Examius

🌍 Mobile App Development · subject

Mobile App Development Backend Integration and Data Syllabus

The Backend Integration and Data syllabus for Mobile App Development in full: 5 chapters and 17 topics, every one listed below, plus 51 Backend Integration and Data flashcards with answers.

5Chapters
17Topics
51Flashcards

Backend Integration and Data syllabus: all 5 chapters

Expand any chapter to see its topics and sub-topics.

  1. Consuming REST APIs

     4 topics
    • HTTP Methods and Status Codes
    • Request and Response Modeling
    • Pagination and Caching
    • Error Handling and Retries

  2. GraphQL and Realtime

     3 topics
    • GraphQL Queries and Mutations
    • WebSockets and Subscriptions
    • Realtime Databases

  3. Authentication and Authorization

     4 topics
    • OAuth 2.0 and OpenID Connect
    • JWT and Token Management
    • Biometric Authentication
    • Social Sign-In

  4. Backend-as-a-Service

     3 topics
    • Firebase (Auth, Firestore, Storage)
    • Supabase and Appwrite
    • Cloud Functions

  5. Local and Sync Strategies

     3 topics
    • SQLite and ORMs
    • Conflict Resolution and Sync
    • Secure Local Storage

Mobile App Development Backend Integration and Data flashcards — 51 questions with answers

  1. Which HTTP method is idempotent and safe, retrieving a resource without modifying server state?

    GET. It is both safe (no side effects) and idempotent (repeating it yields the same result).

  2. Contrast the HTTP methods PUT and PATCH.

    PUT replaces an entire resource and is idempotent. PATCH applies a partial modification to a resource and is not guaranteed to be idempotent.

  3. What do the HTTP status code classes 2xx, 3xx, 4xx, and 5xx each signify?

    2xx = success, 3xx = redirection, 4xx = client error, 5xx = server error.

  4. What is the difference between HTTP status codes 401 and 403?

    401 Unauthorized means authentication is missing or invalid (not logged in). 403 Forbidden means the user is authenticated but lacks permission for the resource.

  5. Which HTTP status code indicates a resource was created successfully, and which indicates a request was accepted for asynchronous processing?

    201 Created for successful creation; 202 Accepted for a request accepted but not yet processed.

  6. What does HTTP status 429 mean and which header typically accompanies it?

    429 Too Many Requests indicates rate limiting; the Retry-After header tells the client how long to wait before retrying.

  7. In REST request/response modeling, what is the purpose of a DTO (Data Transfer Object)?

    A DTO is a plain object that carries data between client and server, decoupling the API's wire format from internal domain models and controlling which fields are exposed.

  8. What Content-Type header value is used for JSON request and response bodies?

    application/json

  9. What is the difference between offset-based and cursor-based pagination?

    Offset pagination uses limit and offset (or page number) to skip rows; it is simple but slow on large offsets and unstable if data changes. Cursor pagination uses an opaque pointer (e.g., last item's id/timestamp) for stable, efficient forward paging.

  10. For a page size $s$ and 1-indexed page number $p$ in offset pagination, what SQL OFFSET value is used?

    $\text{offset} = (p - 1) \times s$

  11. What do the HTTP caching headers Cache-Control: max-age and ETag each control?

    max-age sets how long (in seconds) a response is considered fresh. ETag is a validator token used with If-None-Match for conditional requests, letting the server return 304 Not Modified if unchanged.

  12. What HTTP status code does a server return for a successful conditional GET when the cached copy is still valid?

    304 Not Modified (the body is omitted and the cached copy is reused).

  13. Distinguish a strong ETag from a weak ETag.

    A strong ETag guarantees byte-for-byte identical content. A weak ETag (prefixed W/) indicates semantic equivalence, allowing minor differences that are still considered the same for caching.

  14. What is exponential backoff in the context of retrying failed requests?

    A retry strategy where the wait time grows exponentially with each attempt, typically $t = b \times 2^{n}$ for base delay $b$ and retry number $n$, reducing load on a struggling server.

  15. Why is jitter added to exponential backoff retry delays?

    Jitter adds randomness to the delay so that many clients retrying simultaneously do not synchronize and cause a thundering-herd spike; it spreads retries out over time.

  16. Which HTTP status codes are generally safe to retry, and which are generally not?

    Safe to retry: transient 5xx (500, 502, 503, 504) and 429. Not safe to retry blindly: most 4xx (e.g., 400, 401, 403, 404) since retrying won't change the result.

  17. What is an idempotency key and why is it used in retryable POST requests?

    A unique client-generated key sent with a request so the server can detect and deduplicate retries of the same operation, preventing duplicate side effects (e.g., double charges).

  18. What is the difference between a GraphQL query and a mutation?

    A query reads data (read-only, side-effect free). A mutation writes/changes data on the server and returns the updated result.

  19. How many endpoints does a typical GraphQL API expose, and how does that differ from REST?

    GraphQL typically exposes a single endpoint (e.g., /graphql) where clients specify exactly what data they need. REST exposes many endpoints, one per resource/action.

  20. What GraphQL problems do over-fetching and under-fetching refer to, and how does GraphQL address them?

    Over-fetching = getting more fields than needed; under-fetching = needing multiple round trips to gather data. GraphQL lets the client request exactly the fields it needs in one request, solving both.

Show the other 31 Backend Integration and Data flashcards

  1. What is a GraphQL subscription used for?

    Subscriptions provide real-time updates: the server pushes data to the client whenever a subscribed event occurs, typically over a WebSocket connection.

  2. What is the WebSocket handshake and which HTTP mechanism initiates it?

    A WebSocket connection starts as an HTTP request with an Upgrade: websocket header; the server responds with 101 Switching Protocols, then the connection becomes a persistent, full-duplex TCP channel.

  3. How do WebSockets differ from HTTP polling for real-time data?

    HTTP polling repeatedly opens requests to check for updates (higher latency and overhead). WebSockets keep one persistent, bidirectional connection so the server can push data instantly without repeated requests.

  4. What is the difference between WebSockets and Server-Sent Events (SSE)?

    WebSockets are full-duplex (both directions) over a single TCP connection. SSE is unidirectional (server-to-client only) over HTTP, is simpler, and auto-reconnects, but cannot send client-to-server messages on the same channel.

  5. What defines a realtime database compared to a traditional request/response database?

    A realtime database pushes data changes to subscribed clients automatically as they happen (via listeners/subscriptions), rather than requiring clients to poll or re-query for updates.

  6. In OAuth 2.0, what is the difference between the Authorization Server and the Resource Server?

    The Authorization Server authenticates the user and issues access tokens. The Resource Server hosts the protected resources and accepts valid access tokens to grant access.

  7. Which OAuth 2.0 grant flow is recommended for mobile and native apps, and what security extension does it require?

    The Authorization Code flow, extended with PKCE (Proof Key for Code Exchange), which protects against authorization-code interception on public clients.

  8. How does PKCE protect the OAuth 2.0 authorization code flow?

    The client generates a random code_verifier and sends its hashed code_challenge when requesting the code; at token exchange it sends the original verifier, so an attacker who steals the code cannot redeem it without the verifier.

  9. What is the relationship between OpenID Connect (OIDC) and OAuth 2.0?

    OIDC is an identity layer built on top of OAuth 2.0. OAuth 2.0 handles authorization (access to resources); OIDC adds authentication (verifying who the user is) via an ID token.

  10. What is an OIDC ID token and what format does it use?

    An ID token is a JWT issued by the identity provider that contains claims about the authenticated user (e.g., sub, name, email) and proves the user's identity to the client.

  11. What are the three parts of a JWT and how are they separated?

    Header, Payload, and Signature, encoded in Base64URL and separated by dots: header.payload.signature.

  12. Is the payload of a standard signed JWT encrypted? Explain.

    No. A standard (JWS) JWT payload is only Base64URL-encoded, not encrypted, so anyone can read it. The signature only guarantees integrity/authenticity, not confidentiality. Use JWE to encrypt.

  13. What is the difference between an access token and a refresh token?

    An access token is short-lived and sent with each API request to authorize access. A refresh token is long-lived, stored securely, and used to obtain new access tokens without re-authenticating.

  14. Name three commonly validated JWT claims and their meaning.

    exp (expiration time), iat (issued-at time), and iss (issuer). Others include sub (subject/user id) and aud (audience).

  15. What is the difference between symmetric (HS256) and asymmetric (RS256) JWT signing?

    HS256 uses a single shared secret for both signing and verification. RS256 uses a private key to sign and a public key to verify, so verifiers never need the signing secret.

  16. On mobile, what does biometric authentication actually protect, given the biometric data never leaves the device?

    It gates access to a secret or key stored in the device's secure hardware (e.g., Keychain/Keystore). The biometric match unlocks local credentials; the biometric template itself stays in the secure enclave and is never transmitted.

  17. Why is biometric authentication considered a possession/inherence factor rather than a replacement for server-side auth?

    Biometrics authenticate the user locally to the device and unlock stored tokens/keys, but the server still relies on those cryptographic credentials; biometrics alone don't prove identity to a remote server.

  18. What is social sign-in and what underlying protocol usually powers it?

    Social sign-in lets users authenticate using an existing account (Google, Apple, Facebook), typically implemented with OAuth 2.0 / OpenID Connect, avoiding a separate password for your app.

  19. Why does Apple require 'Sign in with Apple' in certain apps offering social sign-in?

    App Store guidelines require offering Sign in with Apple as an option whenever an app exclusively uses third-party or social login services, giving users a privacy-focused alternative.

  20. What three core services do 'Firebase Auth, Firestore, and Storage' provide respectively?

    Auth = user authentication/identity. Firestore = a NoSQL realtime document database. Storage = cloud object storage for user files like images and videos.

  21. How is data organized in Cloud Firestore?

    As collections containing documents; documents hold key-value fields and can contain subcollections, forming a hierarchical, schemaless document model.

  22. What are Firebase Security Rules used for?

    They declaratively control read/write access to Firestore, Realtime Database, and Storage on the server side based on authentication state, request data, and existing document data.

  23. What is Supabase and what database engine underlies it?

    Supabase is an open-source Firebase alternative (Backend-as-a-Service) built on PostgreSQL, providing auth, realtime subscriptions, storage, and auto-generated REST/GraphQL APIs.

  24. How does Appwrite differ from Supabase in database model and hosting philosophy?

    Appwrite is a self-hostable, Docker-based open-source BaaS with its own document-style database and built-in functions/storage/auth. Supabase is PostgreSQL-centric (relational, SQL) and is offered both hosted and self-hosted.

  25. What are Cloud Functions and what execution model do they follow?

    Cloud Functions are serverless, event-driven functions that run backend code in response to triggers (HTTP requests, database changes, auth events) without managing servers; they auto-scale and you pay per invocation.

  26. What is a 'cold start' in serverless Cloud Functions?

    The latency incurred when a function is invoked after being idle and the platform must spin up a new execution instance/container before running your code, versus a faster 'warm' reused instance.

  27. What is an ORM and what core problem does it solve?

    An Object-Relational Mapper maps database tables/rows to objects/classes in code, solving the object-relational impedance mismatch so developers query and persist data using objects instead of raw SQL.

  28. Why is SQLite well-suited for mobile local storage?

    SQLite is a serverless, zero-configuration, self-contained embedded relational database stored in a single file, requiring no separate process, making it ideal for on-device persistence.

  29. What is Last-Write-Wins (LWW) conflict resolution and its main drawback?

    When two edits conflict during sync, the write with the latest timestamp overwrites the other. Its drawback is silent data loss of the discarded edit and sensitivity to clock skew across devices.

  30. What are CRDTs and why are they useful for offline sync and conflict resolution?

    Conflict-free Replicated Data Types are data structures that can be updated independently on multiple devices and merged automatically without conflicts, guaranteeing all replicas converge to the same state regardless of update order.

  31. Which secure storage mechanisms should hold tokens and secrets on iOS versus Android, and why not use plain local storage?

    iOS Keychain and Android Keystore (via encrypted storage). They store secrets in hardware-backed, encrypted form; plain local storage / SharedPreferences / UserDefaults are unencrypted and easily readable if the device is compromised.

Mobile App Development Backend Integration and Data FAQ

What is in the Mobile App Development Backend Integration and Data syllabus?

Mobile App Development Backend Integration and Data is split into 5 chapters: Consuming REST APIs, GraphQL and Realtime, Authentication and Authorization, Backend-as-a-Service and Local and Sync Strategies. Together they contain 17 topics.

How many chapters are in Mobile App Development Backend Integration and Data?

5 chapters, containing 17 topics. The largest chapter is Consuming REST APIs, with 4 topics.

Are there flashcards for Mobile App Development Backend Integration and Data?

Yes — a 51-card Backend Integration and Data deck, printed in full in the flashcards section of this page and available in the Examius app with spaced repetition. The free plan covers one exam of your choice, including its flashcards; Examius Pro, a one-time purchase, unlocks every other exam and deck.