Difficulty: Hard
Which response header can restrict allowed script sources?
A Cache-Control
B Content-Type
C Content-Security-Policy
D Accept-Encoding
Answer: C. Content-Security-Policy. Content-Security-Policy can limit script sources a page may execute.
When displaying untrusted text, which API is safer?
A Use textContent
B Use innerHTML directly
C Append to a script
D Build markup by concatenation
Answer: A. Use textContent. textContent inserts text without interpreting it as HTML markup.
To verify request source, what does an anti-CSRF token help establish?
A Response uses TLS
B Cookie is persistent
C Origin supports CORS
D Request came from trusted form
Answer: D. Request came from trusted form. An anti-CSRF token helps verify a request belongs to the expected session.
Why does an HTTPS certificate matter to a browser?
A Compresses response content
B Authenticates server identity
C Hides URL path
D Prevents all phishing
Answer: B. Authenticates server identity. A trusted certificate binds a server identity to a cryptographic key.
After a successful WebSocket upgrade, which status should the server return?
A 200 OK
B 204 No Content
C 304 Not Modified
D 101 Switching Protocols
Answer: D. 101 Switching Protocols. 101 Switching Protocols confirms the server accepted the WebSocket upgrade.
How does a WebSocket handshake begin?
A DNS TXT query
B TLS certificate request
C HTTP Upgrade request
D HTML form submission
Answer: C. HTTP Upgrade request. The WebSocket opening handshake begins as an HTTP upgrade request.
For repeated updates to the same target, which HTTP method is idempotent?
A PUT
B POST
C CONNECT
D PATCH
Answer: A. PUT. PUT is idempotent: repeating the same intended update has the same effect.
In HTTP terms, what does idempotency mean for repetition?
A Identical response bytes
B Same intended effect
C No network transfer
D Always returns 200
Answer: B. Same intended effect. Idempotency concerns the intended effect, not identical response bytes.
Where is an HttpOnly cookie unavailable?
A HTTPS requests
B Same-site requests
C Server headers
D JavaScript APIs
Answer: D. JavaScript APIs. HttpOnly keeps a cookie inaccessible to page JavaScript.
Which cookie attribute requires secure-channel transmission?
A Secure
B Path
C Domain
D Priority
Answer: A. Secure. Secure restricts cookie transmission to secure channels.
For a service worker, what does its scope limit?
A Defines CSS inheritance
B Sets cookie lifetime
C Limits controlled URL paths
D Names an HTTP method
Answer: C. Limits controlled URL paths. A service worker’s scope determines which page paths it can control.
How does the preload resource hint affect fetching?
A Waits for user click
B Fetches resource early
C Loads after page close
D Queries DNS only
Answer: B. Fetches resource early. Preload lets the browser fetch a needed resource early.
Code splitting can reduce which initial loading cost?
A HTML parse errors
B DNS query count
C CSS specificity
D Initial transfer size
Answer: D. Initial transfer size. Splitting code can lower the bytes required for initial loading.
Among Core Web Vitals, which measures layout instability?
A LCP
B INP
C CLS
D TTFB
Answer: C. CLS. CLS measures unexpected movement of visible page content.
Which metric measures render time of the largest contentful element?
A Largest content render time
B First input delay
C Layout shift score
D Interaction count
Answer: A. Largest content render time. LCP records when the largest contentful element renders.
Which metric replaced First Input Delay as a Core Web Vital?
A CLS
B INP
C LCP
D FCP
Answer: B. INP. INP replaced FID among the Core Web Vitals.
How can an ETag help a cache validator?
A Encrypt cached bytes
B Set browser origin
C Choose content language
D Compare representation versions
Answer: D. Compare representation versions. ETag supports conditional requests by identifying a representation version.
HTTP 412 denotes which condition?
A Precondition failed
B Authentication required
C Resource created
D Range unsatisfied
Answer: A. Precondition failed. 412 means a request precondition evaluated false.
In transit, which TLS property protects data from passive reading?
A Compression
B Caching
C Encryption
D Minification
Answer: C. Encryption. TLS encryption protects transmitted data from passive reading.
How can Subresource Integrity help with external scripts?
A Blocks every third party
B Checks expected file hash
C Encrypts cookies
D Validates HTML structure
Answer: B. Checks expected file hash. Subresource Integrity checks a fetched file against its declared hash.
Shadow DOM can encapsulate which component details?
A HTTP headers
B DNS records
C Form methods
D DOM and styles
Answer: D. DOM and styles. Shadow DOM scopes a component’s internal DOM and styles.
Which ARIA feature announces dynamic content changes?
A aria-live region
B role=button
C aria-hidden
D alt text
Answer: A. aria-live region. An aria-live region signals updates for assistive technologies.
Which HTML attribute can suppress referrer details?
A crossorigin
B fetchpriority
C referrerpolicy
D autocomplete
Answer: C. referrerpolicy. Referrerpolicy controls how much referrer information navigation sends.
When does a classic deferred script execute?
A Before HTML parsing
B After parsing completes
C After window unload
D During DNS lookup
Answer: B. After parsing completes. Defer runs an external classic script after parsing and before DOMContentLoaded.
Why should a CORS response vary by Origin when reflecting it?
A Prevent TLS handshakes
B Disable client scripts
C Normalize request methods
D Separate cache variants
Answer: D. Separate cache variants. Vary: Origin keeps cached responses separate when allowed origins differ.