BudiBaduQuiziBadu

JavaScript Security Basics Quiz

JavaScript
0 Passed
0% acceptance

Test your knowledge with 40 questions on web security fundamentals—covering XSS types, prevention strategies, CSRF mechanics, and defense techniques like tokens, SameSite cookies, and Content Security Policy.

40 Questions
~80 minutes
1

Question 1

Why is client-side security important even when the server is secure?

A
Because attackers can manipulate the frontend to bypass server checks or steal data
B
Because browsers ignore server responses
C
Because JavaScript runs faster than backend code
D
Because servers cannot validate user input
2

Question 2

What is the principle of “defense in depth” in web security?

A
Using multiple overlapping security controls to protect against failure of any single layer
B
Encrypting all JavaScript files
C
Blocking all third-party scripts
D
Disabling cookies entirely
3

Question 3

Which of the following is a common goal of client-side attacks?

A
Steal session cookies or authentication tokens
B
Increase server CPU usage
C
Compress HTML files
D
Improve SEO ranking
4

Question 4

What role does the Same-Origin Policy (SOP) play in browser security?

A
It restricts scripts from one origin from reading data from another origin
B
It prevents all JavaScript execution
C
It encrypts localStorage data
D
It disables network requests
5

Question 5

What is Cross-Site Scripting (XSS)?

A
An attack where malicious scripts are injected and executed in a victim’s browser
B
A method to compress JavaScript files
C
A way to authenticate users across domains
D
A browser rendering bug
6

Question 6

Why is XSS dangerous?

A
It can steal cookies, session tokens, or perform actions as the user
B
It slows down the browser
C
It increases bandwidth usage
D
It breaks CSS layouts
7

Question 7

What enables an XSS attack to succeed?

A
Untrusted data rendered in the DOM without proper escaping or sanitization
B
Using HTTPS
C
Minifying JavaScript
D
Disabling JavaScript
8

Question 8

Which built-in browser feature can help mitigate some XSS impacts?

A
HttpOnly cookies
B
localStorage
C
console.log()
D
Web Workers
9

Question 9

What characterizes a reflected XSS attack?

A
Malicious script is embedded in a URL and reflected off the server in the response
B
Script is stored permanently in a database and served to all users
C
Attack occurs only in local files
D
It requires physical access to the server
10

Question 10

How does stored (persistent) XSS differ from reflected XSS?

A
Stored XSS saves malicious input on the server (e.g., in a comment) and affects multiple users
B
Stored XSS only affects the attacker
C
Reflected XSS is worse
D
Stored XSS cannot be mitigated
11

Question 11

What defines DOM-based XSS?

A
The vulnerability exists entirely in client-side code that modifies the DOM with untrusted data
B
It only occurs in XML documents
C
The server must be compromised
D
It requires WebAssembly
12

Question 12

Which code snippet shows a DOM-based XSS vulnerability?

javascript
// URL: https://example.com/#<script>alert(1)</script>
const hash = location.hash.substring(1);
document.body.innerHTML = hash;
A
Using innerHTML with location.hash without sanitization
B
Using console.log
C
Reading from localStorage
D
Calling fetch()
13

Question 13

In which type of XSS is the malicious payload never sent to the server?

A
DOM-based XSS
B
Stored XSS
C
Reflected XSS
D
All types send it to the server
14

Question 14

Which input source is commonly exploited in DOM-based XSS?

A
window.location
B
navigator.userAgent
C
performance.now()
D
document.title
15

Question 15

What is the most effective way to prevent XSS when inserting user data into HTML?

A
Context-aware output encoding (e.g., HTML-escape before inserting)
B
Using eval()
C
Disabling JavaScript
D
Minifying code
16

Question 16

Why is input validation alone insufficient to prevent XSS?

A
Because the same input may be safe in one context but dangerous in another
B
Because validation slows down the app
C
Because browsers ignore validation
D
Because validation removes all special characters
17

Question 17

Which method is safe for inserting user text into the DOM?

javascript
const userInput = '<img src=x onerror=alert(1)>';
// Which is secure?
A
element.textContent = userInput;
B
element.innerHTML = userInput;
C
document.write(userInput);
D
eval(userInput);
18

Question 18

What does this code do safely?

javascript
const div = document.createElement('div');
div.textContent = userInput;
container.appendChild(div);
A
Inserts userInput as plain text, preventing XSS
B
Executes userInput as JavaScript
C
Sends userInput to the server
D
Sanitizes userInput using regex
19

Question 19

What is the purpose of a Content Security Policy (CSP)?

A
To restrict which scripts, styles, and resources can be loaded and executed
B
To compress JavaScript files
C
To validate form inputs
D
To encrypt cookies
20

Question 20

Which CSP directive helps prevent inline script execution?

A
script-src 'self'
B
img-src *
C
default-src *
D
style-src unsafe-inline
21

Question 21

What is a safe alternative to using innerHTML with user data?

A
Create elements with DOM APIs and set textContent
B
Use eval
C
Replace all < characters with <' manually
D
Use innerHTML but add // comments
22

Question 22

Which library is commonly used to sanitize HTML and prevent XSS?

A
DOMPurify
B
jQuery
C
Lodash
D
Axios
23

Question 23

What is Cross-Site Request Forgery (CSRF)?

A
An attack that tricks a user’s browser into making unauthorized requests to a site where they’re authenticated
B
A virus that infects JavaScript files
C
A method to bypass HTTPS
D
A type of SQL injection
24

Question 24

Why can CSRF succeed even on secure sites?

A
Because browsers automatically include cookies with same-site requests
B
Because servers ignore authentication
C
Because JavaScript is disabled
D
Because all APIs are public
25

Question 25

Which HTTP methods are most commonly targeted in CSRF attacks?

A
POST and state-changing GET requests
B
OPTIONS
C
HEAD
D
Only PUT
26

Question 26

Can a CSRF attack read the response from the forged request?

A
No, due to the Same-Origin Policy
B
Yes, always
C
Only if CORS is enabled
D
Only with WebSockets
27

Question 27

Which scenario is a classic CSRF example?

A
A malicious site submits a form to your bank’s transfer endpoint while you’re logged in
B
A user types a password incorrectly
C
A script logs console errors
D
An image fails to load
28

Question 28

What is the purpose of an anti-CSRF token?

A
To provide a secret value that an attacker cannot predict or access due to Same-Origin Policy
B
To encrypt form data
C
To replace cookies
D
To compress HTTP requests
29

Question 29

Where should an anti-CSRF token be included in a form?

A
As a hidden input field
B
In the action URL
C
In a CSS class
D
In the form’s enctype
30

Question 30

What does the SameSite cookie attribute do?

A
Prevents cookies from being sent in cross-site requests
B
Encrypts cookie values
C
Makes cookies expire faster
D
Disables JavaScript access to cookies
31

Question 31

Which SameSite value allows cookies on top-level navigations but blocks them in cross-site POSTs?

A
Lax
B
Strict
C
None
D
Auto
32

Question 32

What is the “double submit cookie” pattern?

A
Sending a random token in both a cookie and a request header/body and verifying they match
B
Submitting the same form twice
C
Using two different cookies for session
D
Requiring two-factor authentication
33

Question 33

Which code snippet shows a secure way to include a CSRF token in a fetch request?

javascript
// Assume csrfToken is rendered in a meta tag or global JS var
fetch('/transfer', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-CSRF-Token': csrfToken  // from trusted source
  },
  body: JSON.stringify({ to: 'attacker', amount: 100 })
})
A
Including the token in a custom header like X-CSRF-Token
B
Putting the token in the URL
C
Omitting the token entirely
D
Using eval to generate the token
34

Question 34

Why can’t an attacker read your CSRF token if it’s in a meta tag?

A
Because of the Same-Origin Policy—cross-origin scripts can’t read your page’s DOM
B
Because meta tags are encrypted
C
Because browsers block all scripts
D
Because tokens expire in 1ms
35

Question 35

What is a limitation of relying only on SameSite cookies for CSRF protection?

A
Older browsers may not support SameSite or may ignore it
B
SameSite breaks all forms
C
It only works with GET requests
D
It requires WebAssembly
36

Question 36

How should CSRF tokens be generated?

A
Using a cryptographically secure random value per user session
B
Using the user’s email as the token
C
Hardcoding "secret123" for all users
D
Incrementing a counter
37

Question 37

Which cookie attribute should accompany SameSite=None?

A
Secure
B
HttpOnly
C
Partitioned
D
Max-Age
38

Question 38

What is wrong with this form?

html
<form action="/delete-account" method="POST">
  <button type="submit">Delete</button>
</form>
A
It lacks a CSRF token, making it vulnerable to forged submissions
B
It uses POST instead of GET
C
It has no CSS
D
It uses a button
39

Question 39

Why is it unsafe to store a CSRF token in localStorage and send it in a header?

A
Because XSS can read localStorage, combining XSS + CSRF into a worse attack
B
Because localStorage is slower
C
Because headers can’t contain tokens
D
Because it increases cookie size
40

Question 40

Which combination provides strong CSRF protection?

A
Anti-CSRF tokens + SameSite=Lax cookies + avoiding state changes via GET
B
Only using HTTPS
C
Minifying JavaScript
D
Using base64 encoding

Other Quiz Categories

Rust
30 quizzes
Cargo and Project Setup
Variables and Mutability
Data Types
Python
29 quizzes
Introduction & Core Fundamentals
Data Types Overview
Type Casting
Golang
29 quizzes
Basics & Syntax
Data Types & Zero Values
Operators & Expressions
C++
26 quizzes
Basics
Variables & Data Types
Operators & Expression
Java
22 quizzes
Java Basics & JVM Fundamentals
Variables, Data Types & Type Casting
Operators & Expressions
Matlab
21 quizzes
Basics & Environment
Variables and Data Type
Arrays and Matric
TypeScript
19 quizzes
Introduction and Overview
Installation and Configuration
Basic Types and Type Annotations
SQL Database
15 quizzes
Foundations and Basics
Basic Query Selection
Filter, Sort, and Alias Essentials
PHP
15 quizzes
Syntax Building Blocks
Variable Naming
Data Types Overview
Linked List
11 quizzes
Introduction
Node Structure and Pointer Fundamentals
Singly Linked List

QUIZZES IN JavaScript

1

Basics

40

A beginner-friendly quiz to evaluate your understanding of core JavaScript fundamentals including variables, data types, operators, and foundational syntax. This quiz builds the base for mastering more advanced JavaScript concepts.

2

Variables & Data Types

50

A focused JavaScript quiz dedicated to variables, scope, primitive values, reference types, and type conversion. Use this set to check how well you understand declarations, assignments, comparison rules, and everyday runtime behaviour.

3

Operators & Expressions

50

A detailed JavaScript quiz exploring arithmetic, comparison, logical, bitwise, and assignment operators through practical expressions and tricky evaluation scenarios.

4

Strings & String Methods

75

Tackle 75 JavaScript string challenges that cover formatting, slicing, searching, pattern matching, and Unicode-safe manipulation to solidify everyday text-processing skills.

5

Numbers & Math Operations

75

Master 75 JavaScript questions that cover numeric literals, parsing, formatting, math utilities, and the edge cases every engineer hits when working with numbers.

6

Arrays & Basic Array Methods

100

Tackle 100 JavaScript array questions that range from everyday indexing to tricky splice mutations and iteration strategies. Forty questions supply runnable code so you can reason through exact behaviour before answering.

7

Objects & Key/Value Manipulation

75

Explore 75 JavaScript object questions that cover construction, property access, mutation, introspection, cloning, and immutability. Thirty questions include runnable snippets so you can reason through exact behaviour before answering.

8

Control Flow (if, else, switch)

50

Explore 50 JavaScript control-flow questions covering branching, truthiness, equality pitfalls, nested decisions, switch mechanics, fallthrough, and short-circuit expressions. Twenty questions include runnable snippets so you can reason about exact evaluation before answering.

9

Functions & Parameters

50

Explore 50 JavaScript function questions covering declarations, expressions, arrow functions, scopes, parameters, defaults, rest arguments, return values, closures, and execution flow.

10

Boolean Logic & Truthy/Falsy

50

Explore 50 JavaScript questions covering boolean values, logical operators, comparison pitfalls, truthy/falsy coercion, short-circuit flow, optional chaining, nullish coalescing, ternaries, and real-world conditional patterns.

11

Type Conversion & Coercion

50

Explore 50 JavaScript questions that test implicit coercion, explicit casts, string and number conversions, truthy/falsy evaluations, equality quirks, arithmetic side effects, ToPrimitive algorithms, JSON behavior, and the most common pitfalls developers hit when the engine reshapes data types.

12

Basic Error Types (SyntaxError, TypeError)

40

Explore 40 JavaScript questions covering SyntaxError definitions, parsing mistakes, prevention strategies, TypeError causes, undefined versus null access issues, strict mode implications, debugging stacks, try/catch usage, and best practices for runtime resilience.

13

Console API (log, error, table)

40

Explore 40 questions that cover console.log, console.error, console.table, message formatting, styling, grouping, timing, assertions, debugging workflows, clearing output, and practical logging best practices in JavaScript.

14

Basic Debugging in Browser DevTools

30

Understand 30 questions covering how to open DevTools, inspect the DOM, use the console, set and manage breakpoints, step through code, inspect the call stack, monitor network calls, leverage overrides, analyze performance and memory, debug event listeners, and work in responsive design mode.

15

Math Object & Random Numbers

50

Explore 50 JavaScript questions covering Math constants, rounding methods, min/max, exponentiation, roots, absolute values, sign detection, trig/log functions, random generation, range helpers, conceptual seeding, randomization patterns, and performance tips for numerical code.

16

Array Iteration Essentials (forEach)

40

Cover 40 questions on how Array.forEach works, callback parameters, side effects, mutation patterns, differences versus loops and map/filter, thisArg usage, arrow callbacks, early-exit limitations, nested iterations, object handling, common patterns, debugging techniques, and best practices.

17

Basic Date Handling (Date object)

50

Answer 50 questions on JavaScript Date basics: creating instances, timestamps, extracting components, setting values, parsing strings, basic formatting, Date.now, arithmetic, time zones, UTC helpers, comparisons, ISO conversion, and common pitfalls.

18

Intro to DOM (querySelector & textContent)

40

Answer 40 questions covering DOM fundamentals, document structure, element selection with querySelector/querySelectorAll, CSS selector usage, reading and updating textContent, handling null results, safe DOM manipulation, and best practices.

19

Prototype & Inheritance

75

Tackle 75 questions covering prototype chain fundamentals, __proto__ vs prototype, constructor functions, adding and overriding prototype methods, Object.create patterns, class syntax with extends/super, distinguishing instance vs prototype data, checking inheritance relationships, understanding this, performance considerations, pitfalls, and best practices.

20

Classes & OOP

50

Work through 50 questions on class syntax, constructors, instance and static members, getters/setters, inheritance with extends/super, private fields, composition vs inheritance, using this, creating multiple instances, basic design patterns, and best practices.

21

Modules (import/export)

50

Answer 50 questions on ES modules: named vs default exports, import syntax variations, renaming, exporting functions/classes/constants, re-exporting, module scope, namespace imports, dynamic import(), browser/module loading, resolution rules, Node.js ESM/CommonJS, bundling basics, and best practices.

22

Error Handling (try, catch, finally)

40

Tackle 40 questions on why try/catch exists, how to structure catch/finally blocks, inspecting error objects, throwing custom errors, handling specific cases, nesting handlers, and modern best practices.

23

Asynchronous JS (Callbacks)

75

Answer 75 questions on asynchronous JavaScript callbacks: fundamentals, error-first patterns, execution order, callback hell, timers, DOM and I/O callbacks, higher-order functions, data passing, chaining, and modern replacements like Promises.

24

Promises & Promise Chaining

40

Tackle 40 questions about JavaScript Promises: states, creating promises, then/catch/finally, value chaining, error propagation, avoiding callback hell, Promise.all, Promise.race, and coordinating multiple async operations.

25

Async/Await Deep Understanding

40

Answer 40 questions on async/await internals: how async functions work, await behavior, try/catch error handling, sequential vs parallel flows, awaiting multiple promises, mixing with raw promises, event loop interaction, return values, pitfalls, and best practices.

26

Execution Context

40

Dive into 40 questions covering how JavaScript builds global and function execution contexts, creation and execution phases, lexical and variable environments, scope chains, hoisting, this binding, and call stack behavior.

27

Hoisting & Temporal Dead Zone

40

Tackle 40 questions covering hoisting concepts, var behavior, function declaration hoisting, function expressions, let/const characteristics, temporal dead zone pitfalls, runtime errors, and best practices.

28

Closures & Lexical Environment

40

Study 40 JavaScript questions on lexical scoping, scope chains, closure creation, accessing outer variables, state preservation, memory considerations, and avoiding accidental closures.

29

Scope Types (Global, Block, Function)

30

Learn 30 questions that analyze JavaScript global scope, function scope, block scope, var quirks, visibility rules, shadowing, scope chains, and best practices for managing identifiers.

30

Event Loop & Microtasks Introduction

50

Answer 50 questions about the JavaScript event loop, call stack, macrotasks, microtasks, promise timing, rendering, async APIs, starvation risks, and debugging workflows.

31

Advanced Array Methods (map, filter, reduce)

35

Answer 35 questions that dive into map transformations, filter logic, reduce accumulations, callback signatures, immutability, chaining, patterns, performance trade-offs, and behavior comparisons.

32

Spread & Rest Operator Deep Usage

35

Answer 35 questions exploring spread on arrays and objects, cloning behavior, combining collections, rest parameters, destructuring techniques, pitfalls, performance trade-offs, and modern practical patterns.

33

6 Destructuring Use Cases (Nested, Default)

30

Tackle 30 questions on nested object/array destructuring, defaults, renaming bindings, destructuring parameters, and skipping positions.

34

Template Literals Advanced (Tagged Templates)

35

Answer 35 questions digging into template literal basics, tagged function mechanics, string/value processing, security sanitization, custom formatting, localization, DSL construction, and performance trade-offs.

35

Regular Expressions Basics

35

Answer 35 questions covering regex literal vs constructor syntax, metacharacters, character classes, quantifiers, anchors, grouping, escaping, and JS testing/matching methods.

36

Shallow vs Deep Copying Objects

30

Answer 30 questions comparing shallow copy techniques, deep copy strategies, spread/Object.assign behavior, JSON and structuredClone approaches, reference vs value semantics, and common pitfalls like cyclic structures.

37

JSON Handling (stringify, parse pitfalls)

40

Answer 40 questions covering JSON.stringify basics, JSON.parse behavior, handling undefined and functions, circular structure errors, Date serialization, number precision, reviver/replacer usage, and safe parsing practices.

38

DOM Events Bubbling & Capturing

30

Answer 30 questions on event propagation phases, capturing basics, target behavior, bubbling mechanics, addEventListener options, stopping propagation, preventing default actions, and event delegation techniques.

39

Performance Optimization Techniques

35

Answer 35 questions on minimizing reflows, debouncing/throttling, faster loops, efficient structures, avoiding leaks, web workers, lazy loading, caching, cutting re-renders, and profiling with DevTools.

40

Iterators & Generators (yield, next, custom iterators)

35

Answer 35 questions covering iterator protocol basics, next() behavior, iterable objects, generator syntax, yield mechanics, execution control, passing values, custom iterators, lazy generator use cases, and async-iterator differences.

41

Async Iteration & for-await-of

35

Answer 35 questions covering the async iterator protocol, Symbol.asyncIterator, async generator syntax, yield vs yield*, promise handling, for-await-of mechanics, error management, streaming data scenarios, and using async generators with fetch.

42

Debounce & Throttle Patterns

35

Answer 35 questions covering debounce timing, throttle intervals, leading/trailing triggers, preventing noisy events, scroll/input use cases, manual implementations, pitfalls, and UI performance gains.

43

Shadow DOM & Web Components Basics

35

Answer 35 questions on custom element fundamentals, shadow DOM encapsulation, open vs closed roots, templates and slots, style isolation, lifecycle callbacks, reusable component design, and light/shadow DOM interaction.

44

Intersection Observer

35

Answer 35 questions covering observers and targets, threshold/rootMargin tuning, lazy-loading patterns, visibility detection, cleanup best practices, entry properties, performance wins vs scroll events, and common use cases like infinite scroll, animations, and analytics.

45

MutationObserver: Watching DOM Changes

35

Test your knowledge with 35 questions on MutationObserver—covering DOM observation, configuration options, attribute and child tracking, subtree monitoring, mutation records, cleanup, performance, and real-world use cases.

46

Browser Rendering Pipeline

35

Test your understanding of how browsers render web pages with 35 questions covering HTML/CSS/JS parsing, the Critical Rendering Path, layout, painting, compositing, and performance optimizations.

47

Security Basics

40

Test your knowledge with 40 questions on web security fundamentals—covering XSS types, prevention strategies, CSRF mechanics, and defense techniques like tokens, SameSite cookies, and Content Security Policy.