ICT 421 WEB APPLICATION
DEVELOPMENT FINAL EXAM
Full Stack Web Architecture REST APIs and Security Questions and
Answers Verified Solutions 2026 2027
1. Which HTTP request method is designed to be idempotent and used specifically to
retrieve resources without causing server-side state changes?
A. POST
B. GET
C. PATCH
D. DELETE
Rationale: HTTP GET is a safe, idempotent method intended solely to retrieve data without modifying
database records or server state.
2. What HTTP status code class indicates a client-side error, such as a malformed
request body or missing resource endpoint?
A. 2xx
B. 3xx
C. 4xx
D. 5xx
Rationale: 4xx HTTP status codes (like 400 Bad Request, 401 Unauthorized, or 404 Not Found) indicate
client errors.
3. Which security vulnerability allows attackers to inject malicious client-side scripts into
web pages viewed by other users?
A. SQL Injection (SQLi)
B. Cross-Site Scripting (XSS)
C. Cross-Site Request Forgery (CSRF)
D. Server-Side Request Forgery (SSRF)
Rationale: Cross-Site Scripting occurs when web applications fail to sanitize user inputs before rendering
them in the DOM, allowing arbitrary JavaScript execution.
, 4. What browser security mechanism restricts web pages from making HTTP requests to
a different domain than the one that served the web page?
A. Same-Origin Policy (SOP)
B. Content Security Policy (CSP)
C. Transport Layer Security (TLS)
D. HTTP Strict Transport Security (HSTS)
Rationale: The Same-Origin Policy prevents scripts loaded from one origin from accessing sensitive data
on another origin unless explicit CORS headers are provided.
5. What HTTP header allows servers to declare which external origin domains are
permitted to read API response resources?
A. X-Frame-Options
B. Access-Control-Allow-Origin
C. Content-Type
D. Authorization
Rationale: The Access-Control-Allow-Origin header is part of the CORS protocol, specifying allowed
origin domains for cross-site browser requests.
6. Which CSS layout module is optimized for one-dimensional layouts along either a row
or a column?
A. Flexbox (Flexible Box Layout)
B. CSS Grid Layout
C. Float Positioning
D. Absolute Block Positioning
Rationale: Flexbox is designed for single-axis 1D alignments, whereas CSS Grid is designed for two-
dimensional grid layouts.
7. In JavaScript, what keyword defines a block-scoped variable that can be reassigned
later in execution?
A. const
B. let
DEVELOPMENT FINAL EXAM
Full Stack Web Architecture REST APIs and Security Questions and
Answers Verified Solutions 2026 2027
1. Which HTTP request method is designed to be idempotent and used specifically to
retrieve resources without causing server-side state changes?
A. POST
B. GET
C. PATCH
D. DELETE
Rationale: HTTP GET is a safe, idempotent method intended solely to retrieve data without modifying
database records or server state.
2. What HTTP status code class indicates a client-side error, such as a malformed
request body or missing resource endpoint?
A. 2xx
B. 3xx
C. 4xx
D. 5xx
Rationale: 4xx HTTP status codes (like 400 Bad Request, 401 Unauthorized, or 404 Not Found) indicate
client errors.
3. Which security vulnerability allows attackers to inject malicious client-side scripts into
web pages viewed by other users?
A. SQL Injection (SQLi)
B. Cross-Site Scripting (XSS)
C. Cross-Site Request Forgery (CSRF)
D. Server-Side Request Forgery (SSRF)
Rationale: Cross-Site Scripting occurs when web applications fail to sanitize user inputs before rendering
them in the DOM, allowing arbitrary JavaScript execution.
, 4. What browser security mechanism restricts web pages from making HTTP requests to
a different domain than the one that served the web page?
A. Same-Origin Policy (SOP)
B. Content Security Policy (CSP)
C. Transport Layer Security (TLS)
D. HTTP Strict Transport Security (HSTS)
Rationale: The Same-Origin Policy prevents scripts loaded from one origin from accessing sensitive data
on another origin unless explicit CORS headers are provided.
5. What HTTP header allows servers to declare which external origin domains are
permitted to read API response resources?
A. X-Frame-Options
B. Access-Control-Allow-Origin
C. Content-Type
D. Authorization
Rationale: The Access-Control-Allow-Origin header is part of the CORS protocol, specifying allowed
origin domains for cross-site browser requests.
6. Which CSS layout module is optimized for one-dimensional layouts along either a row
or a column?
A. Flexbox (Flexible Box Layout)
B. CSS Grid Layout
C. Float Positioning
D. Absolute Block Positioning
Rationale: Flexbox is designed for single-axis 1D alignments, whereas CSS Grid is designed for two-
dimensional grid layouts.
7. In JavaScript, what keyword defines a block-scoped variable that can be reassigned
later in execution?
A. const
B. let
