Question 1

Question 1
A protected page should verify the user's authenticated state before showing restricted content.
True
False

Accepted Answer

True

Question 2

Question 2
What is a common reason to redirect after processing login?
It changes the PHP version.
It disables validation.
It deletes the controller.
It prevents the same form submission from being repeated by browser refresh.

Accepted Answer

It prevents the same form submission from being repeated by browser refresh.

Question 3

Question 3
What should happen after a successful login?
Delete all routes.
Disable the session library.
Store appropriate user identity data in the session and redirect to a protected page.
Display the password in the browser.

Accepted Answer

Store appropriate user identity data in the session and redirect to a protected page.

Question 4

Question 4
Which logout design is stronger?
Display the dashboard again without clearing data.
Destroy the session and redirect to login with a short message.
Store the password in flash data.
Leave the session active and hide the logout link.

Accepted Answer

Destroy the session and redirect to login with a short message.

Question 5

Question 5
Which CodeIgniter service is commonly used to access session functionality?
model()
session()
service('routes')
view()

Accepted Answer

session()

Question 6

Question 6
Authentication
Verifies that a user is who they claim to be

Accepted Answer

Verifies that a user is who they claim to be

Question 7

Question 7
What should a controller check before showing a protected page?

Accepted Answer

Session/authentication state

Question 8

A developer stores the full password hash and user role in session after login. What should be evaluated?
Whether views can run without controllers.
Whether only necessary, non-sensitive session data is stored.

Accepted Answer

Whether only necessary, non-sensitive session data is stored.

Question 9

Question 9
What CodeIgniter feature is used for temporary messages such as 'Login successful'?

Accepted Answer

Flash data

Question 10

Question 10
A controller checks if session()->get('isLoggedIn') is true before returning the dashboard view. What security goal does this support?
Database migration
Route caching only
Image resizing
Session-based access control

Accepted Answer

Session-based access control

Question 11

Question 11
Flash data
Stores a short message for the next request

Accepted Answer

Stores a short message for the next request

Question 12

Question 12
Logout
Removes the authenticated session state

Accepted Answer

Removes the authenticated session state

Question 13

Question 13
What process clears authenticated session data so the user is no longer logged in?

Accepted Answer

Logout

Question 14

Question 14
What is the safest general description of authentication?
Changing all routes to POST.
Confirming a user's identity before allowing access.
Rendering a database table.
Styling a login button.

Accepted Answer

Confirming a user's identity before allowing access.

Question 15

Question 15
Password verification should work against hashed passwords rather than exposing raw passwords.
True
False

Accepted Answer

True

Question 16

Question 16
Session
Stores small user-related data across requests

Accepted Answer

Stores small user-related data across requests

Question 17

Question 17
What term refers to the process of verifying a user's identity?

Accepted Answer

Authentication

Question 18

Question 18
Which line is a reasonable way to set session data in CodeIgniter?
$routes->setSession(true);
view()->set('login');
session()->set(['isLoggedIn' => true]);
$model->session('on');

Accepted Answer

session()->set(['isLoggedIn' => true]);

Question 19

Question 19
Flash data is intended to last permanently until manually deleted from the database.
True
False

Accepted Answer

False

Question 20

A protected page relies only on hiding menu links, but the route can still be opened manually. What is the main weakness?
The server-side access check is missing or incomplete.
The controller has a comment.

Accepted Answer

The server-side access check is missing or incomplete.

Question 21

Question 1
What is the main purpose of logout?
To insert a database row.
To create a new user record.
To change the public folder.
To remove the user's authenticated session state.

Accepted Answer

To remove the user's authenticated session state.

Question 22

Question 2
Session
Stores small user-related data across requests

Accepted Answer

Stores small user-related data across requests

Question 23

Question 3
What term refers to the process of verifying a user's identity?

Accepted Answer

Authentication

Question 24

Question 4
Which behavior indicates a protected page is working correctly?
The route ignores session data.
Unauthenticated users are redirected to login.
The view bypasses the controller.
Every visitor can open it directly.

Accepted Answer

Unauthenticated users are redirected to login.

Question 25

Question 5
Which line is a reasonable way to remove all authentication session data on logout?
$routes->deleteAll();
session()->destroy();
$model->dropSessionTable();
view('logout')->erase();

Accepted Answer

session()->destroy();

Question 26

Question 6
What CodeIgniter feature is used for temporary messages such as 'Login successful'?

Accepted Answer

Flash data

Question 27

Question 7
Which session value would be reasonable to store after login?
The Composer executable file.
The user's plaintext password.
The logged-in user's id or username.
The complete database dump.

Accepted Answer

The logged-in user's id or username.

Question 28

Question 8
Which logout design is stronger?
Leave the session active and hide the logout link.
Store the password in flash data.
Display the dashboard again without clearing data.
Destroy the session and redirect to login with a short message.

Accepted Answer

Destroy the session and redirect to login with a short message.

Question 29

Question 9
A protected page relies only on hiding menu links, but the route can still be opened manually. What is the main weakness?
The controller has a comment.
The server-side access check is missing or incomplete.

Accepted Answer

The server-side access check is missing or incomplete.

Question 30

Question 10
Password verification should work against hashed passwords rather than exposing raw passwords.
True
False

Accepted Answer

True

Question 31

Question 11
Why should access-control checks happen before displaying protected content?
To prevent unauthorized users from seeing restricted pages.
To remove the need for HTML.
To make CSS files load faster.
To avoid using routes.

Accepted Answer

To prevent unauthorized users from seeing restricted pages.

Question 32

Question 12
A user logs in successfully, but protected pages still redirect to login. What should be checked first?
Whether the database table has a title column.
Whether the expected session key is set and read consistently.

Accepted Answer

Whether the expected session key is set and read consistently.

Question 33

Question 13
What is the primary purpose of a session in a web application?
To permanently replace the database.
To create routes automatically.
To write CSS rules into views.
To store small user-related data across multiple requests.

Accepted Answer

To store small user-related data across multiple requests.

Question 34

Question 14
Logout
Removes the authenticated session state

Accepted Answer

Removes the authenticated session state

Question 35

Question 15
Session data can persist across multiple HTTP requests for the same user.
True
False

Accepted Answer

True

Question 36

Question 16
Flash data
Stores a short message for the next request

Accepted Answer

Stores a short message for the next request

Question 37

Question 17
What process clears authenticated session data so the user is no longer logged in?

Accepted Answer

Logout

Question 38

Question 18
Which CodeIgniter service is commonly used to access session functionality?
session()
model()
view()
service('routes')

Accepted Answer

session()

Question 39

Question 19
A developer stores the full password hash and user role in session after login. What should be evaluated?
Whether only necessary, non-sensitive session data is stored.
Whether views can run without controllers.

Accepted Answer

Whether only necessary, non-sensitive session data is stored.

Question 40

Question 20
Authentication
Verifies that a user is who they claim to be

Accepted Answer

Verifies that a user is who they claim to be

Question 41

Question 21
Hiding a menu link is enough to secure a protected page even if the route remains accessible.
True
False

Accepted Answer

False

Question 42

Question 22
Flash data is intended to last permanently until manually deleted from the database.
True
False

Accepted Answer

False

Question 43

Question 23
What should a controller check before showing a protected page?

Accepted Answer

Session/authentication state

Question 44

Question 24
A team wants every protected controller method to repeat the same session-check code. What is a better long-term approach?
Use GET links for logout only.
Use a reusable check, filter, or shared helper pattern.

Accepted Answer

Use a reusable check, filter, or shared helper pattern.

Question 45

Question 25
A login page shows 'Invalid credentials' only after a failed attempt and then the message disappears. What feature most likely supports this?
Seeder classes
Flash data
Route placeholders
File upload rules

Accepted Answer

Flash data

Question 46

Question 26
Logout should leave the authenticated session values untouched.
True
False

Accepted Answer

False

Question 47

Question 27
A protected page should verify the user's authenticated state before showing restricted content.
True
False

Accepted Answer

True

Question 48

Question 28
Session-based authentication removes the need to validate login input.
True
False

Accepted Answer

False

Question 49

Question 29
A controller checks if session()->get('isLoggedIn') is true before returning the dashboard view. What security goal does this support?
Database migration
Route caching only
Image resizing
Session-based access control

Accepted Answer

Session-based access control

Question 50

Question 30
Which line is a reasonable way to set session data in CodeIgniter?
session()->set(['isLoggedIn' => true]);
view()->set('login');
$model->session('on');
$routes->setSession(true);

Accepted Answer

session()->set(['isLoggedIn' => true]);

Question	Answer
Question 1 A protected page should verify the user's authenticated state before showing restricted content. True False	True
Question 2 What is a common reason to redirect after processing login? It changes the PHP version. It disables validation. It deletes the controller. It prevents the same form submission from being repeated by browser refresh.	It prevents the same form submission from being repeated by browser refresh.
Question 3 What should happen after a successful login? Delete all routes. Disable the session library. Store appropriate user identity data in the session and redirect to a protected page. Display the password in the browser.	Store appropriate user identity data in the session and redirect to a protected page.
Question 4 Which logout design is stronger? Display the dashboard again without clearing data. Destroy the session and redirect to login with a short message. Store the password in flash data. Leave the session active and hide the logout link.	Destroy the session and redirect to login with a short message.
Question 5 Which CodeIgniter service is commonly used to access session functionality? model() session() service('routes') view()	session()
Question 6 Authentication Verifies that a user is who they claim to be	Verifies that a user is who they claim to be
Question 7 What should a controller check before showing a protected page?	Session/authentication state
A developer stores the full password hash and user role in session after login. What should be evaluated? Whether views can run without controllers. Whether only necessary, non-sensitive session data is stored.	Whether only necessary, non-sensitive session data is stored.
Question 9 What CodeIgniter feature is used for temporary messages such as 'Login successful'?	Flash data
Question 10 A controller checks if session()->get('isLoggedIn') is true before returning the dashboard view. What security goal does this support? Database migration Route caching only Image resizing Session-based access control	Session-based access control
Question 11 Flash data Stores a short message for the next request	Stores a short message for the next request
Question 12 Logout Removes the authenticated session state	Removes the authenticated session state
Question 13 What process clears authenticated session data so the user is no longer logged in?	Logout
Question 14 What is the safest general description of authentication? Changing all routes to POST. Confirming a user's identity before allowing access. Rendering a database table. Styling a login button.	Confirming a user's identity before allowing access.
Question 15 Password verification should work against hashed passwords rather than exposing raw passwords. True False	True
Question 16 Session Stores small user-related data across requests	Stores small user-related data across requests
Question 17 What term refers to the process of verifying a user's identity?	Authentication
Question 18 Which line is a reasonable way to set session data in CodeIgniter? $routes->setSession(true); view()->set('login'); session()->set(['isLoggedIn' => true]); $model->session('on');	session()->set(['isLoggedIn' => true]);
Question 19 Flash data is intended to last permanently until manually deleted from the database. True False	False
A protected page relies only on hiding menu links, but the route can still be opened manually. What is the main weakness? The server-side access check is missing or incomplete. The controller has a comment.	The server-side access check is missing or incomplete.
Question 1 What is the main purpose of logout? To insert a database row. To create a new user record. To change the public folder. To remove the user's authenticated session state.	To remove the user's authenticated session state.
Question 2 Session Stores small user-related data across requests	Stores small user-related data across requests
Question 3 What term refers to the process of verifying a user's identity?	Authentication
Question 4 Which behavior indicates a protected page is working correctly? The route ignores session data. Unauthenticated users are redirected to login. The view bypasses the controller. Every visitor can open it directly.	Unauthenticated users are redirected to login.
Question 5 Which line is a reasonable way to remove all authentication session data on logout? $routes->deleteAll(); session()->destroy(); $model->dropSessionTable(); view('logout')->erase();	session()->destroy();
Question 6 What CodeIgniter feature is used for temporary messages such as 'Login successful'?	Flash data
Question 7 Which session value would be reasonable to store after login? The Composer executable file. The user's plaintext password. The logged-in user's id or username. The complete database dump.	The logged-in user's id or username.
Question 8 Which logout design is stronger? Leave the session active and hide the logout link. Store the password in flash data. Display the dashboard again without clearing data. Destroy the session and redirect to login with a short message.	Destroy the session and redirect to login with a short message.
Question 9 A protected page relies only on hiding menu links, but the route can still be opened manually. What is the main weakness? The controller has a comment. The server-side access check is missing or incomplete.	The server-side access check is missing or incomplete.
Question 10 Password verification should work against hashed passwords rather than exposing raw passwords. True False	True
Question 11 Why should access-control checks happen before displaying protected content? To prevent unauthorized users from seeing restricted pages. To remove the need for HTML. To make CSS files load faster. To avoid using routes.	To prevent unauthorized users from seeing restricted pages.
Question 12 A user logs in successfully, but protected pages still redirect to login. What should be checked first? Whether the database table has a title column. Whether the expected session key is set and read consistently.	Whether the expected session key is set and read consistently.
Question 13 What is the primary purpose of a session in a web application? To permanently replace the database. To create routes automatically. To write CSS rules into views. To store small user-related data across multiple requests.	To store small user-related data across multiple requests.
Question 14 Logout Removes the authenticated session state	Removes the authenticated session state
Question 15 Session data can persist across multiple HTTP requests for the same user. True False	True
Question 16 Flash data Stores a short message for the next request	Stores a short message for the next request
Question 17 What process clears authenticated session data so the user is no longer logged in?	Logout
Question 18 Which CodeIgniter service is commonly used to access session functionality? session() model() view() service('routes')	session()
Question 19 A developer stores the full password hash and user role in session after login. What should be evaluated? Whether only necessary, non-sensitive session data is stored. Whether views can run without controllers.	Whether only necessary, non-sensitive session data is stored.
Question 20 Authentication Verifies that a user is who they claim to be	Verifies that a user is who they claim to be
Question 21 Hiding a menu link is enough to secure a protected page even if the route remains accessible. True False	False
Question 22 Flash data is intended to last permanently until manually deleted from the database. True False	False
Question 23 What should a controller check before showing a protected page?	Session/authentication state
Question 24 A team wants every protected controller method to repeat the same session-check code. What is a better long-term approach? Use GET links for logout only. Use a reusable check, filter, or shared helper pattern.	Use a reusable check, filter, or shared helper pattern.
Question 25 A login page shows 'Invalid credentials' only after a failed attempt and then the message disappears. What feature most likely supports this? Seeder classes Flash data Route placeholders File upload rules	Flash data
Question 26 Logout should leave the authenticated session values untouched. True False	False
Question 27 A protected page should verify the user's authenticated state before showing restricted content. True False	True
Question 28 Session-based authentication removes the need to validate login input. True False	False
Question 29 A controller checks if session()->get('isLoggedIn') is true before returning the dashboard view. What security goal does this support? Database migration Route caching only Image resizing Session-based access control	Session-based access control
Question 30 Which line is a reasonable way to set session data in CodeIgniter? session()->set(['isLoggedIn' => true]); view()->set('login'); $model->session('on'); $routes->setSession(true);	session()->set(['isLoggedIn' => true]);

"Know" box contains:
Time elapsed:
Retries:

phpf4