D276 ITSW 2120 Web Development
Foundations
Final Assessment Review
(Questions & Solutions)
2025
©2025
,Multiple Choice (MCQ)
1. Which HTTP response status code most commonly indicates a
successful RESTful resource creation?
A) 200 OK
B) 201 Created
C) 204 No Content
D) 400 Bad Request ANS: B Rationale: 201 indicates a resource has been
created successfully.
2. What is the primary function of Content Security Policy (CSP) in
modern web applications?
A) Enforce client-side SSL
B) Prevent SQL Injection attacks
C) Restrict sources from which content can be loaded
D) Enable browser cache ANS: C Rationale: CSP helps prevent XSS by
specifying which sources are trusted.
3. In the context of Single Page Applications (SPAs), which technology is
most responsible for allowing content updates without full page reloads?
A) WebSockets
B) AJAX
C) CSS Grid
D) DOM Parsing ANS: B Rationale: AJAX enables asynchronous updates
to web pages.
4. From a security perspective, which is the least safe method for
authenticating a RESTful API?
A) OAuth 2.0 Bearer Tokens
B) Basic Authentication over HTTPS
C) JWT (JSON Web Tokens)
D) API Keys in URL Query Strings ANS: D Rationale: API keys in URLs may
be exposed in logs and browser history.
©2025
, 5. Which HTTP header is used to prevent clickjacking attacks in web
applications?
A) X-Content-Type-Options
B) X-Frame-Options
C) X-XSS-Protection
D) X-Content-Security-Policy ANS: B Rationale: X-Frame-Options controls
whether a browser should allow a page to be displayed in a <frame>,
<iframe>, <embed>, or <object>.
6. The Same-Origin Policy (SOP) is enforced by:
A) Web server
B) Firewalls
C) Client-side browser
D) Reverse Proxy ANS: C Rationale: SOP is a critical security feature
implemented in browsers.
7. When using WebSockets, which protocol upgrade header is required in
the initial HTTP request?
A) Connection: close
B) Upgrade: websocket
C) Accept-Encoding: gzip
D) Transfer-Encoding: chunked ANS: B Rationale: The Upgrade:
websocket header initiates a WebSocket connection.
8. Which of the following is NOT a recommended method for mitigating
Cross-Site Request Forgery (CSRF) attacks?
A) Implementing same-site cookies
B) Using anti-CSRF tokens
C) Enabling HTTP Strict Transport Security (HSTS)
D) Validating Referer headers ANS: C Rationale: HSTS is to enforce
HTTPS, not to prevent CSRF.
9. What is the primary role of a Reverse Proxy in an enterprise web
solution?
©2025
Foundations
Final Assessment Review
(Questions & Solutions)
2025
©2025
,Multiple Choice (MCQ)
1. Which HTTP response status code most commonly indicates a
successful RESTful resource creation?
A) 200 OK
B) 201 Created
C) 204 No Content
D) 400 Bad Request ANS: B Rationale: 201 indicates a resource has been
created successfully.
2. What is the primary function of Content Security Policy (CSP) in
modern web applications?
A) Enforce client-side SSL
B) Prevent SQL Injection attacks
C) Restrict sources from which content can be loaded
D) Enable browser cache ANS: C Rationale: CSP helps prevent XSS by
specifying which sources are trusted.
3. In the context of Single Page Applications (SPAs), which technology is
most responsible for allowing content updates without full page reloads?
A) WebSockets
B) AJAX
C) CSS Grid
D) DOM Parsing ANS: B Rationale: AJAX enables asynchronous updates
to web pages.
4. From a security perspective, which is the least safe method for
authenticating a RESTful API?
A) OAuth 2.0 Bearer Tokens
B) Basic Authentication over HTTPS
C) JWT (JSON Web Tokens)
D) API Keys in URL Query Strings ANS: D Rationale: API keys in URLs may
be exposed in logs and browser history.
©2025
, 5. Which HTTP header is used to prevent clickjacking attacks in web
applications?
A) X-Content-Type-Options
B) X-Frame-Options
C) X-XSS-Protection
D) X-Content-Security-Policy ANS: B Rationale: X-Frame-Options controls
whether a browser should allow a page to be displayed in a <frame>,
<iframe>, <embed>, or <object>.
6. The Same-Origin Policy (SOP) is enforced by:
A) Web server
B) Firewalls
C) Client-side browser
D) Reverse Proxy ANS: C Rationale: SOP is a critical security feature
implemented in browsers.
7. When using WebSockets, which protocol upgrade header is required in
the initial HTTP request?
A) Connection: close
B) Upgrade: websocket
C) Accept-Encoding: gzip
D) Transfer-Encoding: chunked ANS: B Rationale: The Upgrade:
websocket header initiates a WebSocket connection.
8. Which of the following is NOT a recommended method for mitigating
Cross-Site Request Forgery (CSRF) attacks?
A) Implementing same-site cookies
B) Using anti-CSRF tokens
C) Enabling HTTP Strict Transport Security (HSTS)
D) Validating Referer headers ANS: C Rationale: HSTS is to enforce
HTTPS, not to prevent CSRF.
9. What is the primary role of a Reverse Proxy in an enterprise web
solution?
©2025
