Debugging is the process of locating, understanding, and correcting errors in code.
Incorrect! Try again.
2What does a breakpoint do during debugging?
Debugging Techniques
Easy
A.Reloads the web page
B.Uploads files to GitHub
C.Pauses code execution
D.Deletes unused code
Correct Answer: Pauses code execution
Explanation:
A breakpoint pauses execution at a selected line so that the program state can be inspected.
Incorrect! Try again.
3Which browser developer tool displays messages produced by console.log()?
Browser Developer Tools
Easy
A.Network panel
B.Elements panel
C.Console panel
D.Storage panel
Correct Answer: Console panel
Explanation:
The Console panel displays logged messages, warnings, and JavaScript errors.
Incorrect! Try again.
4Which browser developer tool is commonly used to inspect HTML elements and CSS styles?
Browser Developer Tools
Easy
A.Sources panel
B.Elements panel
C.Performance panel
D.Network panel
Correct Answer: Elements panel
Explanation:
The Elements panel lets developers inspect and temporarily modify a page's HTML and CSS.
Incorrect! Try again.
5Which JavaScript statement is used to handle an exception?
Error Handling
Easy
A.for...of
B.try...catch
C.if...else
D.switch...case
Correct Answer: try...catch
Explanation:
A try...catch statement runs code in try and handles thrown exceptions in catch.
Incorrect! Try again.
6What is the purpose of the finally block in JavaScript error handling?
Error Handling
Easy
A.Stops the browser process
B.Runs code after handling
C.Creates a new exception
D.Repeats the failed operation
Correct Answer: Runs code after handling
Explanation:
The finally block runs after try and catch, whether or not an exception occurs.
Incorrect! Try again.
7Which JavaScript method attaches an event handler to an HTML element?
Interactive User Interface Development
Easy
A.createElement()
B.querySelector()
C.addEventListener()
D.getAttribute()
Correct Answer: addEventListener()
Explanation:
addEventListener() connects an event, such as a click, to a function that responds to it.
Incorrect! Try again.
8Which event usually occurs when a user presses and releases a mouse button on an element?
Interactive User Interface Development
Easy
A.load
B.resize
C.submit
D.click
Correct Answer: click
Explanation:
The click event is triggered when a user clicks an interactive page element.
Incorrect! Try again.
9Where does client-side JavaScript normally execute?
Client-Side Application Design
Easy
A.In a DNS server
B.In the user's browser
C.In a mail server
D.In a database server
Correct Answer: In the user's browser
Explanation:
Client-side JavaScript runs in the user's web browser and controls page behavior.
Incorrect! Try again.
10What is the DOM in a client-side web application?
Client-Side Application Design
Easy
A.A page object structure
B.A repository access setting
C.A server storage format
D.A network security rule
Correct Answer: A page object structure
Explanation:
The Document Object Model represents a web page as objects that JavaScript can access and modify.
Incorrect! Try again.
11Why are functions used to organize JavaScript code?
Code Organization
Easy
A.To configure network routers
B.To increase image dimensions
C.To purchase domain names
D.To group reusable instructions
Correct Answer: To group reusable instructions
Explanation:
Functions group related instructions into reusable units, making code easier to understand and maintain.
Incorrect! Try again.
12What is a common benefit of placing CSS in a separate stylesheet?
Code Organization
Easy
A.Built-in user authentication
B.Improved style maintainability
C.Automatic database creation
D.Faster domain registration
Correct Answer: Improved style maintainability
Explanation:
A separate stylesheet keeps presentation rules organized and allows multiple pages to reuse them.
Incorrect! Try again.
13Which action commonly reduces the loading time of a web page?
Website Performance Fundamentals
Easy
A.Adding duplicate scripts
B.Increasing file sizes
C.Compressing large images
D.Using more redirects
Correct Answer: Compressing large images
Explanation:
Image compression reduces the amount of data that the browser must download.
Incorrect! Try again.
14What is browser caching used for?
Website Performance Fundamentals
Easy
A.Deleting every page request
B.Reusing downloaded resources
C.Blocking every network response
D.Renaming all source files
Correct Answer: Reusing downloaded resources
Explanation:
Browser caching stores resources locally so they may not need to be downloaded again.
Incorrect! Try again.
15What is a GitHub repository primarily used to store?
GitHub Repository Management
Easy
A.Project files and history
B.Domain records and routes
C.Monitor settings and drivers
D.Browser cookies and sessions
Correct Answer: Project files and history
Explanation:
A GitHub repository stores project files along with their Git version history.
Incorrect! Try again.
16What does a Git commit represent?
GitHub Repository Management
Easy
A.A purchased web domain
B.A saved project snapshot
C.A running browser process
D.A deleted user account
Correct Answer: A saved project snapshot
Explanation:
A commit records a snapshot of tracked changes in a Git project's history.
Incorrect! Try again.
17What type of website is GitHub Pages commonly used to host?
Website Hosting using GitHub Pages
Easy
A.Database server
B.Email service
C.Desktop application
D.Static website
Correct Answer: Static website
Explanation:
GitHub Pages publishes static HTML, CSS, and JavaScript files from a repository.
Incorrect! Try again.
18Which file commonly serves as the home page of a GitHub Pages site?
Website Hosting using GitHub Pages
Easy
A.index.html
B.package.json
C..gitignore
D.README.md
Correct Answer: index.html
Explanation:
index.html is commonly loaded as the default home page of a static website.
Incorrect! Try again.
19Why should an image include meaningful alternative text?
Web Development Best Practices
Easy
A.To improve accessibility
B.To configure web hosting
C.To execute JavaScript code
D.To create a repository
Correct Answer: To improve accessibility
Explanation:
Alternative text helps screen-reader users understand the purpose or content of an image.
Incorrect! Try again.
20How can GitHub Copilot assist a web developer?
Improving Web Applications using GitHub Copilot
Easy
A.By suggesting code
B.By replacing browsers
C.By registering domains
D.By repairing hardware
Correct Answer: By suggesting code
Explanation:
GitHub Copilot can suggest code and completions based on the current file and developer prompts.
Incorrect! Try again.
21A JavaScript function produces the correct result for most inputs but fails when the input array is empty. Which debugging technique is most appropriate for identifying the cause?
Debugging Techniques
Medium
A.Add a breakpoint and inspect variables when the empty array is processed
B.Move the function into a separate stylesheet
C.Minify the JavaScript file and run the application again
D.Disable browser caching for all application resources
Correct Answer: Add a breakpoint and inspect variables when the empty array is processed
Explanation:
A breakpoint allows the developer to pause execution on the failing case and inspect the function's state, control flow, and variable values.
Incorrect! Try again.
22An event handler appears to run twice whenever a button is clicked. What should a developer investigate first?
Debugging Techniques
Medium
A.Whether the stylesheet contains duplicate selectors
B.Whether the same listener is registered more than once
C.Whether the page title is defined in the document
D.Whether the button uses a semantic HTML element
Correct Answer: Whether the same listener is registered more than once
Explanation:
Registering the same event listener multiple times commonly causes one user action to invoke the handler more than once.
Incorrect! Try again.
23A page sends a form submission, but the server returns an unexpected response. Which browser developer tools panel provides the most useful initial evidence?
Browser Developer Tools
Medium
A.Elements panel for examining computed styles
B.Sources panel for editing local JavaScript
C.Application panel for examining stored cookies
D.Network panel for examining the request and response
Correct Answer: Network panel for examining the request and response
Explanation:
The Network panel shows request URLs, methods, headers, payloads, status codes, and response bodies, which are central to diagnosing failed submissions.
Incorrect! Try again.
24A heading has the correct CSS class but displays with the wrong color. Which developer tools feature best identifies the rule overriding its color?
Browser Developer Tools
Medium
A.The storage table in the Application panel
B.The timing chart in the Network panel
C.The call stack in the JavaScript debugger
D.The computed styles view in the Elements panel
Correct Answer: The computed styles view in the Elements panel
Explanation:
The computed styles view reveals the final applied value and helps trace it to the winning CSS rule after cascade and specificity are evaluated.
Incorrect! Try again.
25A client-side application calls an API with fetch(). Which approach correctly handles an HTTP 404 response?
Error Handling
Medium
A.Use finally to convert the response into valid data
B.Catch only syntax errors raised while parsing the script
C.Check response.ok and throw an error when it is false
D.Assume every resolved promise contains successful data
Correct Answer: Check response.ok and throw an error when it is false
Explanation:
fetch() normally resolves for HTTP error statuses, so the application must inspect response.ok or response.status and handle unsuccessful responses explicitly.
Incorrect! Try again.
26An application displays data loaded from a remote service. What is the best user-facing behavior when the request fails?
Error Handling
Medium
A.Show a clear error state with an option to retry
B.Leave the loading indicator visible without further changes
C.Write the full exception stack trace into the page
D.Remove the entire interface until the user refreshes
Correct Answer: Show a clear error state with an option to retry
Explanation:
A clear message and retry action help users understand the failure and recover without exposing technical implementation details.
Incorrect! Try again.
27A list contains many dynamically added delete buttons. Which event-handling strategy is most maintainable?
Interactive User Interface Development
Medium
A.Attach a new window listener whenever an item is added
B.Add an inline click attribute to every generated button
C.Use one delegated click listener on the list container
D.Poll all delete buttons repeatedly with a timer
Correct Answer: Use one delegated click listener on the list container
Explanation:
Event delegation uses event bubbling so one stable parent listener can handle existing and dynamically created child buttons.
Incorrect! Try again.
28A custom dropdown can be opened with a mouse but not operated with a keyboard. Which change most directly improves its accessibility?
Interactive User Interface Development
Medium
A.Increase the animation duration when the menu opens
B.Add keyboard controls and manage focus during interaction
C.Replace text labels with background images
D.Store the selected value in session storage
Correct Answer: Add keyboard controls and manage focus during interaction
Explanation:
Keyboard handling and predictable focus management allow users who do not use a mouse to open, navigate, and close the dropdown.
Incorrect! Try again.
29A single-page application must update the displayed products whenever its filter state changes. Which design is most appropriate?
Client-Side Application Design
Medium
A.Store each product only in unrelated global variables
B.Read the current filters only from visible label text
C.Reload the complete HTML document after every selection
D.Treat the state as the source used to render the product view
Correct Answer: Treat the state as the source used to render the product view
Explanation:
Using application state as the source of truth keeps the rendered product list consistent with the selected filters.
Incorrect! Try again.
30Two components need the same API data and currently send identical requests whenever the page loads. Which design change best reduces duplication?
Client-Side Application Design
Medium
A.Place the response data inside a CSS custom property
B.Convert both requests from asynchronous to synchronous
C.Fetch the data in a shared service and reuse the result
D.Give each component a different copy of the endpoint URL
Correct Answer: Fetch the data in a shared service and reuse the result
Explanation:
A shared data service centralizes request logic and can cache or distribute one result to multiple components.
Incorrect! Try again.
31A JavaScript file mixes API requests, DOM updates, validation, and storage operations in one large function. What is the best refactoring approach?
Code Organization
Medium
A.Duplicate the function for each page that uses it
B.Rename the function without changing its internal structure
C.Move all statements into one global event listener
D.Split the responsibilities into focused functions or modules
Correct Answer: Split the responsibilities into focused functions or modules
Explanation:
Separating responsibilities improves readability, testing, reuse, and maintenance while reducing coupling between unrelated behaviors.
Incorrect! Try again.
32Several modules need the same date-formatting behavior. Where should that behavior be placed?
Code Organization
Medium
A.In separate copied functions inside each module
B.In a shared utility module with a documented interface
C.In a CSS rule imported by the relevant pages
D.In a hidden HTML element read by every module
Correct Answer: In a shared utility module with a documented interface
Explanation:
A shared utility module provides one reusable implementation and prevents copied versions from becoming inconsistent.
Incorrect! Try again.
33A page's largest visible image delays the Largest Contentful Paint measurement. Which change is most likely to improve the result?
Website Performance Fundamentals
Medium
A.Load the image through a delayed click handler
B.Add more JavaScript before the image element
C.Optimize its size and serve an appropriate modern format
D.Encode the image at a larger intrinsic resolution
Correct Answer: Optimize its size and serve an appropriate modern format
Explanation:
Reducing image transfer size and using an efficient format helps the browser download and render the largest visible image sooner.
Incorrect! Try again.
34A website loads a large JavaScript bundle that contains code used only on an admin page. Which optimization best addresses this issue?
Website Performance Fundamentals
Medium
A.Place the bundle at the beginning of the HTML file
B.Load the admin code only when that route is requested
C.Rename the bundle to use a shorter file name
D.Store the entire bundle in a JavaScript variable
Correct Answer: Load the admin code only when that route is requested
Explanation:
Route-based code splitting keeps admin-only code out of the initial bundle and reduces unnecessary download, parsing, and execution work.
Incorrect! Try again.
35A developer wants to add a new feature without destabilizing the repository's main branch. Which workflow is most appropriate?
GitHub Repository Management
Medium
A.Develop on a feature branch and open a pull request
B.Delete the commit history before starting the feature
C.Commit unfinished changes directly to the main branch
D.Create a separate repository for every source file
Correct Answer: Develop on a feature branch and open a pull request
Explanation:
A feature branch isolates work, while a pull request supports review, automated checks, and controlled integration into the main branch.
Incorrect! Try again.
36A merge conflict occurs because two branches changed the same lines. What should the developer do?
GitHub Repository Management
Medium
A.Remove the conflicted file from version control permanently
B.Delete both branches and recreate the repository
C.Resolve the conflicting content, test it, and commit the result
D.Keep both file versions without examining their behavior
Correct Answer: Resolve the conflicting content, test it, and commit the result
Explanation:
Merge conflicts require a deliberate choice about the final content, followed by testing and a commit that records the resolution.
Incorrect! Try again.
37A project site is published at https://example.github.io/shop/, but its stylesheet is requested from https://example.github.io/styles.css and returns 404. Which change is appropriate?
Website Hosting using GitHub Pages
Medium
A.Change the stylesheet extension from .css to .html
B.Reference the stylesheet through a local disk path
C.Move the stylesheet into the repository's issue tracker
D.Use a project-aware relative path such as ./styles.css
Correct Answer: Use a project-aware relative path such as ./styles.css
Explanation:
A GitHub Pages project site is served under a repository subpath, so relative or correctly prefixed asset paths prevent requests from incorrectly targeting the domain root.
Incorrect! Try again.
38A GitHub Pages site displays index.html, but server-side PHP code appears as text or does not execute. What is the reason?
Website Hosting using GitHub Pages
Medium
A.GitHub Pages requires PHP files to use lowercase names
B.GitHub Pages requires PHP code to be placed in CSS files
C.GitHub Pages executes PHP only from the default branch
D.GitHub Pages serves static content and does not run PHP
Correct Answer: GitHub Pages serves static content and does not run PHP
Explanation:
GitHub Pages is a static hosting service. Server-side runtimes such as PHP require a hosting platform that supports backend execution.
Incorrect! Try again.
39A registration form currently validates required fields only with JavaScript in the browser. What should be added before production deployment?
Web Development Best Practices
Medium
A.Server-side validation of all submitted values
B.Longer placeholder text for every input field
C.A separate stylesheet for each form control
D.Client-side validation based only on text color
Correct Answer: Server-side validation of all submitted values
Explanation:
Client-side validation improves usability but can be bypassed, so the server must independently validate untrusted input.
Incorrect! Try again.
40GitHub Copilot suggests a function that builds SQL using direct string interpolation from a form value. What is the best response?
Improving Web Applications using GitHub Copilot
Medium
A.Replace it with a parameterized query and review the behavior
B.Accept it because generated code is automatically security-tested
C.Hide the interpolation inside a helper with a shorter name
D.Use it unchanged if the function passes a syntax check
Correct Answer: Replace it with a parameterized query and review the behavior
Explanation:
Copilot suggestions require developer review. Parameterized queries separate data from SQL structure and reduce injection risk.
Incorrect! Try again.
41A production exception maps to a source line that cannot produce the observed error. Local debugging with the same source code works correctly. What should be verified first?
Debugging Techniques
Hard
A.Whether all production functions have descriptive names instead of minified names
B.Whether the browser has JavaScript disabled for the production domain
C.Whether the deployed bundle and source map came from the same build artifact
D.Whether the source map contains only relative paths rather than absolute paths
Correct Answer: Whether the deployed bundle and source map came from the same build artifact
Explanation:
A source map from a different build can map generated offsets to incorrect source lines. Matching release identifiers or artifact hashes confirms that the bundle and map correspond.
Incorrect! Try again.
42A timing-sensitive interface bug disappears whenever a normal breakpoint is added. Which technique is most appropriate for collecting evidence while minimizing disruption to execution timing?
Debugging Techniques
Hard
A.Disable browser caching and single-step through every executed statement
B.Use conditional logpoints and timestamped performance marks around state transitions
C.Insert synchronous alert dialogs before every asynchronous callback
D.Replace all promises with blocking loops during the investigation
Correct Answer: Use conditional logpoints and timestamped performance marks around state transitions
Explanation:
Logpoints and performance marks capture ordering and timing with less interference than pausing execution, making them suitable for race conditions and observer effects.
Incorrect! Try again.
43A cross-origin fetch sends a custom X-Report-ID header. DevTools shows an OPTIONS request returning 403, while JavaScript receives only TypeError: Failed to fetch. Which change addresses the underlying failure?
Browser Developer Tools
Hard
A.Configure the server to accept the preflight and allow the origin and custom header
B.Parse the failed response body before checking the response status code
C.Set the request mode to no-cors so JavaScript can read the complete response
D.Add Access-Control-Allow-Origin as a request header in the browser code
Correct Answer: Configure the server to accept the preflight and allow the origin and custom header
Explanation:
The custom header triggers a CORS preflight. The server must handle OPTIONS and return suitable CORS response headers; client code cannot grant itself CORS permission.
Incorrect! Try again.
44Successive heap snapshots show increasing numbers of detached modal DOM trees. The retaining path leads from a document-level event listener to a closure that references each modal. What is the most direct correction?
Browser Developer Tools
Hard
A.Remove or abort the document listener and release modal references during cleanup
B.Clone each modal before removal so its event listeners are not preserved
C.Hide closed modals with CSS and retain their listeners for later reuse
D.Force garbage collection immediately after setting each modal's display to none
Correct Answer: Remove or abort the document listener and release modal references during cleanup
Explanation:
A listener attached to the live document can retain its closure and the detached modal. Cleanup must remove the listener, or abort it through an AbortSignal, and release captured references.
Incorrect! Try again.
45The code fetch('/api/item/42').then(r => r.json()).then(render).catch(showError) displays a generic parsing error when the server returns an HTML 404 page. Which revision preserves the HTTP failure meaning?
Error Handling
Hard
A.Check r.ok, throw an error containing r.status, and parse only valid responses
B.Call r.json() twice and use the second rejection as the HTTP error
C.Treat every resolved fetch promise as successful regardless of HTTP status
D.Move catch before then(render) so it can inspect the original response
Correct Answer: Check r.ok, throw an error containing r.status, and parse only valid responses
Explanation:
fetch normally resolves for HTTP errors such as 404. Checking response.ok before parsing distinguishes an HTTP failure from invalid JSON or a rendering failure.
Incorrect! Try again.
46A dashboard loads four independent widgets using Promise.all. One optional widget rejects, causing the dashboard to discard the other three successful results. Which design best supports partial rendering while retaining error information?
Error Handling
Hard
A.Use Promise.any and duplicate its first fulfilled value across all widgets
B.Use Promise.allSettled and process fulfilled and rejected outcomes separately
C.Wrap the requests in one try block and ignore any resulting exception
D.Use Promise.race and render whichever widget settles before the others
Correct Answer: Use Promise.allSettled and process fulfilled and rejected outcomes separately
Explanation:
Promise.allSettled records every outcome without failing fast. The interface can render successful widgets and show targeted errors for rejected ones.
Incorrect! Try again.
47A list uses one delegated click listener, and each action button contains nested icons. Items may also be inserted dynamically. Which handler logic most reliably identifies a valid action button?
Interactive User Interface Development
Hard
A.Use event.target.closest('[data-action]') and verify the result belongs to the list
B.Use event.target.parentElement and assume the button is exactly one level higher
C.Use event.currentTarget.matches('[data-action]') and read the list's action
D.Use list.querySelector('[data-action]') and execute the first matching action
Correct Answer: Use event.target.closest('[data-action]') and verify the result belongs to the list
Explanation:
closest handles clicks on nested button content, while the containment check prevents an unrelated matching ancestor from being treated as a list action.
Incorrect! Try again.
48A modal visually overlays the page, but keyboard users can tab into background controls and lose their previous focus when it closes. Which behavior provides the strongest accessible interaction model?
Interactive User Interface Development
Hard
A.Move focus into the modal, disable the Escape key, and restore focus to the document root
B.Place aria-hidden on the modal, preserve document tab order, and focus the page body
C.Move focus into the modal, contain tab navigation, inert the background, and restore focus
D.Focus the close button, leave the background interactive, and remove all focus indicators
Correct Answer: Move focus into the modal, contain tab navigation, inert the background, and restore focus
Explanation:
An accessible modal manages initial focus, keeps keyboard navigation inside, prevents background interaction, and restores focus to the invoking control when closed.
Incorrect! Try again.
49A search interface sends a request after each query. Occasionally, a slow response for an older query overwrites the results of a newer query. Which design most robustly prevents stale commits?
Client-Side Application Design
Hard
A.Assign each request a sequence token and commit only the latest token's response
B.Sort completed responses by HTTP status and render the first successful response
C.Cache every response and always render the response with the largest payload
D.Delay rendering until every request created during the session has completed
Correct Answer: Assign each request a sequence token and commit only the latest token's response
Explanation:
A monotonically increasing request token makes the state commit conditional on request freshness. Aborting older requests is also useful, but the token guards against responses that still settle.
Incorrect! Try again.
50An application stores todos, completedTodos, and completedCount as separately mutable state. After several updates, the three values disagree. Which redesign best preserves consistency?
Client-Side Application Design
Hard
A.Freeze the completed count while allowing both todo arrays to change independently
B.Persist all three values independently and reconcile them only when the page reloads
C.Store only the canonical todos and derive completed items and counts when needed
D.Update all three values through unrelated event listeners running in registration order
Correct Answer: Store only the canonical todos and derive completed items and counts when needed
Explanation:
Duplicated mutable state creates synchronization invariants that are easy to violate. Keeping canonical state and deriving filtered lists and counts removes those conflicting sources of truth.
Incorrect! Try again.
51Modules orders.js and payments.js import each other through a shared barrel file. Depending on import order, one module observes an uninitialized binding. What is the best structural remedy?
Code Organization
Hard
A.Add more re-exports to the barrel so the runtime chooses a stable initialization order
B.Convert every named export into a default export while retaining the dependency cycle
C.Move shared contracts into a dependency-free module and inject cross-module services
D.Duplicate both modules' implementations so that neither file needs an import
Correct Answer: Move shared contracts into a dependency-free module and inject cross-module services
Explanation:
Extracting shared abstractions and injecting behavior breaks the circular dependency. Changing export syntax or adding barrel re-exports does not remove the initialization cycle.
Incorrect! Try again.
52Importing a utility module in a unit test unexpectedly registers DOM listeners and starts a timer because the module executes setup at top level. Which refactoring best improves reuse and test isolation?
Code Organization
Hard
A.Catch all top-level exceptions and silently continue when no document object exists
B.Move the side effects into an explicit initialization function called by the application entry point
C.Retain top-level setup but increase the timer delay so tests usually complete first
D.Copy the utility functions into the test suite to avoid importing the production module
Correct Answer: Move the side effects into an explicit initialization function called by the application entry point
Explanation:
Separating pure exports from explicit startup logic prevents imports from changing global state. The entry point can initialize the browser behavior, while tests can import utilities safely.
Incorrect! Try again.
53The Largest Contentful Paint element is a hero background image declared in a stylesheet that is discovered late. The image is above the fold and currently lazy-loaded by script. Which change most directly improves its discovery and priority?
Website Performance Fundamentals
Hard
A.Prefetch the image after the load event and keep script-controlled lazy loading
B.Preload the hero as an image in the document head and avoid lazy-loading that image
C.Increase the image dimensions and store it under a filename without a cache extension
D.Inline every application script before the stylesheet so image discovery occurs later
Correct Answer: Preload the hero as an image in the document head and avoid lazy-loading that image
Explanation:
A preload exposes the CSS background image to the browser earlier, and avoiding lazy loading prevents an above-the-fold LCP resource from being intentionally delayed.
Incorrect! Try again.
54A deployment uses content-hashed JavaScript filenames, but returning users sometimes keep an old HTML document that references assets removed by the new deployment. Which caching policy best limits this failure?
Website Performance Fundamentals
Hard
A.Revalidate HTML frequently and cache hashed assets as long-lived immutable resources
B.Cache HTML immutably for one year and disable caching for hashed JavaScript files
C.Give HTML and hashed assets the same long expiration without revalidation
D.Disable caching for HTML and all static assets on every production request
Correct Answer: Revalidate HTML frequently and cache hashed assets as long-lived immutable resources
Explanation:
HTML should be refreshed or revalidated because it points to current assets. Content-hashed files can be cached immutably because a content change produces a new URL.
Incorrect! Try again.
55A repository accepts pull requests from forks. A workflow using pull_request_target checks out the contributor's head commit and then runs its build script with repository secrets available. What is the safest redesign?
GitHub Repository Management
Hard
A.Approve every fork workflow automatically because GitHub masks secrets in console output
B.Move secrets into source files so the build no longer accesses the Actions secret store
C.Use a read-only pull_request workflow without secrets to execute untrusted contribution code
D.Keep the privileged trigger but hide secret values by disabling workflow command echoing
Correct Answer: Use a read-only pull_request workflow without secrets to execute untrusted contribution code
Explanation:
Checking out untrusted code in a privileged pull_request_target job can expose secrets or write permissions. Untrusted builds should run with minimal permissions and no repository secrets.
Incorrect! Try again.
56A faulty merge commit has already been pulled by many developers from a protected main branch. The project must undo its changes while preserving shared history. Which action is appropriate?
GitHub Repository Management
Hard
A.Delete the local branch and ask every developer to reconstruct the commit graph
B.Force-push main to the commit immediately preceding the faulty merge
C.Rebase all commits after the merge and force-push the rewritten branch
D.Revert the merge with the correct mainline parent and merge the revert through review
Correct Answer: Revert the merge with the correct mainline parent and merge the revert through review
Explanation:
Reverting creates a new commit that undoes the merge without rewriting published history. Selecting the mainline parent tells Git which side of the merge should remain.
Incorrect! Try again.
57A GitHub Pages project site is published at https://example.github.io/catalog/. The HTML loads, but assets requested from /assets/app.js return 404, and client routes omit /catalog/. What configuration is required?
Website Hosting using GitHub Pages
Hard
A.Set the build asset base and client router basename to /catalog/
B.Add query parameters to every asset URL and leave the router rooted at /
C.Rename the repository to assets and configure the router basename as /app/
D.Set the build asset base to / and remove the repository name from all URLs
Correct Answer: Set the build asset base and client router basename to /catalog/
Explanation:
A project site is served beneath the repository path. Both generated asset URLs and history-based client routing must account for the /catalog/ base path.
Incorrect! Try again.
58A single-page application hosted on GitHub Pages works when navigating internally, but directly opening /reports/2025 returns the Pages 404. Server-side rewrite rules and redirect scripts are not allowed. Which routing strategy resolves this constraint?
Website Hosting using GitHub Pages
Hard
A.Use hash-based routes such as /#/reports/2025 so the server requests the entry page
B.Store the route in a cookie while continuing to request /reports/2025 from the server
C.Use deeper history routes so GitHub Pages can infer the nearest application directory
D.Send a custom rewrite header from the browser before requesting every client route
Correct Answer: Use hash-based routes such as /#/reports/2025 so the server requests the entry page
Explanation:
URL fragments are not sent to the server, so GitHub Pages serves the root entry document. The client router can then interpret the fragment without requiring server rewrites.
Incorrect! Try again.
59An application converts untrusted Markdown comments to HTML and inserts the result with innerHTML. The Markdown library permits embedded HTML. Which defense most directly prevents stored DOM-based XSS while preserving supported formatting?
Web Development Best Practices
Hard
A.Sanitize the generated HTML with a maintained allowlist sanitizer before insertion
B.Encode the Markdown before parsing and trust every HTML node produced afterward
C.Remove only <script> strings and permit all event attributes and URL schemes
D.Validate comments solely in the browser and store the resulting HTML unchanged
Correct Answer: Sanitize the generated HTML with a maintained allowlist sanitizer before insertion
Explanation:
XSS payloads can use event handlers, dangerous URLs, SVG, and other constructs beyond <script>. Context-aware allowlist sanitization removes unsafe generated HTML while preserving approved markup.
Incorrect! Try again.
60GitHub Copilot suggests authentication middleware that calls a JWT decode function and trusts the resulting role claim without verifying the token. What is the correct response before adopting the suggestion?
Improving Web Applications using GitHub Copilot
Hard
A.Store the decoded role in local storage and compare it during later requests
B.Verify signature, allowed algorithm, issuer, audience, and time claims with a trusted library
C.Accept it because decoding a JWT necessarily validates its signature and claims
D.Add client-side obfuscation so attackers cannot discover the role claim's name
Correct Answer: Verify signature, allowed algorithm, issuer, audience, and time claims with a trusted library
Explanation:
Decoding only reads attacker-controlled data. Generated code must be reviewed and tested, and JWT authorization requires cryptographic verification plus validation of relevant claims and algorithms.
Incorrect! Try again.
Did this save you a night before the exam?
LPU Notes is free, and it stays free. Ads cover part of the server bill.
The rest comes out of a student's own pocket: the domain, the storage,
and keeping the site up through the weeks everyone needs it at once.
The payment button didn't load. An ad blocker or a filtered network is the usual reason.
to try again.
Nothing here is ever locked, and nothing unlocks. Chip in only if it was worth it.
What it pays for →