30-question level test

Indicative assessment of six areas: Java, object-oriented programming, quality, data, Spring and security. The questions are original and the result does not certify professional competence.

Question 1 of 30 · C1

To check learning in “Syntax, variables, operators and types”, which criterion correctly describes “operators”?

A. BigDecimal represents exact decimal values when constructed from text and used with a defined rounding policy.B. byte, short, int, long, float, double, char and boolean store values with defined ranges and operators.C. var infers the static type from the initialiser; it does not make the language dynamic or improve poor names.D. Precedence, short-circuiting and numeric promotion determine the result; parentheses make the intention explicit.

Question 2 of 30 · C1

When migrating from Java 21 to Java 25 in “Syntax, variables, operators and types”, which interpretation of “local type inference” must be preserved and verified again?

A. var infers the static type from the initialiser; it does not make the language dynamic or improve poor names.B. Precedence, short-circuiting and numeric promotion determine the result; parentheses make the intention explicit.C. String is immutable; equals compares content and StringBuilder avoids costly repeated concatenation.D. A reference variable identifies an object or null; assigning it does not copy the object.

Question 3 of 30 · C1

A colleague proposes solving everything with an automated tool in “Inheritance, interfaces, polymorphism and composition”. Which principle of “abstract classes” must be preserved?

A. Sealed types limit the known implementations and support exhaustive decisions in closed models.B. The caller uses the common contract, and the concrete implementation determines the behaviour without instanceof.C. An object delegates responsibility to explicit collaborators and can combine them at construction time or at runtime.D. An abstract class shares a controlled base when invariants and lifecycle are truly common.

Question 4 of 30 · C1

The artefact “a map of a request from the client to the database and back” fails in an edge case. Which statement about “state” guides a sustainable correction?

A. Persistent state survives processes, while session state and in-memory state have different lifecycles.B. Presentation, application, domain and infrastructure layers separate reasons for change and allow implementation details to be replaced.C. A contract defines inputs, outputs, errors and expectations without revealing the internal implementation.D. A request carries intent and context; the response communicates the result, metadata and an interpretable status.

Question 5 of 30 · C1

Before integrating the change in “Environment: JDK, IDE, Git and Maven”, which definition of “installation diagnostics” allows the behaviour to be reviewed without guesswork?

A. which/where, java -version and ./mvnw -version help distinguish path, JDK and project problems.B. The JDK contains the compiler and tools; JAVA_HOME must point to the chosen distribution and be checked alongside java -version.C. mvnw pins the Maven distribution used by the project and reduces differences between machines.D. A repository records meaningful changes; .gitignore excludes artefacts, credentials and local metadata.

Question 6 of 30 · C2

To check learning in “Exceptions, dates, files and logging”, which criterion correctly describes “java.time”?

A. Injecting Clock allows expiry and date changes to be tested without changing the system clock.B. Instant represents a point on the global timeline; LocalDate represents a civil date; ZonedDateTime incorporates time-zone rules.C. A specific exception expresses a failed rule; the outer layer decides how to translate it.D. AutoCloseable resources are closed even when an exception occurs, and suppressed exceptions remain available.

Question 7 of 30 · C2

A review of the module “Testing with JUnit and Mockito” raises a decision concerning “JUnit Jupiter”. Which explanation should the reviewer accept?

A. Equivalence classes and boundary values reduce the number of cases without losing semantic coverage.B. Choosing a dummy, stub, spy, mock or fake depends on the interaction or state that needs to be observed.C. Annotations, assertions, lifecycle methods and parameterised tests support small, repeatable specifications.D. Arrange sets up the data, Act performs an action and Assert checks an observable result.

Question 8 of 30 · C2

While designing a use-case test suite with parameterised tests and verification of an external collaboration, the team needs to apply “AAA structure”. Which reasoning is technically correct?

A. Annotations, assertions, lifecycle methods and parameterised tests support small, repeatable specifications.B. Arrange sets up the data, Act performs an action and Assert checks an observable result.C. Mocks verify collaboration at boundaries; stubs provide responses, and fakes implement a simple working alternative.D. Determinism, independence, speed and useful messages matter more than an isolated percentage.

Question 9 of 30 · C2

While designing the history of an improvement with three atomic commits and a reasoned review, the team needs to apply “working tree and index”. Which reasoning is technically correct?

A. The working directory contains changes; the index selects exactly what will form the next commit.B. A commit implements one coherent change, builds successfully and explains why in its message.C. Merge preserves topology; rebase rewrites a local sequence and must never alter shared history without agreement.D. A review assesses correctness, security, design, tests and clarity through actionable observations.

Question 10 of 30 · C2

To check learning in “Lambdas, Streams and Optional”, which criterion correctly describes “collectors”?

A. Collectors groups, partitions and reduces data, but requires decisions about duplicates and the mutability of the result.B. Optional models a return value that may be absent and requires an explicit alternative; it is unsuitable as an entity field.C. A lambda implements a functional interface and captures effectively final variables from its surrounding scope.D. map transforms an element; flatMap flattens nested results and expresses one-to-many relationships.

Question 11 of 30 · C3

A colleague proposes solving everything with an automated tool in “Relational databases and SQL”. Which principle of “JOIN” must be preserved?

A. GROUP BY forms groups and HAVING filters aggregates; counting rows is not always equivalent to counting entities.B. The primary key identifies a row, and a foreign key prevents orphaned references between relations.C. INNER and OUTER JOIN combine relations according to a condition; misunderstood cardinality multiplies rows.D. SELECT projects columns and WHERE filters rows before sorting; NULL requires IS NULL and three-valued logic.

Question 12 of 30 · C3

The risk of “creating indexes by intuition or manually changing production without a reproducible migration” appears in production. Which use of “PostgreSQL types” helps investigate the cause rather than hide it?

A. Separating functional dependencies reduces duplication and anomalies; denormalisation requires explicit measurement and maintenance.B. Choosing integer, bigint, numeric, text, a timestamp with time zone or jsonb communicates the domain and constrains values.C. The executed plan shows estimates, rows, loops and timings; read it without confusing cost with milliseconds.D. The application uses a least-privilege role separate from the owner and limits access by schema.

Question 13 of 30 · C3

When defending the artefact “a small bean graph with two explicitly selected implementations”, you must justify “bean”. Which option gives the most precise justification?

A. The constructor reveals required dependencies, supports immutability and makes testing possible without a Spring context.B. A bean is a managed object with a defined scope and callbacks, not just any object created with new.C. @Bean methods wire third-party types or objects whose construction should not depend on annotations.D. The application declares components and relationships; the container controls creation, configuration and lifecycle.

Question 14 of 30 · C3

Before integrating the change in “Relational databases and SQL”, which definition of “aggregation” allows the behaviour to be reviewed without guesswork?

A. A table represents a type of fact; each row conforms to the same heading and does not depend on its physical position.B. NOT NULL, UNIQUE, CHECK and foreign keys place invariants close to the data and protect all clients.C. INNER and OUTER JOIN combine relations according to a condition; misunderstood cardinality multiplies rows.D. GROUP BY forms groups and HAVING filters aggregates; counting rows is not always equivalent to counting entities.

Question 15 of 30 · C3

To check learning in “JDBC, JPA and Hibernate”, which criterion correctly describes “JPA entity”?

A. Cardinality and the owning side of a relationship determine keys, updates and fetching strategy.B. The pool lends a limited number of connections; each operation must return them promptly and define the transaction boundary.C. JDBC code maps each row to a model and must handle NULL, types and cardinality deliberately.D. Identity, lifecycle and the persistence context distinguish a managed entity from an ordinary POJO.

Question 16 of 30 · C4

A review of the module “Validation and global error handling” raises a decision concerning “domain validation”. Which explanation should the reviewer accept?

A. An advice centralises exception translation and keeps controllers focused.B. An identifier links a safe response to an internal event without exposing technical details.C. Rules that must always hold belong alongside the model or use case, even when HTTP is absent.D. Standard and custom constraints validate input properties; use groups only when the contract justifies them.

Question 17 of 30 · C4

While designing a concurrent stock reservation that does not allow negative quantities, the team needs to apply “ACID”. Which reasoning is technically correct?

A. The use case usually defines the boundary; external operations should remain outside it or use messaging patterns.B. A version detects concurrent updates and allows a retry or conflict report without locking in advance.C. Recording the change and event in the same transaction allows later publication without inconsistent dual writes.D. Atomicity, consistency, isolation and durability describe transaction guarantees, not automatic business rules.

Question 18 of 30 · C4

A review of the module “Controllers, Services, Repositories and DTOs” raises a decision concerning “application service”. Which explanation should the reviewer accept?

A. A repository provides operations according to the domain's needs and hides queries or framework details.B. A service defines a use case, coordinates the domain and ports, and usually defines the transaction boundary.C. The response exposes only intended fields, stable formats and necessary links or metadata.D. The controller interprets the route, authentication and representation; it delegates the business rule and translates the result.

Question 19 of 30 · C4

The risk of “disabling CSRF or allowing CORS globally to make an error disappear without understanding the threat model” appears in production. Which use of “filter chain” helps investigate the cause rather than hide it?

A. Validated authentication holds the principal and authorities for the request, without making that object part of the domain model.B. CSRF exploits credentials sent automatically by the browser; appropriate tokens or cookie settings protect sessions.C. Filters extract credentials, protect against attacks and authorise requests before they reach MVC; their order changes the result.D. Method-level authorisation protects sensitive use cases in addition to URL patterns, using testable rules.

Question 20 of 30 · C4

The risk of “storing secrets in localStorage, trusting roles sent by the client or accepting unexpected algorithms” appears in production. Which use of “passwords” helps investigate the cause rather than hide it?

A. Verification produces a principal; uniform messages prevent account enumeration.B. Verify the header and claims using an allowed algorithm, the correct issuer, audience, time constraints and key; the contents are not encrypted.C. Credential changes, account locking and global sign-out require session versioning, a revocation list or controlled refresh.D. Passwords are stored using an adaptive hash and a unique salt; length limits and rate limiting complete the control.

Question 21 of 30 · C5

While designing a local Compose setup with the application and PostgreSQL, plus equivalent instructions without Docker, the team needs to apply “image and container”. Which reasoning is technically correct?

A. One stage builds the application and another runs only the JAR with a minimal runtime, reducing the attack surface and image size.B. An image is an immutable, layered template; a container adds a process and ephemeral state.C. A volume keeps data outside the container lifecycle; bind mounts expose host paths.D. The same project starts with ./mvnw and local PostgreSQL, configuring the URL, username and password through the environment.

Question 22 of 30 · C5

Before integrating the change in “Cloud fundamentals for Java backends”, which definition of “FinOps basics” allows the behaviour to be reviewed without guesswork?

A. Tags, budgets, alerts, capacity and data-transfer costs make consumption visible.B. Each model moves the operational boundary; more management brings both control and responsibility.C. A managed database automates tasks but still requires tested backups, encryption, network configuration and capacity planning.D. Zones, redundancy, RTO and RPO follow from business impact; not every workload requires multiple regions.

Question 23 of 30 · C5

The risk of “including secrets in the image, using latest or assuming a healthy container means the application is ready” appears in production. Which use of “image and container” helps investigate the cause rather than hide it?

A. One stage builds the application and another runs only the JAR with a minimal runtime, reducing the attack surface and image size.B. A volume keeps data outside the container lifecycle; bind mounts expose host paths.C. The same project starts with ./mvnw and local PostgreSQL, configuring the URL, username and password through the environment.D. An image is an immutable, layered template; a container adds a process and ephemeral state.

Question 24 of 30 · C5

The artefact “a library OpenAPI specification with examples and reusable error responses” fails in an edge case. Which statement about “responses” guides a sustainable correction?

A. Each state documents headers and body, including 400, 401, 403, 404, 409 and 500 where applicable.B. Realistic examples clarify semantics and support tests, but must never contain real credentials.C. Validating requests and responses against the specification detects drift between documentation and runtime behaviour.D. Required fields, formats, limits and composition make JSON precise; nullable and absent must not be confused.

Question 25 of 30 · C5

While designing a CI pipeline that verifies Maven, retains reports and builds a traceable artefact, the team needs to apply “pipeline”. Which reasoning is technically correct?

A. The Wrapper, pinned versions and verified dependencies reduce variation between runs.B. The same JAR or image promoted between environments retains its hash and commit metadata.C. Each stage has an input, output and failure condition; the same steps must be runnable locally.D. A rollback restores a compatible version; expand-and-contract allows data to evolve without downtime.

Question 26 of 30 · C6

When defending the artefact “a before-and-after search report with latency and load budgets”, you must justify “profiling”. Which option gives the most precise justification?

A. JFR and profiles reveal allocations, CPU use, blocking and pauses; a hypothesis must be supported by a comparable recording.B. The pool limits concurrency towards the database; making it too large increases contention and does not create capacity.C. Reducing data round trips often outperforms micro-optimisations; batching must respect memory and transaction limits.D. Total time is divided between the network, queue, application and data, using percentiles as well as averages.

Question 27 of 30 · C6

While designing a threat model and negative test suite for a multi-user API, the team needs to apply “BOLA”. Which reasoning is technically correct?

A. A DTO with an allowlist of fields avoids binding privileges or ownership values sent by the client.B. Validate supplied URLs by scheme, host and resolution, blocking internal networks and dangerous redirects.C. Every access by identifier checks authorisation for that object; hiding IDs or making them hard to guess is not an access control.D. Assets, actors, trust boundaries and abuse paths determine mitigation and testing priorities.

Question 28 of 30 · C6

The artefact “a complete business backend delivered in milestones, with a technical presentation and an improvement plan” fails in an edge case. Which statement about “incremental delivery” guides a sustainable correction?

A. Design registration, sign-in, resource permissions, secret management, auditing and negative tests from the start.B. The learner demonstrates a user story, explains trade-offs, acknowledges limitations and proposes prioritised improvements.C. Context, containers, components, the data model and ADRs explain the structure and decisions.D. Each vertical slice crosses the API, use case, data and test layers, keeping main runnable.

Question 29 of 30 · C6

While designing a project profile with the problem, architecture, decisions, a reproducible demo and interview questions, the team needs to apply “professional README”. Which reasoning is technically correct?

A. Explain the problem, scope, architecture, requirements, execution, tests, decisions and limitations.B. Context, the decision, an alternative, difficulties and lessons learned support a discussion that goes beyond the code.C. Explaining memory, collections, equality, exceptions and concurrency matters more than reciting definitions.D. Credit resources, licences and AI assistance; never present someone else's work as your own.

Question 30 of 30 · C6

A review of the module “OWASP and API security” raises a decision concerning “validation and mass assignment”. Which explanation should the reviewer accept?

A. Limits by identity, IP and operation protect resources; define responses and retries without blocking legitimate users.B. Keep secrets out of repositories, rotate them and scan for exposure; an SBOM and alerts guide library updates.C. Every access by identifier checks authorisation for that object; hiding IDs or making them hard to guess is not an access control.D. A DTO with an allowlist of fields avoids binding privileges or ownership values sent by the client.