0 / 17 answered

1. 1. Which statements about WordPress nonces are correct?

   Select all correct answers.

   Which statements about WordPress nonces are correct?

   A WordPress nonce can technically be used only once. They are a complete authorization mechanism on their own. They should be combined with a capability check when authorizing a sensitive action. They help confirm the intent behind a request.
   Hint

   A nonce verifies intent, not the user’s role or capabilities.

2. 2. Which output-escaping pairs are appropriate for their context?

   Select all correct answers. The values are dynamic and are about to be rendered.

   Which output-escaping pairs are appropriate for their context?

   esc_html() for text placed between HTML tags. esc_attr() is preferable to esc_url() for every URL. sanitize_text_field() always replaces escaping at output time. esc_url() for a URL placed in href or src.
   Hint

   Visible HTML text and a URL attribute require different escaping functions.

3. 3. What is the difference between sanitizing and escaping data?

   Choose the most accurate statement for WordPress development.

   What is the difference between sanitizing and escaping data?

   Sanitization is needed only in themes. They are two names for the same operation. Sanitize input; escape output according to its context. Escape input once and output it without further checks.
   Hint

   Think about when data enters the system and when it leaves for the browser.

4. 4. Which function should authorize whether the current user may perform a WordPress operation?

   Choose the function intended for capability checks.

   Which function should authorize whether the current user may perform a WordPress operation?

   current_user_can() is_admin() get_bloginfo() wp_verify_nonce() alone
   Hint

   Roles group capabilities, but code should generally check the required capability.

5. 5. Why is a valid WordPress nonce not sufficient authorization?

   Why is a valid WordPress nonce not sufficient authorization?

   Nonces contain the user password A nonce verifies intent and request origin, not the user capability A nonce sanitizes submitted data Nonces work only for administrators
   Hint

   Intent and permission are separate questions.

6. 6. When is wp_kses_post() appropriate?

   When is wp_kses_post() appropriate?

   When escaping a URL attribute When allowing only HTML permitted in normal post content When preparing SQL When hashing a password
   Hint

   It is an allow-list HTML filter.

7. 7. Which checks are important before accepting an uploaded file?

   Which checks are important before accepting an uploaded file?

   Capability, nonce, size and allowed file type Only the file extension Only the original filename The referring page title
   Hint

   Client-provided names and MIME values are not enough.

8. 8. In a REST endpoint, where should resource-specific authorization be enforced?

   In a REST endpoint, where should resource-specific authorization be enforced?

   In the response headers Only in the JavaScript client In the route namespace In permission_callback
   Hint

   The server must enforce authorization before the main callback.

9. 9. Which function should be preferred when redirecting to a URL that must stay on an allowed host?

   Which function should be preferred when redirecting to a URL that must stay on an allowed host?

   header() with unvalidated input wp_send_json() esc_url() wp_safe_redirect()
   Hint

   Escaping a string is not the same as validating a redirect destination.

10. 10. What is the difference between validation and sanitization?

    What is the difference between validation and sanitization?

    Validation rejects unacceptable input; sanitization cleans it into an acceptable form Validation escapes output Sanitization grants capabilities They are identical
    Hint

    Reject versus clean.

11. 11. How should a URL placed inside an HTML href attribute normally be escaped?

    How should a URL placed inside an HTML href attribute normally be escaped?

    esc_html() wp_slash() sanitize_key() esc_url()
    Hint

    Use the function designed for URL contexts.

12. 12. Why is escaping recommended as late as possible?

    Why is escaping recommended as late as possible?

    The final output context is known at that point It makes SQL faster It eliminates capability checks Escaped data is safer to store
    Hint

    Stored data may be reused in different contexts.

13. 13. What is a benefit of checking object-level capabilities such as edit_post with an object ID?

    What is a benefit of checking object-level capabilities such as edit_post with an object ID?

    WordPress can map the request through ownership and post-type rules It skips authentication It disables roles It makes the post public
    Hint

    Authorization may depend on the object owner and status.

14. 14. Which API should plugin code use to hash a WordPress-compatible password?

    Which API should plugin code use to hash a WordPress-compatible password?

    wp_hash_password() sanitize_text_field() md5() base64_encode()
    Hint

    Do not invent password storage.

15. 15. Where should API secrets generally not be exposed?

    Where should API secrets generally not be exposed?

    Public JavaScript, HTML, or repository-tracked configuration A non-public server constant A protected secrets manager Server-side environment configuration
    Hint

    Frontend code cannot keep a secret.

16. 16. Why should an uploaded filename not be trusted as a filesystem path?

    Why should an uploaded filename not be trusted as a filesystem path?

    PHP removes every extension It is user-controlled and may contain unsafe or conflicting components WordPress filenames are always encrypted Browsers guarantee uniqueness
    Hint

    Treat names as input.

17. 17. Which attack are WordPress nonces primarily intended to mitigate?

    Which attack are WordPress nonces primarily intended to mitigate?

    Server-side request forgery SQL injection by themselves Password brute force Cross-site request forgery
    Hint

    They do not replace validation, escaping or authorization.