Module Assessment — Web & API Fundamentals

Assessment Overview

Congratulations!

You have successfully completed Module 11 — Web & API Fundamentals.

Throughout this module, you explored how modern web applications communicate, authenticate users, exchange data, and securely expose services through APIs.

This assessment validates your understanding before progressing to more advanced web application security topics.

Assessment Information

Item	Details
Module	Module 11 — Web & API Fundamentals
Assessment Type	Module Assessment
Questions	40
Question Types	Multiple Choice & Scenario-Based
Passing Score	70%
Time Limit	60 Minutes
Difficulty	Beginner to Intermediate

Skills Being Assessed

This assessment covers:

Web Fundamentals
Web Architecture
HTTP
HTTPS
Cookies
Sessions
REST APIs
GraphQL
JSON
API Authentication
Modern Web Applications

Assessment Objectives

After completing this assessment, you should be able to:

Explain how web applications work.
Understand modern web architectures.
Interpret HTTP requests and responses.
Differentiate HTTP from HTTPS.
Understand cookies and session management.
Explain REST and GraphQL APIs.
Interpret JSON data.
Apply API authentication concepts.
Identify security best practices for web applications.

Enterprise Scenario

You have joined CloudNova Technologies as a Cloud Security Engineer.

The organization is launching a new cloud-native web platform built using:

React
Kubernetes
REST APIs
GraphQL
OAuth 2.0
AWS

Before participating in security assessments and architecture reviews, your manager asks you to complete this assessment to verify your understanding of modern web technologies.

Instructions

Before beginning:

Read every question carefully.
Select the best answer.
Think from an enterprise security perspective.
Apply security best practices.
Review your answers before submission.

Section 1 — Web Fundamentals

Question 1

The World Wide Web (WWW) primarily consists of:

A. Physical network cables
B. Websites and web applications
C. Firewalls
D. Operating Systems

Question 2

Which component requests information from a web server?

A. Database
B. Browser (Client)
C. Router
D. Switch

Question 3

Which component stores and delivers website content?

A. Web Server
B. DNS Resolver
C. Firewall
D. Browser Cache

Question 4

A URL identifies:

A. A user account
B. A web resource
C. An IP packet
D. A firewall rule

Question 5

Which statement is correct?

A. Internet and Web are identical.
B. The Web operates on top of the Internet.
C. HTTP replaces the Internet.
D. DNS is the Web.

Section 2 — Web Architecture

Question 6

Which architecture separates presentation, application, and database layers?

A. Peer-to-Peer
B. Three-Tier Architecture
C. Mesh Network
D. Ring Topology

Question 7

A Load Balancer primarily:

A. Stores passwords
B. Distributes incoming traffic
C. Encrypts files
D. Creates APIs

Question 8

Which component commonly performs SSL/TLS termination?

A. Reverse Proxy
B. Database
C. Browser Cache
D. DHCP Server

Question 9

Which architecture divides an application into independent services?

A. Monolithic
B. Microservices
C. Client Cache
D. Static Website

Question 10

Which service improves global content delivery performance?

A. CDN
B. DNS Cache
C. DHCP
D. FTP

Section 3 — HTTP & HTTPS

Question 11

HTTP stands for:

A. Hypertext Transfer Protocol
B. High Transfer Protocol
C. Hyper Transport Protocol
D. Hybrid Text Protocol

Question 12

Which HTTP method retrieves information?

A. POST
B. DELETE
C. GET
D. PATCH

Question 13

Which status code indicates success?

A. 404
B. 500
C. 200
D. 403

Question 14

HTTPS secures communication using:

A. FTP
B. TLS
C. DHCP
D. SNMP

Question 15

HTTPS typically uses which port?

A. 21
B. 22
C. 80
D. 443

Section 4 — Cookies & Sessions

Question 16

Cookies are primarily stored in:

A. Database
B. Browser
C. Router
D. Firewall

Question 17

The HttpOnly cookie attribute helps mitigate:

A. SQL Injection
B. Cross-Site Scripting (XSS)
C. DDoS
D. Port Scanning

Question 18

HTTP is considered:

A. Stateful
B. Stateless
C. Connectionless Database
D. Persistent Storage

Question 19

A Session ID should be:

A. Predictable
B. Sequential
C. Random and Unique
D. Publicly Shared

Question 20

Which attack involves stealing a valid Session ID?

A. CSRF
B. Session Hijacking
C. SQL Injection
D. Buffer Overflow

Section 5 — REST APIs

Question 21

REST stands for:

A. Representational State Transfer
B. Remote Security Transfer
C. Resource State Transport
D. Real-Time State Transfer

Question 22

REST APIs generally use:

A. SMTP Commands
B. HTTP Methods
C. SNMP Traps
D. SSH Sessions

Question 23

Which method creates a new resource?

A. GET
B. POST
C. DELETE
D. HEAD

Question 24

REST APIs commonly exchange data using:

A. XML Only
B. JSON
C. CSV
D. PDF

Question 25

REST APIs are typically:

A. Stateful
B. Stateless
C. Offline
D. Peer-to-Peer

Section 6 — GraphQL & JSON

Question 26

GraphQL generally exposes:

A. One endpoint
B. Hundreds of endpoints
C. FTP services
D. SMTP services

Question 27

GraphQL retrieves:

A. Entire databases
B. Only requested fields
C. Random records
D. Log files

Question 28

JSON stands for:

A. Java Structured Object Network
B. JavaScript Object Notation
C. Java Object Naming
D. Java Serialized Output Notation

Question 29

JSON objects are enclosed within:

A. ()
B. []
C. {}
D. <>

Question 30

Which GraphQL feature allows real-time updates?

A. Queries
B. Mutations
C. Subscriptions
D. Schemas

Section 7 — API Authentication

Question 31

Authentication answers:

A. What resources exist?
B. Who are you?
C. How fast is the API?
D. Which database is used?

Question 32

Authorization determines:

A. User identity
B. Network latency
C. What actions are permitted
D. HTTP version

Question 33

OAuth 2.0 primarily provides:

A. File Compression
B. Authorization Framework
C. DNS Resolution
D. Database Encryption

Question 34

JWT stands for:

A. Java Web Token
B. JSON Web Token
C. Java Wide Token
D. JSON Wide Transport

Question 35

Which authentication mechanism verifies both client and server identities?

A. API Key
B. Basic Authentication
C. Mutual TLS (mTLS)
D. Anonymous Access

Section 8 — Modern Web Applications

Question 36

A Single Page Application (SPA):

A. Reloads every page completely
B. Dynamically updates content without full page reloads
C. Cannot use APIs
D. Runs only on servers

Question 37

Which technology is commonly used to orchestrate containers?

A. Docker Compose
B. Kubernetes
C. Apache HTTP Server
D. IIS

Question 38

Which cloud computing model allows code execution without managing servers?

A. Virtual Machines
B. Bare Metal
C. Serverless Computing
D. Dedicated Hosting

Question 39

Which security control helps protect web applications from common attacks?

A. DHCP
B. Web Application Firewall (WAF)
C. FTP
D. SMTP Relay

Question 40

Which statement best describes a modern web application?

A. It consists only of static HTML pages.
B. It uses APIs, cloud-native services, and modern front-end frameworks to deliver dynamic user experiences.
C. It cannot integrate with cloud services.
D. It does not require authentication.

Assessment Summary

Congratulations on completing the Web & API Fundamentals Module Assessment.

If you achieved a score of 70% or higher, you have demonstrated a solid understanding of:

Web Fundamentals
Web Architecture
HTTP & HTTPS
Cookies
Sessions
REST APIs
GraphQL
JSON
API Authentication
Modern Web Applications

These concepts form the foundation for web application security, API security, penetration testing, cloud-native application security, and secure software development.

Congratulations!

🎉 You have successfully completed Module 11 — Web & API Fundamentals.

You now understand how modern web applications communicate, authenticate users, exchange data, and securely expose APIs across cloud and enterprise environments.

These concepts are fundamental for Cloud Security Engineers, Security Architects, DevSecOps Engineers, Application Security Engineers, SOC Analysts, and Penetration Testers.

What’s Next?

➡️ Module 12 — Enterprise Security Operations

In the next module, you’ll learn how modern Security Operations Centers (SOCs) monitor, detect, investigate, and respond to cybersecurity threats across enterprise environments.

You’ll explore:

Security Operations Center (SOC) Fundamentals
Enterprise Logging & Monitoring
Security Information and Event Management (SIEM)
Threat Intelligence
Security Event Correlation
Incident Detection & Response
Security Automation (SOAR)
Threat Hunting
Digital Forensics Fundamentals
Enterprise Security Operations Best Practices

By the end of this module, you’ll understand how enterprise security teams continuously monitor infrastructure, investigate security incidents, respond to cyber attacks, and improve organizational security posture using modern security operations platforms.