What is a common defense against CSRF attacks?

Escaping all output in templates.

Using a unique CSRF token in forms that is validated by the server.

Disabling cookies in the browser.

Using GET requests for all form submissions.

A developer is building a blog where users can post comments. The comments are rendered in an EJS template. The developer wants to allow basic formatting like bold text using HTML tags, but is concerned about XSS attacks. What is the most secure approach?

Use to output the raw input without any sanitization.

Sanitize the input on the server to allow only safe HTML tags, then use to output it.

Use to escape all HTML, preventing any formatting.

Strip all HTML tags from the input and use to output it.

A developer has a route that renders a list of items. The data comes from a database query that may return a large number of items. The developer wants to paginate the results. The URL is '/items?page=2'. How should the route handle the 'page' parameter and render the correct items?

Use req.params.page to get the page number.

Use req.body.page to get the page number.

Ignore the page parameter and render all items at once.

Parse req.query.page, validate it, calculate the offset, and query the database with a limit.

An Express app serves static files from 'public'. A developer adds a route '/files' that should serve a file from a different directory 'private' that is not publicly accessible. What is the correct approach?

Add another express.static middleware for 'private'.

Use a symlink from 'public' to 'private'.

Copy the file to 'public' and serve it from there.

Use res.sendFile with an absolute path to the file in 'private'.

What is Cross-Site Scripting (XSS)?

An attack that forges requests on behalf of an authenticated user.

An attack that steals a user's session cookie by intercepting network traffic.

An attack where malicious scripts are injected into web pages viewed by other users.

An attack that exploits vulnerabilities in the server's operating system.

LPI Web Development Essentials

Domain 5Objective 2

035.2 NodeJS Express Basics (weight: 4) WEB-DEVELOPMENT-ESSENTIALS Practice Questions (Page 2)

Part of the 035 NodeJS Server Programming domain, which makes up ~15% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 60-minute exam (~25–40 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

12concepts

Questions 6–10

6foundation · easy
What is a common defense against CSRF attacks?
Select an answer first
7expert · hard
A developer is building a blog where users can post comments. The comments are rendered in an EJS template. The developer wants to allow basic formatting like bold text using HTML tags, but is concerned about XSS attacks. What is the most secure approach?
Select an answer first
8expert · hard
A developer has a route that renders a list of items. The data comes from a database query that may return a large number of items. The developer wants to paginate the results. The URL is '/items?page=2'. How should the route handle the 'page' parameter and render the correct items?
Select an answer first
9expert · hard
An Express app serves static files from 'public'. A developer adds a route '/files' that should serve a file from a different directory 'private' that is not publicly accessible. What is the correct approach?
Select an answer first
10foundation · easy
What is Cross-Site Scripting (XSS)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WEB-DEVELOPMENT-ESSENTIALS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “WEB-DEVELOPMENT-ESSENTIALS” is a trademark of its owner, used for identification only.