A photo can open in a modal during client navigation while remaining available as a full page through its direct URL.
Incorrect! Try again.
8Where does Edge Runtime code typically execute?
Edge Runtime
Easy
A.Inside the user's database
B.Only during local development
C.Near the application's users
D.Inside a CSS stylesheet
Correct Answer: Near the application's users
Explanation:
Edge Runtime code runs on geographically distributed infrastructure close to users.
Incorrect! Try again.
9What is a common benefit of using the Edge Runtime?
Edge Runtime
Easy
A.Lower request latency
B.Larger image dimensions
C.Longer variable names
D.More CSS selectors
Correct Answer: Lower request latency
Explanation:
Running code closer to users can reduce the time needed to process and return a request.
Incorrect! Try again.
10Which statement about the Edge Runtime is generally correct?
Edge Runtime
Easy
A.It supports a limited set of APIs
B.It requires every page to be static
C.It stores all application data locally
D.It replaces all client-side JavaScript
Correct Answer: It supports a limited set of APIs
Explanation:
Edge environments commonly provide web-standard APIs but may not support every API available in a full Node.js runtime.
Incorrect! Try again.
11What does internationalization prepare an application to support?
Internationalization
Easy
A.Multiple languages and regions
B.Multiple testing frameworks
C.Multiple database engines
D.Multiple source repositories
Correct Answer: Multiple languages and regions
Explanation:
Internationalization prepares an application to adapt its language and regional formatting for different audiences.
Incorrect! Try again.
12What is a locale in an internationalized application?
Internationalization
Easy
A.A database connection setting
B.A reusable visual component
C.A language and regional preference
D.A server performance measurement
Correct Answer: A language and regional preference
Explanation:
A locale identifies language and often regional conventions, such as en-US or fr-FR.
Incorrect! Try again.
13Which content commonly changes according to a user's locale?
Internationalization
Easy
A.Date and currency formatting
B.HTTP protocol versions
C.Component file extensions
D.Source control commit hashes
Correct Answer: Date and currency formatting
Explanation:
Locales affect how dates, numbers, and currencies are presented to users.
Incorrect! Try again.
14What is the main goal of a clear project architecture?
Project Architecture
Easy
A.Make the codebase easier to maintain
B.Remove the need for documentation
C.Place all logic in one component
D.Make every file use the same name
Correct Answer: Make the codebase easier to maintain
Explanation:
Clear architecture organizes responsibilities so developers can understand, modify, and extend the codebase.
Incorrect! Try again.
15Where should shared utility functions generally be placed?
Project Architecture
Easy
A.In the public assets folder
B.In a dedicated utilities module
C.Inside every page component
D.Inside the package lock file
Correct Answer: In a dedicated utilities module
Explanation:
A dedicated utilities module keeps shared functions discoverable and avoids unnecessary duplication.
Incorrect! Try again.
16What is a reusable component?
Component Organization
Easy
A.A component executed only once
B.A component without any markup
C.A component stored in a database
D.A component used in multiple places
Correct Answer: A component used in multiple places
Explanation:
A reusable component provides common interface or behavior that can be used across several parts of an application.
Incorrect! Try again.
17Which practice improves component organization?
Component Organization
Easy
A.Giving every component one filename
B.Duplicating components for each page
C.Putting all components in one file
D.Grouping related components together
Correct Answer: Grouping related components together
Explanation:
Grouping components by feature or responsibility makes them easier to locate and maintain.
Incorrect! Try again.
18How should application secrets such as API keys usually be stored?
Security Best Practices
Easy
A.In client-side component props
B.In public static files
C.In browser-visible comments
D.In protected environment variables
Correct Answer: In protected environment variables
Explanation:
Protected environment variables keep secrets outside public client code and source files.
Incorrect! Try again.
19Why should an application validate user input?
Security Best Practices
Easy
A.To reject invalid or harmful data
B.To rename components automatically
C.To increase the screen resolution
D.To reduce the number of routes
Correct Answer: To reject invalid or harmful data
Explanation:
Input validation helps prevent malformed or malicious data from being processed by the application.
Incorrect! Try again.
20What does a unit test usually verify?
Testing Overview
Easy
A.One small piece of functionality
B.The behavior of external organizations
C.The complete production infrastructure
D.The visual design of every page
Correct Answer: One small piece of functionality
Explanation:
A unit test checks a focused unit, such as a function or component, in isolation.
Incorrect! Try again.
21In a dashboard application, which feature allows the layout to render a sidebar and a main content area independently using named slots?
Parallel Routes
Medium
A.Parallel Routes
B.Static generation
C.Intercepting Routes
D.Middleware
Correct Answer: Parallel Routes
Explanation:
Parallel Routes use named slots to render multiple route segments simultaneously within the same layout.
Incorrect! Try again.
22A user navigates between pages inside a dashboard, but the analytics panel should preserve its state while the main content changes. Which approach is most appropriate?
Parallel Routes
Medium
A.Place both views in one client component
B.Use an API route for the analytics panel
C.Convert the entire dashboard to static HTML
D.Use a parallel route for the analytics panel
Correct Answer: Use a parallel route for the analytics panel
Explanation:
A parallel route can maintain an independently rendered panel while another route segment changes.
Incorrect! Try again.
23What is the most suitable use of a Next.js proxy for a protected application area?
Proxy
Medium
A.Generating CSS files during compilation
B.Managing state inside a browser component
C.Rendering database records into a table
D.Checking authentication before forwarding a request
Correct Answer: Checking authentication before forwarding a request
Explanation:
A proxy can inspect incoming requests and redirect or rewrite them before the request reaches the application route.
Incorrect! Try again.
24A proxy should run only for requests beginning with /admin. Which configuration principle should be applied?
Proxy
Medium
A.Use a loading boundary
B.Create a client-side context
C.Add a dynamic import
D.Configure a route matcher
Correct Answer: Configure a route matcher
Explanation:
A route matcher limits proxy execution to selected URL patterns, reducing unnecessary processing.
Incorrect! Try again.
25A product list should open a product detail page in a modal when navigated from the list, but show a full page after a direct URL visit. Which feature supports this behavior?
Intercepting Routes
Medium
A.Parallel data fetching
B.Static route generation
C.Intercepting Routes
D.Environment variables
Correct Answer: Intercepting Routes
Explanation:
Intercepting Routes allow navigation to be presented in a different UI context, such as a modal, while direct visits can render the normal page.
Incorrect! Try again.
26Why should a modal opened through an intercepted route usually include a normal page implementation as well?
Intercepting Routes
Medium
A.To disable browser history updates
B.To support direct navigation and refreshes
C.To make every request run at the edge
D.To avoid using server components
Correct Answer: To support direct navigation and refreshes
Explanation:
A user may access the URL directly or refresh the browser, so the route needs a full-page fallback in addition to the intercepted modal view.
Incorrect! Try again.
27Which implementation is most compatible with an edge runtime?
Edge Runtime
Medium
A.A handler requiring the Node.js fs module
B.A request handler using standard Web APIs
C.A process that launches a child process
D.A library dependent on native Node.js binaries
Correct Answer: A request handler using standard Web APIs
Explanation:
Edge runtimes generally support Web APIs such as Request, Response, and fetch, but not all Node.js-specific modules.
Incorrect! Try again.
28An edge function must access a database driver that depends on Node.js TCP sockets. What is the main concern?
Edge Runtime
Medium
A.The browser will block all requests
B.The driver may not be supported
C.The function cannot return JSON
D.The route must become a static asset
Correct Answer: The driver may not be supported
Explanation:
Edge environments have a restricted runtime and may not provide Node.js networking APIs required by some database drivers.
Incorrect! Try again.
29An application supports English and French URLs such as /en/products and /fr/products. What should determine the displayed language?
Internationalization
Medium
A.The number of URL segments
B.The server's operating system
C.The user's screen resolution
D.The locale associated with the route
Correct Answer: The locale associated with the route
Explanation:
The locale segment identifies the language context used to load translations and format content.
Incorrect! Try again.
30A price must display correctly for users in Germany and the United States. Which strategy is most reliable?
Internationalization
Medium
A.Store formatted prices as permanent strings
B.Replace every decimal point manually
C.Use locale-aware number and currency formatting
D.Use the browser's default font settings
Correct Answer: Use locale-aware number and currency formatting
Explanation:
Internationalization APIs can apply locale-specific decimal separators, grouping, currency symbols, and formatting conventions.
Incorrect! Try again.
31Which architectural choice best supports independent development of a large web application?
Project Architecture
Medium
A.Mix database logic into visual components
B.Organize code by clear domain boundaries
C.Duplicate authentication logic in every page
D.Place every component in one directory
Correct Answer: Organize code by clear domain boundaries
Explanation:
Domain-oriented boundaries improve ownership, maintainability, testing, and the ability to change one feature without affecting unrelated features.
Incorrect! Try again.
32A team wants to prevent UI code from directly constructing database queries. Which architectural practice is most appropriate?
Project Architecture
Medium
A.Duplicate queries inside each page
B.Use a service or repository layer
C.Move all queries into CSS files
D.Expose database credentials to the browser
Correct Answer: Use a service or repository layer
Explanation:
A service or repository layer separates data access from presentation and provides a clearer boundary for validation and testing.
Incorrect! Try again.
33A button is reused across unrelated features and has no feature-specific behavior. Where should it generally be organized?
Component Organization
Medium
A.Inside the database migration folder
B.In the proxy configuration file
C.Inside the route for one feature
D.In a shared UI component directory
Correct Answer: In a shared UI component directory
Explanation:
Generic reusable components belong in a shared UI area, while feature-specific components should remain near their feature.
Incorrect! Try again.
34A page needs browser event handlers, but most of its content is static. How should the components be organized?
Component Organization
Medium
A.Move all content into a proxy
B.Keep the page server-rendered and isolate the interactive part
C.Render the page only after a database mutation
D.Make every component a client component
Correct Answer: Keep the page server-rendered and isolate the interactive part
Explanation:
Isolating interactivity in a small client component preserves server-rendering benefits and reduces client-side JavaScript.
Incorrect! Try again.
35Which practice best protects a web application from SQL injection?
Security Best Practices
Medium
A.Use parameterized queries
B.Minify the SQL statements
C.Hide the database hostname
D.Rename the database tables
Correct Answer: Use parameterized queries
Explanation:
Parameterized queries keep user input separate from executable SQL syntax, preventing input from changing the intended query.
Incorrect! Try again.
36A server action receives an isAdmin value from a form. Why should the server avoid trusting that value?
Security Best Practices
Medium
A.Clients can modify submitted form values
B.Browsers automatically encrypt all form fields
C.Server actions cannot access request data
D.Forms cannot submit Boolean values
Correct Answer: Clients can modify submitted form values
Explanation:
Authorization must be checked using trusted server-side identity and permissions, not a client-controlled field.
Incorrect! Try again.
37Which cookie configuration is most appropriate for a session identifier that should not be accessible to JavaScript?
Security Best Practices
Medium
A.Place it in a client-side environment variable
B.Set the HttpOnly attribute
C.Set the Public attribute
D.Store it in a visible page heading
Correct Answer: Set the HttpOnly attribute
Explanation:
The HttpOnly attribute prevents browser JavaScript from reading the cookie, reducing exposure to certain cross-site scripting attacks.
Incorrect! Try again.
38Which test type is most appropriate for verifying that a form displays an error when a required field is empty?
Testing Overview
Medium
A.A database backup test
B.A component or integration test
C.A load test of the production server
D.A compiler performance test
Correct Answer: A component or integration test
Explanation:
Component or integration tests can simulate user input and verify the resulting validation message and UI behavior.
Incorrect! Try again.
39A test passes locally but fails intermittently in continuous integration because it depends on timing. What is the best improvement?
Testing Overview
Medium
A.Disable the test in continuous integration
B.Wait for observable conditions instead of fixed delays
C.Increase every timeout to ten minutes
D.Add random delays to the application
Correct Answer: Wait for observable conditions instead of fixed delays
Explanation:
Waiting for a specific UI or network condition makes tests more deterministic than relying on arbitrary sleep intervals.
Incorrect! Try again.
40Which test provides the strongest check that a user can log in, reach a protected page, and log out through the browser?
Testing Overview
Medium
A.A static type-checking run
B.A snapshot test for a button
C.A unit test for a formatter
D.An end-to-end test
Correct Answer: An end-to-end test
Explanation:
End-to-end tests exercise the complete workflow across the browser, application routes, authentication, and user interface.
Incorrect! Try again.
41A dashboard uses parallel routes for @analytics and @activity. The user navigates from /dashboard/reports to /dashboard/settings, but the activity panel should preserve its existing state while the analytics panel refreshes. Which design best achieves this behavior?
Parallel Routes
Hard
A.Render both panels conditionally inside the page component
B.Store panel state in cookies and reconstruct it after navigation
C.Use separate slots with independent loading and error boundaries
D.Place both panels in one shared layout and reload them together
Correct Answer: Use separate slots with independent loading and error boundaries
Explanation:
Parallel route slots can preserve independent UI state and manage loading or errors separately, allowing one slot to refresh without remounting the others.
Incorrect! Try again.
42A modal is implemented with a parallel route slot. On a hard refresh at /inbox, the modal slot receives no active child, although client-side navigation correctly opens the modal. Which file most directly defines the refresh fallback for that slot?
Parallel Routes
Hard
A.default.tsx inside the modal slot
B.not-found.tsx inside the modal slot
C.loading.tsx inside the modal slot
D.layout.tsx inside the modal slot
Correct Answer: default.tsx inside the modal slot
Explanation:
A parallel route's default.tsx defines the fallback UI when no matching slot content exists during an initial load or hard refresh.
Incorrect! Try again.
43Two parallel route slots display independent resources. One resource returns a 403 response while the other succeeds. What is the most appropriate boundary arrangement?
Parallel Routes
Hard
A.One global error boundary around the entire dashboard
B.An error boundary colocated within each parallel slot
C.A middleware redirect for every failed slot request
D.A single try/catch around the parent layout fetch
Correct Answer: An error boundary colocated within each parallel slot
Explanation:
Slot-level error boundaries isolate failures, so a denied resource can show its own recovery UI without replacing unrelated successful content.
Incorrect! Try again.
44A proxy should protect /admin routes but must not run for /_next/static, image optimization requests, or files containing a dot in their final path segment. Which matcher strategy is most precise?
Proxy
Hard
A.Run the proxy only from the root layout after rendering begins
B.Match only /admin/:path* and ignore static asset handling
C.Use a negative-lookahead matcher excluding framework assets and dotted paths
D.Match every request beginning with / and check exclusions in the handler
Correct Answer: Use a negative-lookahead matcher excluding framework assets and dotted paths
Explanation:
A carefully scoped matcher prevents unnecessary proxy execution and avoids applying authentication logic to framework assets or file-like URLs.
Incorrect! Try again.
45A proxy validates an access token and then redirects unauthenticated users to /login?returnTo=<original path>. Which issue must be addressed before deploying this implementation?
Proxy
Hard
A.The login page must be rendered exclusively on the Edge Runtime
B.The token must always be stored in a client-side local-storage key
C.The return path must be validated to prevent open redirects
D.The redirect must use a permanent status code for browser caching
Correct Answer: The return path must be validated to prevent open redirects
Explanation:
An attacker could supply an external return URL and turn the login redirect into an open redirect. Only validated same-origin paths should be accepted.
Incorrect! Try again.
46A product detail route should open as a modal when reached from a product list, but render as a full page after a direct URL entry or browser refresh. Which combination is required?
Intercepting Routes
Hard
A.An intercepting route for soft navigation and a canonical page route
B.A rewrite from the list route to the product route
C.A client-side state flag and a global modal component
D.A parallel route without a separate product page
Correct Answer: An intercepting route for soft navigation and a canonical page route
Explanation:
Intercepting routes alter the presentation during client navigation, while the canonical route supplies the full-page representation for direct entry and refresh.
Incorrect! Try again.
47A modal opened through an intercepting route remains visible after the user presses the browser Back button. Which implementation detail is most likely missing?
Intercepting Routes
Hard
A.The intercepted page must be statically generated
B.The modal route must use a server action
C.The route must disable all client-side transitions
D.The modal must close by navigating back through browser history
Correct Answer: The modal must close by navigating back through browser history
Explanation:
Intercepted modal navigation should create a history entry. Returning with browser history removes the modal state and restores the underlying route.
Incorrect! Try again.
48An API handler works in Node.js but fails after being configured for the Edge Runtime because it imports a package that depends on fs and Node's TCP APIs. What is the correct diagnosis?
Edge Runtime
Hard
A.The route must be converted into a client component
B.The package violates Edge Runtime API constraints
C.The handler needs a longer request timeout
D.Edge handlers require a larger memory allocation
Correct Answer: The package violates Edge Runtime API constraints
Explanation:
The Edge Runtime does not provide arbitrary Node.js built-ins such as filesystem and TCP APIs. The dependency must be replaced or the route must run in Node.js.
Incorrect! Try again.
49A globally distributed request handler performs a 700 ms database query against a single regional database. Moving the handler to the Edge Runtime does not improve median latency. Why?
Edge Runtime
Hard
A.The database remains the dominant regional bottleneck
Correct Answer: The database remains the dominant regional bottleneck
Explanation:
Edge execution reduces compute distance, but a remote single-region dependency can still dominate total latency. Data locality and connection strategy must also be addressed.
Incorrect! Try again.
50An application supports locale-prefixed URLs and must preserve a user's requested path when redirecting / to a detected locale. Which behavior avoids a common routing defect?
Internationalization
Hard
A.Rewrite every locale request to a single unprefixed route
B.Always redirect / to the default locale
C.Redirect to the detected locale while preserving the normalized path
D.Infer locale only from the browser's time zone
Correct Answer: Redirect to the detected locale while preserving the normalized path
Explanation:
Locale detection should select the locale without discarding the requested route. The path must be normalized carefully to avoid duplicate prefixes and redirect loops.
Incorrect! Try again.
51A localized page is statically generated for en, fr, and de. A request arrives for fr-CA, which is configured as a fallback of fr. What is the most robust rendering strategy?
Internationalization
Hard
A.Render the page in English because only exact locales are valid
B.Redirect all regional locales permanently to the base locale
C.Treat fr-CA as unrelated and return a 404
D.Use fr resources while preserving fr-CA formatting rules where supported
Correct Answer: Use fr resources while preserving fr-CA formatting rules where supported
Explanation:
Locale fallback should separate translation-resource availability from regional formatting. Base-language messages can be reused while regional conventions remain explicit when supported.
Incorrect! Try again.
52A team wants feature ownership to remain clear as a Next.js application grows. Which structure best supports localized changes and prevents unrelated domain code from accumulating in a global utilities folder?
Project Architecture
Hard
A.Organize every file by extension under components, hooks, and utils
B.Place all server actions in one root file for centralized discovery
C.Put reusable and feature-specific components in the same global directory
D.Organize code by business feature with local components, data access, and tests
Correct Answer: Organize code by business feature with local components, data access, and tests
Explanation:
Feature-oriented architecture keeps related behavior together, clarifies ownership, and reduces accidental coupling between unrelated domains.
Incorrect! Try again.
53A route group is introduced to give authenticated pages a shared layout without changing their public URLs. Which statement correctly describes the purpose of route groups?
Project Architecture
Hard
A.They force all grouped routes to use static rendering
B.They expose a new URL segment for each directory
C.They group routes structurally without adding path segments
Correct Answer: They group routes structurally without adding path segments
Explanation:
Parenthesized route groups organize layouts and route ownership while remaining invisible in the URL. They do not provide authentication by themselves.
Incorrect! Try again.
54A server component fetches private data and passes a callback that closes over a secret-bearing object to a client component. Why is this design invalid or unsafe?
Component Organization
Hard
A.Functions and secret-bearing values cannot cross the server-client boundary safely
B.Private data becomes cached automatically by every browser
C.Client components cannot receive any props from servers
D.Server components may only return plain HTML strings
Correct Answer: Functions and secret-bearing values cannot cross the server-client boundary safely
Explanation:
Props crossing the boundary must be serializable, and secrets must never be exposed to client code. Server actions or narrow data contracts should be used instead.
Incorrect! Try again.
55A large interactive table causes an otherwise static page to become client-rendered. Which refactoring best preserves server rendering while retaining table interactivity?
Component Organization
Hard
A.Move the entire page data fetch into the browser
B.Keep the page server-rendered and isolate table behavior in a client island
C.Duplicate the page as separate server and client implementations
D.Add use client to the root layout
Correct Answer: Keep the page server-rendered and isolate table behavior in a client island
Explanation:
Client boundaries should be as narrow as practical. A focused interactive component can receive serializable data while the surrounding page remains a server component.
Incorrect! Try again.
56A server action updates a user's email address. The form is rendered only for administrators, but a malicious client invokes the action directly. What control is essential inside the action?
Security Best Practices
Hard
A.Hide the form from non-administrators
B.Recheck authentication and authorization on the server
C.Require JavaScript to be enabled in the browser
D.Obfuscate the action identifier in the client bundle
Correct Answer: Recheck authentication and authorization on the server
Explanation:
UI visibility is not an authorization boundary. Every server action must independently authenticate the caller and verify permission for the requested operation.
Incorrect! Try again.
57An application accepts a next query parameter after login and performs redirect(next). Which validation is strongest for preventing an attacker-controlled external redirect?
Security Best Practices
Hard
A.Allow any absolute URL using HTTPS
B.Allow only normalized same-origin paths beginning with /
C.Reject values containing the substring javascript
D.URL-encode the value before passing it to redirect
Correct Answer: Allow only normalized same-origin paths beginning with /
Explanation:
Encoding does not establish trust, and string blacklists are incomplete. A normalized same-origin relative path is the appropriate allowlist.
Incorrect! Try again.
58A page displays user-submitted Markdown. The renderer permits raw HTML because some trusted authors need formatting. Which mitigation is required?
Security Best Practices
Hard
A.Sanitize generated HTML with a strict allowlist before insertion
B.Render the content through a client component
C.Escape only the Markdown heading syntax
D.Add a CSP header without sanitizing the generated markup
Correct Answer: Sanitize generated HTML with a strict allowlist before insertion
Explanation:
Markdown conversion can produce dangerous HTML. Sanitization must remove unsafe tags, attributes, and URL schemes; CSP is defense in depth, not a replacement.
Incorrect! Try again.
59A component test passes because it mocks the router, but production fails when a parallel route slot is missing during a hard refresh. Which test addition most directly covers the defect?
Testing Overview
Hard
A.Increase snapshot test coverage for button labels
B.Mock more router methods in the existing unit test
C.Measure the component's rendering time under CPU throttling
D.Add an end-to-end test for direct entry and refresh of the route
Correct Answer: Add an end-to-end test for direct entry and refresh of the route
Explanation:
The failure depends on routing, server rendering, and refresh behavior. An end-to-end test exercises the actual navigation mode and slot fallback together.
Incorrect! Try again.
60A test verifies that an unauthorized user cannot access /admin. The implementation returns either a redirect or a 403 depending on whether the request is browser navigation or an API call. What assertion strategy is most resilient?
Testing Overview
Hard
A.Assert that every request returns exactly status 302
B.Assert only that the response body contains the word unauthorized
C.Test each contract separately: redirect behavior for navigation and 403 for the API
D.Mock authorization so both paths return the same status
Correct Answer: Test each contract separately: redirect behavior for navigation and 403 for the API
Explanation:
Different clients have different response contracts. Tests should verify the intended status, headers, and behavior for each request type rather than forcing one implementation outcome.
Incorrect! Try again.
Did this save you a night before the exam?
LPU Notes is free, and it stays free. Ads cover part of the server bill.
The rest comes out of a student's own pocket: the domain, the storage,
and keeping the site up through the weeks everyone needs it at once.
The payment button didn't load. An ad blocker or a filtered network is the usual reason.
to try again.
Nothing here is ever locked, and nothing unlocks. Chip in only if it was worth it.
What it pays for →