I85PREP
⌘ K
NZ Scholarship Digital Technologies study materials
NZ Scholarship Digital Technologies study resources

NZ Scholarship Digital Technologies practice questions

One question at a time. Build your NZ Scholarship Digital Technologies understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Digital Technologies

In a relational database, which property must a candidate key satisfy in addition to uniqueness?

  1. It must be defined on a numeric column
  2. It must be the first column of the table
  3. It must be referenced by a foreign key
  4. It must contain no null values in any row Correct answer.

Explanation

A candidate key is a minimal set of attributes that uniquely identifies each tuple, and uniqueness cannot be guaranteed if any component is null. Referential use by another table is a consequence of chosen primary keys, not a requirement for candidacy. Numeric typing and column ordering are irrelevant to key semantics.

Question 2Digital Technologies

A programmer writes a recursive function without a base case. Which outcome best describes the resulting behaviour at runtime?

  1. The recursion is silently converted into a loop by the runtime
  2. The call stack grows until a stack overflow error terminates execution Correct answer.
  3. The compiler rejects the program before it runs
  4. The function returns zero automatically

Explanation

Each recursive call pushes a new stack frame, so without a terminating condition the frames accumulate until the call stack is exhausted. Compilers generally cannot prove absence of a base case, so this is a runtime failure rather than a compile error. No runtime automatically rewrites recursion into iteration or supplies a default return value.

Question 3Digital Technologies

Which statement correctly distinguishes symmetric from asymmetric encryption?

  1. Symmetric encryption requires a certificate authority to issue keys
  2. Symmetric is always slower than asymmetric for bulk data
  3. Asymmetric encryption cannot provide confidentiality
  4. Symmetric uses one shared key for both operations; asymmetric uses a public/private key pair Correct answer.

Explanation

Symmetric cryptography uses a single secret key for encryption and decryption, while asymmetric cryptography uses mathematically related public and private keys. Symmetric ciphers are typically much faster and are used for bulk data, with asymmetric methods often distributing the shared key. Certificates support public-key trust, not symmetric key issuance.

Question 4Digital Technologies

A web application stores user passwords. Which practice best protects them if the database is later leaked?

  1. Store an MD5 hash of each password without a salt
  2. Store a salted hash produced by a slow key-derivation function such as bcrypt or Argon2 Correct answer.
  3. Store the passwords encrypted with a key kept in the same database
  4. Store the passwords in plain text but restrict table access to administrators

Explanation

Salted, deliberately slow key-derivation functions make large-scale offline guessing expensive and prevent identical passwords producing identical stored values. Fast unsalted hashes such as MD5 are vulnerable to precomputed rainbow tables and rapid brute force. Keeping the decryption key beside the ciphertext offers no protection once the database is exposed.

Question 5Digital Technologies

Which HTML element is semantically correct for marking up a self-contained, independently distributable piece of content such as a forum post?

  1. <article> Correct answer.
  2. <aside>
  3. <section>
  4. <div>

Explanation

The article element represents a complete, self-contained composition that could stand alone or be syndicated, which matches a forum post. A div carries no semantics, a section groups thematically related content, and an aside holds tangential material. Choosing article lets assistive technology and parsers infer document structure.

Question 6Digital Technologies

In Big-O notation, what does it describe about an algorithm?

  1. An asymptotic upper bound on growth of resource use as input size increases Correct answer.
  2. The exact running time in seconds on a reference machine
  3. The maximum input size the algorithm can accept
  4. The average number of lines of source code executed

Explanation

Big-O characterises how an algorithm's resource consumption grows relative to input size in the limit, ignoring constant factors. It deliberately abstracts away hardware, implementation detail and specific timings. It does not state a hard input-size limit or a count of source lines.

Question 7Digital Technologies

A team wants every commit on the main branch to be reviewed and pass automated tests before merging. Which practice implements this?

  1. Allowing direct pushes to main but asking developers to be careful
  2. Protecting the main branch and requiring pull-request reviews plus passing CI checks Correct answer.
  3. Tagging each release with a semantic version number
  4. Rebasing feature branches onto main before every push

Explanation

Branch protection rules can block direct pushes and gate merges on required reviews and successful continuous-integration status checks. Rebase and tagging are useful workflow habits but do not enforce review or testing. Relying on developer care provides no technical guarantee.

Question 8Digital Technologies

Which statement about the TCP three-way handshake is correct?

  1. It guarantees that application messages arrive in order without loss
  2. It assigns a routable IP address to the client
  3. It encrypts the connection using a shared session key
  4. It synchronises sequence numbers and confirms both hosts are ready before data transfer Correct answer.

Explanation

The SYN, SYN-ACK, ACK exchange establishes the connection by exchanging initial sequence numbers so each side knows where to start numbering bytes. Encryption is handled by TLS above TCP, addressing by DHCP or configuration, and reliability is a property of TCP's ongoing acknowledgements rather than the handshake alone.

Question 9Digital Technologies

A hash table with separate chaining degrades toward O(n) lookup. Which condition most directly causes this?

  1. Most keys hash to the same bucket, producing long collision chains Correct answer.
  2. The load factor is kept below 0.5 through resizing
  3. The table stores string keys instead of integer keys
  4. The hash function returns values larger than the table size

Explanation

With separate chaining, lookup cost is proportional to chain length, so a poor distribution that clusters keys into one bucket makes operations linear. Resizing to keep the load factor low preserves average O(1) behaviour. Key type is irrelevant if hashing is well distributed, and large hash values are normally reduced modulo the table size.

Question 10Digital Technologies

A function checks whether a number is prime by testing divisors from 2 up to n-1. What is the tightest simple improvement that preserves correctness?

  1. Test divisors only up to the integer square root of n Correct answer.
  2. Skip the divisor 2 entirely
  3. Test divisors in descending order
  4. Test only even divisors

Explanation

If n has a factor greater than its square root, the complementary factor is smaller than the square root, so testing up to the square root is sufficient. This reduces the loop from linear to roughly square-root time. Restricting to even divisors would miss odd factors, skipping 2 misclassifies even composites, and order does not reduce the search space.

Question 11Digital Technologies

A database table of orders records customer details in every order row, so updating a customer's address requires many row edits. Which normal form primarily addresses this redundancy?

  1. First normal form, by ensuring atomic column values
  2. Second normal form, by removing partial dependencies on a composite key
  3. Third normal form, by removing transitive dependencies on non-key attributes Correct answer.
  4. Boyce-Codd normal form, by requiring every determinant to be a candidate key

Explanation

Storing customer attributes in order rows creates a transitive dependency: order key determines customer, and customer determines address. Third normal form removes such dependencies by placing customer data in its own relation. First normal form concerns atomicity, second concerns partial dependencies on composite keys, and BCNF is a stricter determinant rule.

Question 12Digital Technologies

A binary search is applied to an array that is not sorted. What is the most accurate description of the result?

  1. The algorithm may return an incorrect index because its halving assumes ordered data Correct answer.
  2. The algorithm still works but runs in linear time
  3. The algorithm sorts the array before searching
  4. The algorithm always throws an exception on unsorted input

Explanation

Binary search discards half the search space based on an ordering comparison, so unsorted data can cause the target to be discarded incorrectly. It neither detects nor repairs disorder, and it does not fall back to linear scanning. No exception is raised for unsorted input in typical implementations.

Question 13Digital Technologies

In a public-key infrastructure, what is the primary purpose of a digital certificate signed by a certificate authority?

  1. To record every transaction the holder performs
  2. To bind a public key to a verified identity so relying parties can trust it Correct answer.
  3. To encrypt the holder's private key for backup
  4. To compress the public key for faster transmission

Explanation

A certificate authority signs a statement asserting that a given public key belongs to a named entity, allowing others to verify that binding via the CA's trusted signature. Private keys are never included in certificates, and certificates are not compression or logging mechanisms. Trust flows from the CA's signature to the key-identity binding.

Question 14Digital Technologies

A REST API returns the same resource representation regardless of who requests it, and responses are cached by intermediaries. Which HTTP header most directly enables this caching behaviour?

  1. Cache-Control: public, max-age=3600 Correct answer.
  2. Authorization: Bearer token
  3. Content-Type: application/json
  4. Set-Cookie: session=abc123

Explanation

Cache-Control with public and max-age tells shared caches they may store the response for the stated lifetime. Authorization headers and Set-Cookie typically make responses private or uncacheable by shared caches. Content-Type merely declares the media type and has no caching semantics.

Question 15Digital Technologies

A program uses a mutex to protect a shared counter. What problem does the mutex prevent?

  1. Memory leaks from unreleased allocations
  2. Deadlocks between threads waiting on each other
  3. Race conditions caused by concurrent read-modify-write operations Correct answer.
  4. Stack overflow from deep recursion

Explanation

A mutex ensures only one thread at a time executes the critical section, so an increment's read, modify and write steps cannot interleave and corrupt the value. Mutexes can actually contribute to deadlock if acquired in inconsistent orders, and they do nothing about memory management or recursion depth.

Question 16Digital Technologies

A team adopts a continuous delivery pipeline. Which statement best captures what continuous delivery guarantees?

  1. Manual testing is eliminated from the process
  2. Deployment frequency is fixed at once per day
  3. Every change that passes automated checks is deployable to production at any time Correct answer.
  4. Every change is automatically released to all users without approval

Explanation

Continuous delivery keeps the mainline in a releasable state by running automated build, test and verification stages, but the decision to release may remain manual. Continuous deployment, a stricter practice, releases automatically. Neither practice prescribes a fixed cadence or forbids manual exploratory testing.

Question 17Digital Technologies

A dataset contains 1,000 records, of which 100 are actually positive. A classifier flags 200 records as positive, and 80 of those are truly positive. What are the precision and recall?

  1. Precision 0.50, recall 0.50
  2. Precision 0.80, recall 0.40
  3. Precision 0.40, recall 0.80 Correct answer.
  4. Precision 0.20, recall 0.10

Explanation

Precision is true positives divided by predicted positives, 80/200 = 0.40. Recall is true positives divided by actual positives, 80/100 = 0.80. The remaining options either swap the two metrics or divide by the wrong totals.

Question 18Digital Technologies

A neural network with many layers trains poorly because gradients shrink toward zero as they propagate back. Which technique most directly mitigates this?

  1. Increasing the learning rate by a factor of one hundred
  2. Removing all activation functions
  3. Using residual or skip connections that let gradients bypass layers Correct answer.
  4. Training on a smaller subset of the data

Explanation

Residual connections provide shortcut paths so gradients can flow to earlier layers without repeated multiplication by small weights, which is the core fix for vanishing gradients in deep networks. Excessively large learning rates destabilise training, removing activations collapses the network to a linear model, and reducing data does not address gradient magnitude.

Question 19Digital Technologies

Which situation is most appropriately modelled with a graph traversal rather than a relational join?

  1. Counting rows that match a status value
  2. Finding the shortest path between two users in a social network Correct answer.
  3. Filtering products by price range
  4. Summing order totals grouped by customer region

Explanation

Shortest-path queries over highly connected entities are naturally expressed as breadth-first traversal of a graph, where each hop is an edge. Aggregation, range filtering and counting are set operations well served by relational queries. The distinguishing factor is whether relationships between entities must be followed repeatedly.

Question 20Digital Technologies

A developer wants to prevent SQL injection in a login query. Which approach is most robust?

  1. Escape single quotes in the username field only
  2. Use parameterised queries so user input is bound as data, not concatenated into SQL Correct answer.
  3. Restrict the input length to twenty characters
  4. Hide database error messages from users

Explanation

Parameterised queries separate the SQL statement structure from the supplied values, so input can never alter query syntax. Manual escaping is error-prone and easy to bypass across different database engines. Length limits and hidden errors reduce some exposure but do not stop injection.

Question 21Digital Technologies

An algorithm runs in O(n log n) time. If the input size doubles, how does the running time change asymptotically?

  1. It slightly more than doubles Correct answer.
  2. It exactly doubles
  3. It stays the same
  4. It quadruples

Explanation

Doubling n changes n log n to 2n(log n + 1), which is 2n log n plus an extra 2n term, so the time is a little more than twice the original. Exact doubling would require linear time, quadrupling would require quadratic time, and constant time would be unchanged. The logarithmic factor grows slowly but is not fixed.

Question 22Digital Technologies

A relational schema stores a many-to-many relationship between students and courses. What is the standard correct design?

  1. A foreign key from students to courses
  2. A comma-separated list of course IDs in the student row
  3. Duplicating course details in every student row
  4. A junction table with foreign keys to both students and courses, with a composite key Correct answer.

Explanation

A many-to-many relationship requires an associative table whose rows pair one student with one course; the pair forms a composite candidate key and each column is a foreign key. A single foreign key can only represent one-to-many, while comma-separated lists violate first normal form. Duplicating course details reintroduces redundancy and update anomalies.

Question 23Digital Technologies

A system must remain available during network partitions and can tolerate temporary inconsistency. Which CAP theorem trade-off does this describe?

  1. Refusing all writes during any partition
  2. Choosing availability and partition tolerance over strong consistency Correct answer.
  3. Choosing consistency and partition tolerance over availability
  4. Choosing consistency and availability while ignoring partitions

Explanation

CAP states that during a network partition a distributed system must sacrifice either consistency or availability. A system that keeps serving reads and writes and accepts temporary divergence chooses availability with partition tolerance, often called AP. Refusing writes during a partition would instead favour consistency.

Question 24Digital Technologies

A team must decide between a monolithic and a microservices architecture for a small application with a two-person team and tight deadlines. Which reasoning is strongest?

  1. A modular monolith reduces operational overhead and suits the team size and timeline Correct answer.
  2. Microservices always improve reliability regardless of team size
  3. Microservices eliminate the need for inter-service communication design
  4. A monolith cannot be tested or deployed automatically

Explanation

Microservices trade simpler internal code for distributed-system complexity: networking, deployment orchestration, observability and data consistency across services. With two developers and a tight deadline, that overhead is hard to justify, and a well-modularised monolith offers clear boundaries with far less operational burden. Architecture claims stated as absolutes ignore context.

Question 25Digital Technologies

A hash function used for storing passwords must resist which specific attack that a general-purpose checksum does not address?

  1. Offline brute-force and rainbow-table attacks enabled by fast computation Correct answer.
  2. Cross-site request forgery on authenticated sessions
  3. Packet sniffing on unencrypted networks
  4. Denial of service through oversized request bodies

Explanation

Password hashing must be deliberately slow and salted so attackers holding a leaked hash cannot cheaply test billions of candidates or reuse precomputed tables. General-purpose checksums are designed for speed, which aids attackers. Request-size limits, CSRF tokens and transport encryption address entirely different threat categories.

Question 26Digital Technologies

In software testing, what is the key distinction between a stub and a mock used as test doubles?

  1. A stub verifies interactions, whereas a mock only returns canned responses
  2. A stub returns canned responses, whereas a mock also records and verifies interactions Correct answer.
  3. A mock replaces the database, whereas a stub replaces the entire network stack
  4. A stub is always written in a different language from the code under test

Explanation

Test doubles differ by whether they merely supply indirect inputs or also assert on how the collaborator was called. A stub provides predetermined answers so the unit under test can proceed, while a mock additionally records calls and lets the test verify expectations about them. This behavioural-verification role is what separates the two.

Question 27Digital Technologies

A programmer writes a recursive function to compute Fibonacci numbers directly from the recurrence F(n)=F(n-1)+F(n-2). Why does this naive recursion become extremely slow for moderate n?

  1. Each recursive call performs an expensive database query
  2. The same subproblems are recomputed exponentially many times Correct answer.
  3. The call stack grows only logarithmically, which wastes memory
  4. Recursion cannot express the Fibonacci recurrence correctly

Explanation

Naive recursion recomputes overlapping subproblems, so the number of calls grows roughly exponentially even though only n distinct values exist. Memoisation or dynamic programming stores each result once, reducing the work to linear time. The inefficiency is redundant computation, not the recurrence itself.

Question 28Digital Technologies

Which statement best describes the purpose of a version control branch in a collaborative development workflow?

  1. It replaces the need for any automated testing
  2. It permanently locks files so that only one developer may edit them
  3. It automatically deploys code to production on every save
  4. It creates an isolated line of development that can later be merged Correct answer.

Explanation

A branch lets developers diverge from the main line and commit independently, then integrate their work through a merge or pull request. This isolation supports parallel work and review without disrupting others. Branches do not lock files, deploy automatically, or remove the need for tests.

Question 29Digital Technologies

In a relational database, what does a foreign key constraint enforce?

  1. That the table is automatically indexed on every column
  2. That deleted rows are permanently archived in a backup table
  3. That each value in a column references an existing row in another table Correct answer.
  4. That every column in the table contains a unique value

Explanation

A foreign key ties a column to a referenced key, typically the primary key of another table, so values must match an existing row unless NULL is permitted. This maintains referential integrity across related tables. It does not impose uniqueness or indexing on its own.

Question 30Digital Technologies

A web application must let users stay logged in across requests without sending their password each time. Which mechanism most appropriately achieves this?

  1. A signed session token stored in a cookie and validated on each request Correct answer.
  2. Storing the plaintext password in a cookie for the server to compare
  3. Embedding the password in every URL query string
  4. Disabling HTTPS so the cookie is transmitted faster

Explanation

A signed session token lets the server recognise an authenticated user without re-sending credentials, and signing prevents tampering. The password itself should never be stored client-side or exposed in URLs. Transport should remain encrypted with HTTPS.

Question 31Digital Technologies

A binary tree is described as a binary search tree. Which property must hold for every node?

  1. All keys in the left subtree are smaller and all in the right subtree are larger Correct answer.
  2. Keys are stored in insertion order regardless of value
  3. The tree is perfectly balanced at every level
  4. Every node has exactly two children

Explanation

The defining invariant of a binary search tree is the ordering between a node and all keys in its subtrees, which enables ordered search. Balance and fullness are separate properties. Without the ordering invariant, search cannot reliably discard half the tree.

Question 32Digital Technologies

A developer needs to store configuration values as key-value pairs that must persist across program restarts. Which approach is most appropriate?

  1. Keep them only in global variables in memory
  2. Write the values to a file or database and read them at startup Correct answer.
  3. Hard-code them into the compiled binary and never update them
  4. Print them to standard output and rely on the console history

Explanation

Persistence requires storage outside process memory, such as a configuration file or database, loaded when the program starts. In-memory variables vanish when the process exits. Console output and hard-coding do not provide durable, updatable configuration.

Question 33Digital Technologies

In agile estimation, what does a story point primarily measure?

  1. The exact number of hours the task will take
  2. Relative effort and complexity rather than elapsed time Correct answer.
  3. The salary cost assigned to the task
  4. The number of lines of code to be written

Explanation

Story points express relative size, combining effort, complexity, and uncertainty, so teams can estimate consistently without pretending to predict exact durations. They are deliberately unitless. Converting them directly to hours undermines their purpose.

Question 34Digital Technologies

A function is described as pure. Which characteristic must it have?

  1. It always runs in constant time
  2. It returns the same output for the same input and has no side effects Correct answer.
  3. It must be recursive
  4. It must modify at least one global variable

Explanation

A pure function is deterministic and free of observable side effects such as mutation or I/O. This makes it easier to test and reason about, and enables safe caching. Performance and recursion are unrelated to purity.

Question 35Digital Technologies

A program reads a list of integers and must output them in ascending order. Which algorithm has the best worst-case time complexity among the following for large inputs?

  1. Bubble sort
  2. Insertion sort
  3. Selection sort
  4. Merge sort Correct answer.

Explanation

Merge sort guarantees O(n log n) comparisons in the worst case, whereas bubble, insertion, and selection sort are O(n^2). For large inputs the asymptotic difference dominates. Insertion sort can be fast on nearly sorted data but still degrades quadratically.

Question 36Digital Technologies

An API is designed to be idempotent. Which HTTP method is idempotent by specification when applied to a resource?

  1. PUT Correct answer.
  2. POST
  3. PATCH when used for arbitrary partial updates
  4. CONNECT

Explanation

PUT replaces a resource with the supplied representation, so repeating the same request leaves the resource in the same state. POST typically creates a new subordinate resource each time and is therefore not idempotent. Idempotency concerns repeated identical requests, not safety.

Question 37Digital Technologies

A developer wants to reduce the risk of a single point of failure in a web service. Which design change most directly addresses this?

  1. Increase the timeout on every outbound request
  2. Compress responses to reduce bandwidth
  3. Store all session data on one dedicated server
  4. Run multiple redundant instances behind a load balancer Correct answer.

Explanation

Redundancy removes the single point of failure because traffic can be routed to surviving instances if one fails. A load balancer distributes requests across them. Timeouts, centralised session storage, and compression do not eliminate the failure dependency.

Question 38Digital Technologies

A team wants to detect when a code change introduces a regression before it reaches users. Which practice best supports this?

  1. Relying on manual testing only after release
  2. Removing tests to speed up merges
  3. Running an automated test suite in the integration pipeline Correct answer.
  4. Deploying straight to production without staging

Explanation

Automated tests executed in the pipeline catch regressions at integration time, before deployment. Manual post-release testing discovers problems only after users are affected. Removing tests or skipping staging increases risk rather than reducing it.

Question 39Digital Technologies

In a relational schema, a column contains values that depend only on part of a composite primary key. Which normal form is violated?

  1. Third normal form
  2. First normal form
  3. Boyce-Codd normal form only
  4. Second normal form Correct answer.

Explanation

Second normal form requires that no non-key attribute depend on only part of a composite key; such partial dependencies are removed by decomposition. First normal form concerns atomic values, and third normal form concerns transitive dependencies among non-key attributes.

Question 40Digital Technologies

A program must process a stream of events in the order they arrive, using a first-in-first-out discipline. Which data structure is most appropriate?

  1. Binary heap
  2. Queue Correct answer.
  3. Stack
  4. Hash table

Explanation

A queue removes elements in the same order they were inserted, matching FIFO processing of a stream. A stack is last-in-first-out and would reverse the order. Hash tables and heaps do not preserve arrival order.

Question 41Digital Technologies

A developer must choose a data structure to support frequent lookups by unique user ID with average constant-time access. Which choice is best?

  1. A hash table keyed by user ID Correct answer.
  2. A sorted array searched with binary search
  3. A stack of user records
  4. A singly linked list searched linearly

Explanation

A hash table provides average O(1) lookup when keys are well distributed, which suits frequent access by unique identifier. Linear search is O(n), binary search on a sorted array is O(log n) and costly to maintain under inserts, and a stack offers no key lookup.

Question 42Digital Technologies

A program must be able to undo the most recent user action first. Which structure most naturally models this?

  1. Set
  2. Graph
  3. Stack Correct answer.
  4. Queue

Explanation

Undo semantics are last-in-first-out, which a stack models directly: the most recently pushed action is popped first. A queue would undo the oldest action first. Graphs and sets do not encode recency ordering.

Question 43Digital Technologies

A function processes a list of n items and, for each item, performs a constant-time operation. What is its time complexity?

  1. O(n) Correct answer.
  2. O(n^2)
  3. O(1)
  4. O(log n)

Explanation

A single pass that does constant work per element performs a number of operations proportional to n, giving linear complexity. Logarithmic complexity would require halving the problem each step, and quadratic would require a nested loop over the input.

Question 44Digital Technologies

A web page loads slowly because it requests many small images from the same server. Which change most directly reduces the number of round trips?

  1. Increase the server's CPU allocation
  2. Rename each image file
  3. Combine the images into a single sprite or use a CDN with caching Correct answer.
  4. Remove all caching headers

Explanation

Fewer requests mean fewer round trips, so combining images or serving them through a caching CDN reduces latency. More CPU does not reduce request count, and removing caching headers forces revalidation and increases traffic. Renaming files has no performance effect.

Question 45Digital Technologies

A developer is asked to explain why an index speeds up a database query. Which explanation is most accurate?

  1. It rewrites the query into a faster language
  2. It provides a structure that lets the engine locate matching rows without scanning the whole table Correct answer.
  3. It stores a second copy of every row on disk
  4. It removes the need for transactions

Explanation

An index, often a B-tree, allows the engine to seek matching rows rather than performing a full table scan. This reduces the number of rows examined for selective queries. Indexes do not duplicate entire rows, change query language, or affect transaction guarantees.

Question 46Digital Technologies

A distributed system uses eventual consistency. Which guarantee does this provide?

  1. All nodes are updated in the same instant
  2. Writes are rejected during any network delay
  3. Every read always returns the most recent write
  4. Replicas converge to the same value once updates stop propagating Correct answer.

Explanation

Eventual consistency promises convergence: given no new updates, replicas will eventually agree. It does not promise that a read immediately reflects the latest write. Immediate global agreement would be strong consistency, which is a different model.

Question 47Digital Technologies

A developer wants to protect a web form against cross-site request forgery. Which control is most appropriate?

  1. Require a per-session anti-CSRF token validated on state-changing requests Correct answer.
  2. Accept all requests that carry a valid session cookie
  3. Rely on the browser's same-origin policy alone
  4. Store the session cookie without the Secure flag

Explanation

A per-session token that the attacker cannot predict ensures the request originated from the legitimate form rather than a forged cross-site request. The browser's same-origin policy does not block cross-site form submissions. Cookies alone are automatically attached and therefore insufficient.

Question 48Digital Technologies

A team measures model performance on a held-out test set. Why is it wrong to tune hyperparameters repeatedly on that same test set?

  1. It prevents the model from using any features
  2. It always makes the model train faster than necessary
  3. It leaks test information and yields an optimistic estimate of generalisation Correct answer.
  4. It reduces the size of the training set to zero

Explanation

Repeatedly tuning against the test set lets information about it influence the model, so the reported score no longer estimates performance on unseen data. A separate validation set should guide tuning, leaving the test set for a final unbiased check. The issue is estimation validity, not training speed.

Question 49Digital Technologies

A program uses a semaphore initialised to 3 to control access to a resource. What does this most directly allow?

  1. Unlimited concurrent holders
  2. No holder at any time
  3. Exactly one holder at a time
  4. Up to three concurrent holders of the resource at a time Correct answer.

Explanation

A counting semaphore with initial value 3 permits three acquisitions before further threads block, so at most three holders proceed concurrently. A value of 1 would behave like a mutex and allow only one holder. The initial value sets the concurrency limit.

Question 50Digital Technologies

A developer wants to represent a family of related algorithms that can be swapped at runtime without changing client code. Which design pattern best fits?

  1. Adapter pattern
  2. Observer pattern
  3. Singleton pattern
  4. Strategy pattern Correct answer.

Explanation

The strategy pattern encapsulates interchangeable algorithms behind a common interface, letting the client select one at runtime. Singleton controls instance count, observer handles event notification, and adapter converts interfaces. Only strategy targets swappable algorithm families.