0 / 20 answered

1. 1. How should server-side WordPress code treat submitted form data?

   How should server-side WordPress code treat submitted form data?

   As an administrator request As already escaped SQL As untrusted input As safe because it came from the site
   Hint

   Identify the data-model or security responsibility before choosing the API.

2. 2. Why check the expected HTTP method in a form handler?

   Why check the expected HTTP method in a form handler?

   To load the active theme To reject requests that do not follow the endpoint contract To grant capabilities To escape output
   Hint

   Identify the data-model or security responsibility before choosing the API.

3. 3. What does a WordPress nonce primarily verify?

   What does a WordPress nonce primarily verify?

   That a user has every capability That input is valid Request intent and origin within a time window That SQL is prepared
   Hint

   Identify the data-model or security responsibility before choosing the API.

4. 4. Which function prints a hidden nonce field for a form?

   Which function prints a hidden nonce field for a form?

   esc_attr() wp_create_user() wp_nonce_field() current_user_can()
   Hint

   Identify the data-model or security responsibility before choosing the API.

5. 5. Which function verifies a general WordPress nonce?

   Which function verifies a general WordPress nonce?

   check_password() sanitize_text_field() wp_nonce_field() wp_verify_nonce()
   Hint

   Identify the data-model or security responsibility before choosing the API.

6. 6. What does check_admin_referer() help verify?

   What does check_admin_referer() help verify?

   A theme stylesheet An administration request nonce and expected action A database query A user password hash
   Hint

   Identify the data-model or security responsibility before choosing the API.

7. 7. Why is a valid nonce not enough to authorize a change?

   Why is a valid nonce not enough to authorize a change?

   It contains no timestamp It cannot be used in forms It does not prove the user has permission for the operation It is always public
   Hint

   Identify the data-model or security responsibility before choosing the API.

8. 8. What does current_user_can() check?

   What does current_user_can() check?

   Whether the current user has a capability in context Whether a nonce exists Whether PHP is current Whether a value is sanitized
   Hint

   Identify the data-model or security responsibility before choosing the API.

9. 9. Why pass an object ID when checking a meta capability such as edit_post?

   Why pass an object ID when checking a meta capability such as edit_post?

   Permission may depend on that object, its author and status It changes the current user It sanitizes the ID It creates the post
   Hint

   Identify the data-model or security responsibility before choosing the API.

10. 10. What does validation do?

    What does validation do?

    Grants a role Decides whether input satisfies the required rules Writes a database row automatically Escapes output for HTML
    Hint

    Identify the data-model or security responsibility before choosing the API.

11. 11. What does sanitization do?

    What does sanitization do?

    Cleans or normalizes input into an acceptable form Authorizes the user Selects a template Creates a nonce
    Hint

    Identify the data-model or security responsibility before choosing the API.

12. 12. Which function is suitable for sanitizing a simple one-line text field?

    Which function is suitable for sanitizing a simple one-line text field?

    esc_url() current_user_can() sanitize_text_field() wp_kses_post() only
    Hint

    Identify the data-model or security responsibility before choosing the API.

13. 13. Which function sanitizes an email address?

    Which function sanitizes an email address?

    wp_unslash_url() absint() esc_html() sanitize_email()
    Hint

    Identify the data-model or security responsibility before choosing the API.

14. 14. Which function sanitizes a lowercase machine-readable key?

    Which function sanitizes a lowercase machine-readable key?

    sanitize_key() esc_js() wpautop() sanitize_textarea_field()
    Hint

    Identify the data-model or security responsibility before choosing the API.

15. 15. What does absint() produce?

    What does absint() produce?

    An escaped HTML attribute A non-negative integer A boolean only A database query
    Hint

    Identify the data-model or security responsibility before choosing the API.

16. 16. Why is wp_unslash() commonly used before sanitizing request data?

    Why is wp_unslash() commonly used before sanitizing request data?

    WordPress may add slashes to request values for compatibility It decodes JSON automatically It grants capabilities It verifies a nonce
    Hint

    Identify the data-model or security responsibility before choosing the API.

17. 17. When should stored data be escaped?

    When should stored data be escaped?

    Never after sanitization Only before storing it When it is output, using the function for that context Only during plugin activation
    Hint

    Identify the data-model or security responsibility before choosing the API.

18. 18. Why redirect after a successful POST handler?

    Why redirect after a successful POST handler?

    To avoid duplicate submission on refresh To expose values in the URL To disable caching permanently To skip nonce checks
    Hint

    Identify the data-model or security responsibility before choosing the API.

19. 19. How should validation failure normally be handled?

    How should validation failure normally be handled?

    Silently store invalid data Preserve safe input where appropriate and show a clear actionable error Trigger a public fatal error Make the user an administrator
    Hint

    Identify the data-model or security responsibility before choosing the API.

20. 20. Which order best describes a secure form handler?

    Which order best describes a secure form handler?

    Confirm request, verify nonce, authorize, validate/sanitize, store, redirect, escape later output Store first, then check permission Authorize from JavaScript only Escape SQL, activate plugin, redirect
    Hint

    Identify the data-model or security responsibility before choosing the API.