to wait before retrying.

7. In REST request/response modeling, what is the purpose of a DTO (Data Transfer Object)?

   A DTO is a plain object that carries data between client and server, decoupling the API's wire format from internal domain models and controlling which fields are exposed.

8. What Content-Type header value is used for JSON request and response bodies?

   application/json

9. What is the difference between offset-based and cursor-based pagination?

   Offset pagination uses limit and offset (or page number) to skip rows; it is simple but slow on large offsets and unstable if data changes. Cursor pagination uses an opaque pointer (e.g., last item's id/timestamp) for stable, efficient forward paging.

10. For a page size $s$ and 1-indexed page number $p$ in offset pagination, what SQL OFFSET value is used?

    $\text{offset} = (p - 1) \times s$

11. What do the HTTP caching headers Cache-Control: max-age and ETag each control?

    max-age sets how long (in seconds) a response is considered fresh. ETag is a validator token used with If-None-Match for conditional requests, letting the server return 304 Not Modified if unchanged.

12. What HTTP status code does a server return for a successful conditional GET when the cached copy is still valid?

    304 Not Modified (the body is omitted and the cached copy is reused).

13. Distinguish a strong ETag from a weak ETag.

    A strong ETag guarantees byte-for-byte identical content. A weak ETag (prefixed W/) indicates semantic equivalence, allowing minor differences that are still considered the same for caching.

14. What is exponential backoff in the context of retrying failed requests?

    A retry strategy where the wait time grows exponentially with each attempt, typically $t = b \times 2^{n}$ for base delay $b$ and retry number $n$, reducing load on a struggling server.

15. Why is jitter added to exponential backoff retry delays?

    Jitter adds randomness to the delay so that many clients retrying simultaneously do not synchronize and cause a thundering-herd spike; it spreads retries out over time.

16. Which HTTP status codes are generally safe to retry, and which are generally not?

    Safe to retry: transient 5xx (500, 502, 503, 504) and 429. Not safe to retry blindly: most 4xx (e.g., 400, 401, 403, 404) since retrying won't change the result.

17. What is an idempotency key and why is it used in retryable POST requests?

    A unique client-generated key sent with a request so the server can detect and deduplicate retries of the same operation, preventing duplicate side effects (e.g., double charges).

18. What is the difference between a GraphQL query and a mutation?

    A query reads data (read-only, side-effect free). A mutation writes/changes data on the server and returns the updated result.

19. How many endpoints does a typical GraphQL API expose, and how does that differ from REST?

    GraphQL typically exposes a single endpoint (e.g., /graphql) where clients specify exactly what data they need. REST exposes many endpoints, one per resource/action.

20. What GraphQL problems do over-fetching and under-fetching refer to, and how does GraphQL address them?

    Over-fetching = getting more fields than needed; under-fetching = needing multiple round trips to gather data. GraphQL lets the client request exactly the fields it needs in one request, solving both.

21. What is a GraphQL subscription used for?

    Subscriptions provide real-time updates: the server pushes data to the client whenever a subscribed event occurs, typically over a WebSocket connection.

22. What is the WebSocket handshake and which HTTP mechanism initiates it?

    A WebSocket connection starts as an HTTP request with an Upgrade: websocket header; the server responds with 101 Switching Protocols, then the connection becomes a persistent, full-duplex TCP channel.

23. How do WebSockets differ from HTTP polling for real-time data?

    HTTP polling repeatedly opens requests to check for updates (higher latency and overhead). WebSockets keep one persistent, bidirectional connection so the server can push data instantly without repeated requests.

24. What is the difference between WebSockets and Server-Sent Events (SSE)?

    WebSockets are full-duplex (both directions) over a single TCP connection. SSE is unidirectional (server-to-client only) over HTTP, is simpler, and auto-reconnects, but cannot send client-to-server messages on the same channel.

25. What defines a realtime database compared to a traditional request/response database?

    A realtime database pushes data changes to subscribed clients automatically as they happen (via listeners/subscriptions), rather than requiring clients to poll or re-query for updates.

See more Backend Integration and Data flashcards →

Planning Backend Integration and Data for Mobile App Development

Backend Integration and Data (Mobile App Development) FAQ