Concept Quiz Bank

What's the defining difference between a single tool-use round trip and an 'agent'?

True or false: an agent loop with no max_iterations guard is safe as long as the model 'should' eventually stop requesting tools.

In Managed Agents, when should client.beta.agents.create() typically be called?

True or false: Managed Agents hosts only the agent's decision-making loop; tool execution (bash, file operations) still happens on your own infrastructure.

A multi-step task like 'book a flight, then find a hotel near the airport' typically requires a loop rather than one batch of parallel tool calls because:

True or false: the SDK's beta Tool Runner is a different, incompatible mechanism from the manual while-loop agent pattern — it doesn't do the same thing.

What real benefit does logging each agent step's tool calls (name + input) provide?

True or false: adopting a framework like LangChain removes the need to understand the underlying stop_reason and tool_use/tool_result mechanics.

What does session.status_idle indicate in a Managed Agents session's event stream?

True or false: creating a fresh Managed Agents Agent object per user session preserves prompt-caching benefits better than reusing one persisted Agent.

Which of the three agent-building approaches (manual loop, Tool Runner, Managed Agents) is the appropriate choice specifically when you want Anthropic to host BOTH the loop AND the sandboxed tool-execution environment?

True or false: an agent loop hitting its max_iterations cap should ideally return a deliberate, informative response rather than crashing or hanging.

Why should a user's own message be rendered optimistically, before the network request completes?

True or false: a single boolean like isLoading is sufficient to represent both 'waiting for the first token' and 'actively streaming' states.

What mechanism underlies a 'Stop generating' button?

True or false: when a user clicks 'stop generating,' the best practice is to remove the entire in-progress assistant message from the UI.

Why is presenting a stop_reason: 'refusal' as a generic 'Something went wrong, try again' error misleading?

True or false: giving a tool call a specific, labeled progress indicator (e.g. 'Searching flights...') instead of a generic spinner has been shown to measurably improve perceived responsiveness.

What's the recommended pattern for a response that's naturally structured data (e.g. a set of selectable options), rather than prose?

True or false: a 'propose_options' tool used purely to trigger a UI component must also perform some real side effect to be a valid tool.

What is the benefit of modeling chat turn state as a discriminated union (pending | streaming | tool_call | done | stopped) rather than several independent boolean flags?

True or false: stop_reason: 'max_tokens' represents genuinely useful partial content that should still be shown to the user, rather than being hidden as an error.

A junior developer implements the stop button as `setMessages(prev => prev.slice(0, -1)); controller.abort();`. What's the more correct behavior?

What is the reliable way to determine the actual token cost of a request that was just made?

True or false: a generic, non-Claude-specific tokenizer library gives an accurate token count for a Claude model.

What effect does lowering output_config.effort typically have?

True or false: streaming a response reduces its total token cost compared to a non-streaming request for the same content.

What should an application do when it receives a RateLimitError that the SDK's automatic retries didn't resolve?

True or false: stop_reason: 'refusal' should be treated as a transient error worth automatically retrying with the identical request.

Why is disguising a failed tool call as a successful tool_result (e.g. content: 'Success.' when the tool actually threw) a safety-relevant issue, not just a bug?

True or false: applying one blanket effort/model configuration across every route in an application is generally the recommended approach.

What is the primary architectural mitigation for prompt injection via untrusted user content flowing into a prompt?

True or false: prompt caching guarantees a cost reduction the moment cache_control is added to a request, with no need to verify it in production.

A summarization feature is given a tool that can delete files, 'just in case it's ever useful.' What's the concern here from a safety/cost perspective?

True or false: a tighter max_tokens cap bounds worst-case cost and latency, but risks truncating a genuinely long, valid response.

What does client.messages.countTokens() provide that response.usage does not?

What does MCP (Model Context Protocol) actually standardize?

True or false: declaring an MCP server in the mcp_servers array is sufficient on its own to grant Claude access to that server's tools.

In the Managed Agents MCP pattern, where do MCP OAuth credentials live?

True or false: a service's ordinary REST API key can always be used directly as the vault credential for that service's hosted MCP server.

How is an mcp_oauth vault credential matched to the correct MCP server?

True or false: an mcp_oauth credential's access token must be manually refreshed by the application before it expires.

What happens when an MCP tool call returns more than roughly 100K tokens of output?

True or false: the Messages API's MCP connector requires your own backend to proxy MCP traffic between Claude and the MCP server.

Why does the Managed Agents pattern deliberately split MCP server declaration (on the agent) from credential storage (in a vault, at the session)?

True or false: an MCP server, once built, can only be used by Anthropic's Claude models — it's not interoperable with other vendors' clients.

A developer wants a one-off Messages API call to use an MCP-hosted tool, with no need for a persisted or resumable session. Which is the more appropriate path?

True or false: MCP exposes only 'tools' (callable functions) — prompts and resources are not part of the MCP specification.

What problem does RAG solve that fine-tuning or retraining the model does not solve as cheaply?

True or false: ingestion (chunking, embedding, storing) and query-time retrieval happen at the same time, triggered by the same user request.

Why is chunk overlap (e.g. 50 characters of overlap between adjacent 500-character chunks) used during ingestion?

True or false: the embedding model used to embed documents at ingestion time must be the exact same model used to embed the user's query at retrieval time.

What is the practical symptom of accidentally mixing embedding models between ingestion and query time?

True or false: at query time, the entire vector database's contents (all stored vectors) are typically injected into the model's context.

What role does the vector database play once similarity search returns results?

True or false: without an explicit system instruction to answer only from retrieved context, the model may blend in its own frozen training-data knowledge, reintroducing staleness.

A toy implementation ranks stored chunks by cosine similarity to a query vector and returns the top K. What does the vector database's ANN (approximate nearest neighbor) index, like HNSW, provide over this brute-force approach?

True or false: a vector database should store only the raw numeric vector for each chunk, since that's all that's needed for similarity search.

What's the tradeoff between smaller and larger chunk sizes during ingestion?

True or false: RAG requires retraining or fine-tuning the generation model whenever the underlying knowledge base is updated.

Six months after launch, a team upgrades their embedding provider to a newer model version and updates only the query-time embedding call, leaving the vector database's stored vectors untouched. What is the correct remediation?

True or false: the embedding model used to turn text into vectors is generally the same model used to generate the final natural-language answer.

How does the Anthropic Messages API remember a conversation across multiple turns?

True or false: 'regenerating' a response can be correctly implemented by resending the exact same messages array, unchanged, to the API.

What must happen when a user edits an earlier message in a chat conversation and expects the conversation to continue from there?

True or false: the `messages` array sent to the API effectively IS the conversation state for a chat application.

Why is caching the stable portion of the system prompt (persona, instructions) valuable in a chat application specifically?

True or false: two separate conversations for the same user share some hidden state that must be explicitly managed.

What's the risk of a naive fixed-window trim (e.g. always keep only the last 20 turns) as a context-management strategy?

True or false: a chat application's backend must reload and resend the FULL conversation history from persistence on every single new user message.

In the regenerateLastResponse function, what condition determines whether a turn should be dropped from the end of the messages array?

True or false: streaming and multi-turn conversation history management are unrelated concerns that never need to interact.

A developer implements per-user chat by storing one giant shared messages array across ALL of a user's separate conversations, tagging each message with a conversationId field. What's wrong with this?

True or false: the API's compaction feature (beta, on supporting models) requires the application to manually decide which specific turns to discard.

Why does waiting until a request actually fails on context length (rather than proactively trimming/summarizing) hurt the user experience?

True or false: appending the assistant's response to the persisted messages array should use response.content directly, not just the extracted text string.

What should generally live in the `system` parameter versus `messages`?

True or false: prompt caching matches on request semantics — two requests that 'mean the same thing' will share a cache entry.

A system prompt interpolates `new Date().toISOString()` at its very start, followed by a large stable instruction block with a cache_control breakpoint at the end. What will response.usage.cache_read_input_tokens show across repeated requests?

What is the current, supported way to inject runtime context mid-conversation without invalidating the cached system prompt?

True or false: embedding runtime context as plain text inside a user-role message is functionally identical in trust level to a role: 'system' message.

What replaced assistant-turn message prefills for forcing structured output on current-generation models?

True or false: an assistant-turn prefill (ending the messages array with a partial assistant response) still works without error on current-generation Claude models.

A system prompt reads: 'Be helpful and answer questions about our product.' What's the main risk of this phrasing at scale?

True or false: prompt cache write cost is cheaper than an uncached request, so it's always worth adding cache_control even to a prompt sent only once.

Which usage field would you check to confirm prompt caching is actually being hit, rather than assuming it is because cache_control is present?

True or false: there is a minimum prefix length below which cache_control silently has no effect, with no error raised.

Why does cramming the user's live question directly into the system string (e.g. `You are helpful. The user asked: "${q}"`) hurt both caching and clarity?

A prompt template splits a request into a `stableSystem` string and a `buildMessages(userInput, context)` function. What is `context` typically used for?

True or false: reordering the keys of a JSON object sent as part of the request prefix can invalidate prompt caching.

What guarantee does output_config.format (structured outputs) provide that an assistant-turn prefill never did?

What is the current recommended default model id for new Claude API integrations, per this app's installed SDK?

True or false: it is safe to call the Anthropic SDK directly from a Next.js Client Component as long as the API key is stored in a NEXT_PUBLIC_ environment variable.

Given `response.content = [{ type: 'thinking', thinking: '...' }, { type: 'text', text: 'Done.' }]`, what does `response.content[0].text` evaluate to in a plain JS (non-TypeScript) codebase?

Which parameter replaces the deprecated fixed-token-budget approach to extended thinking on current-generation models?

Where does the `effort` parameter belong in a messages.create() call?

True or false: retrying a 400 Bad Request error in a loop will eventually succeed if you just wait long enough.

Which SDK exception class should be caught first (most specific) when distinguishing rate limiting from other failures?

True or false: response.content is always a single string containing the model's reply.

Why is it recommended to shape a small custom response object (e.g. { text, stopReason }) instead of returning the raw SDK response object to the frontend?

True or false: the zero-argument Anthropic() client constructor requires ANTHROPIC_API_KEY to be set, with no other credential path.

In TypeScript, a per-request timeout override such as `{ timeout: 15_000 }` is specified in which unit?

At roughly what output size should a non-streaming request be converted to a streaming one to avoid SDK-level HTTP timeouts?

True or false: adaptive thinking and the effort parameter serve the exact same purpose and using both together is redundant.

A teammate wants to store the Anthropic API key in a variable named NEXT_PUBLIC_CLAUDE_KEY so 'the frontend can call Claude directly and skip the extra network hop.' What's the correct response?

What does the SDK's default max_retries behavior automatically retry?

True or false: reusing a single module-level Anthropic client instance across requests is preferred over constructing a new one per request.

Which SSE event type carries the incremental text fragments a client should render?

Given the code below, what does `rendered` contain after all three deltas ('The ', 'quick ', 'fox.') have been processed?

True or false: each content_block_delta event contains the full accumulated text generated so far, not just a small new fragment.

At roughly what output token count does a non-streaming request risk hitting an HTTP timeout, making streaming effectively required rather than optional?

True or false: input_json_delta fragments (for a streamed tool_use block) can be safely parsed with JSON.parse() as soon as each individual fragment arrives.

What does stop_reason: 'tool_use' mean in the context of a streamed response, compared to 'end_turn'?

True or false: message_start carries visible response text as part of its payload.

In a hand-rolled SSE parser reading from a fetch() ReadableStream, why is it necessary to buffer an incomplete trailing frame across multiple reader.read() calls?

True or false: it's safe and recommended for a browser-side script to open a streaming connection directly to Anthropic's API.

What is the benefit of calling `stream.finalMessage()` after consuming a stream, instead of manually reconstructing the full Message from tracked deltas?

True or false: re-rendering the UI on every single content_block_delta event, with no batching, is the recommended approach for the smoothest user experience.

Which event signals that the ENTIRE streamed message is complete, not just one content block?

True or false: a streamed response can contain ordinary text blocks followed by a tool_use block in the same message.

A junior developer says: 'Streaming is just a nice UX polish — for a backend job with no visible UI, there's no reason to ever use it.' What's the flaw in this reasoning?

True or false: message_delta events can include a running usage object and the final stop_reason.

What is the correct fix for code that does `renderedText = event.delta.text` instead of `renderedText += event.delta.text` inside a streaming loop?

What does stop_reason: 'tool_use' actually mean?

True or false: tool definitions only need to be sent on the first request of a conversation; Claude remembers them for subsequent calls.

What must a follow-up request include, beyond the new tool_result block, in order for Claude to correctly process it?

True or false: if Claude requests two independent tools in the same turn, you should return each tool's result in its own separate follow-up message.

What field correlates a tool_result block back to the specific tool_use block it's responding to?

True or false: if a tool execution throws an error, the best practice is to silently omit sending any tool_result for that call.

Why does a well-written tool description state WHEN to call the tool, not just what it does?

A follow-up request's messages array is: [user Q, tool_result block] — with NO assistant turn containing the original tool_use in between. What is the most likely outcome?

True or false: the SDK's beta Tool Runner requires you to hand-write the request/execute/loop cycle yourself.

When should you reach for a hand-written manual tool loop instead of the SDK's Tool Runner?

True or false: a max_iterations guard is only relevant for the SDK's Tool Runner, not for a hand-written manual loop.

Independent tool calls requested in the same turn should be executed how?

True or false: an overly broad tool input_schema that accepts many optional fields 'just in case' generally makes tool calling more reliable.

A junior developer's agent loop breaks after the first tool call because they wrote `messages.push({ role: 'user', content: response.content })` instead of `messages.push({ role: 'assistant', content: response.content })`. What's wrong here?

True or false: in a multi-turn agent loop, a later tool call can depend on information returned by an earlier tool call in a previous turn.

What does RFC 9457 standardize?

True or false: RFC 9457 obsoletes the earlier RFC 7807, and is the current standard for this purpose.

In an RFC 9457 problem response, what's the difference between 'title' and 'detail'?

True or false: choosing 'no explicit versioning' (an evolvable API) means less ongoing discipline is required compared to URL-path versioning.

Why is URL path versioning (/v1/, /v2/) attractive despite 'polluting' the URL?

True or false: in the Try It scenario, changing userName from a string to a structured object is safe under evolvable-API discipline because no field was removed.

What's the downside of header/content-negotiation versioning (Accept: application/vnd.myapi.v2+json) compared to URL path versioning?

True or false: extension members (custom fields beyond type/title/status/detail/instance) are allowed in an RFC 9457 problem response.

Why does bumping the ENTIRE API's version for a change affecting only one endpoint cause unnecessary cost?

True or false: using application/problem+json as the actual Content-Type header (not just application/json) lets clients and tooling programmatically recognize the standardized error shape.

A team invents a custom error shape { ok: false, msg: '...', code: 42 } for their new API instead of using RFC 9457. What's the main downside?

True or false: the 'no versioning' (evolvable) strategy is generally riskier for a public API with many uncontrolled third-party clients than for an internal API with clients the team controls.

Why is problemResponse() in Implement It Yourself designed as a single shared helper rather than each route building its own error body inline?

True or false: the 'status' field inside an RFC 9457 problem body is meant to be a completely independent value from the actual HTTP response status code.

What single discipline rule does the evolvable/no-versioning strategy rely on for every single change?

Confirmed via a real curl round-trip against a live API, what does the server return when a client's If-None-Match value matches the current ETag?

True or false: Cache-Control: public means the response may be stored by ANY cache, not just the requesting client's own browser cache.

What's the difference between max-age and s-maxage in a Cache-Control header?

True or false: a weak ETag (prefixed with W/) guarantees byte-for-byte identical content, the same as a strong ETag.

In the Try It scenario, why must the server return a full 200 (not 304) when the client's If-None-Match doesn't match the current ETag?

True or false: a server implementation that returns 304 whenever an If-None-Match header is present, without comparing its actual value, is a subtle but real bug.

Why is Last-Modified/If-Modified-Since generally considered coarser than ETag/If-None-Match?

True or false: setting Cache-Control: public on a response containing one user's private order history is a real data-leak risk.

Why might a strong ETag defeat caching for JSON content with non-deterministic key ordering across serializations?

True or false: computing an ETag has zero performance cost, regardless of resource size.

What connects list-endpoint caching correctness to the pagination strategy chosen (per Under the Hood)?

True or false: only safe HTTP methods (like GET) are meaningfully cacheable under HTTP's caching model.

A code review finds an endpoint returning Cache-Control: public, max-age=3600 on GET /api/me/orders (the CURRENT user's order history). What should be flagged?

True or false: in the Implement It Yourself example, the ETag is recomputed fresh from the resource's actual current content on every single request, rather than being cached from the first computation.

Why does a 304 Not Modified response save meaningful bandwidth compared to a 200 with the same data?

What is the single most important practical fact about gRPC for frontend engineers, per this topic?

True or false: a single .proto file can generate strongly-typed client AND server code across different programming languages from one shared schema.

Why can't browsers call gRPC services directly, per this topic?

True or false: grpc-web and BFF-proxy patterns are optional performance optimizations for gRPC, not required workarounds.

In the Try It scenario, why is gRPC a poor fit for a public API consumed directly by third-party browser apps?

True or false: gRPC's protobuf wire format is human-readable JSON-like text, the same as a typical REST API response.

What HTTP/2 feature does gRPC rely on for multiplexed concurrent calls over one connection?

True or false: gRPC only supports a single unary (one request, one response) call pattern, the same as typical REST.

How does gRPC's approach to type safety compare to tRPC's, per Under the Hood?

True or false: gRPC is generally considered a strong fit for internal, backend-to-backend microservice communication where the team controls both ends.

What does the Implement It Yourself UserServiceClient example illustrate, given it doesn't actually use real protobuf?

True or false: choosing REST or GraphQL over gRPC for a public, browser-consumed API is a legitimate, often-correct engineering tradeoff, not a sign of using an inferior technology.

A team adopts gRPC for internal microservices but reports significant friction debugging failed calls in production. What's the most likely explanation, per this topic?

True or false: server streaming, client streaming, and bidirectional streaming are all distinct RPC patterns gRPC supports natively, beyond simple unary calls.

Why does the topic describe protobuf's binary format as a real tradeoff rather than a strict improvement over JSON?

What is the specific, demonstrated consistency bug in offset pagination?

True or false: cursor pagination is immune to the offset skip/duplicate bug because it anchors to an actual VALUE rather than a row count.

What's the real tradeoff cursor pagination makes compared to offset pagination?

True or false: a single-field cursor (e.g. just createdAt) is always sufficient, even when multiple rows can share the exact same value on that field.

In the Try It scenario, why does order #21 (original ordering) get silently skipped rather than order #22?

True or false: cursor pagination generally performs BETTER than offset pagination at deep pages, because it doesn't need to scan and discard skipped rows.

When is offset pagination still a reasonable choice, per this topic?

True or false: a structured field:operator:value filter grammar scales better than inventing a new query parameter per field/operator combination.

Why does an unbounded, client-supplied page limit pose a real risk?

True or false: a compound database index matching the cursor's exact sort/filter columns is what makes cursor pagination's performance advantage real in practice.

Why is offset pagination's consistency bug described as 'deterministic, not probabilistic'?

True or false: offset-based paginated responses are generally easier to cache correctly than cursor-based ones.

A code review finds GET /feed?offset=8000&limit=50 used for a social media feed with very high write volume. What should be flagged?

True or false: the implement-it-yourself paginateByCursor function correctly handles a deletion between requests because it filters on a VALUE (createdAt + id), not an index/count.

What does the compound cursor's second component (the unique id) specifically guard against?

What is the structural inefficiency of short polling?

True or false: long-polling eliminates almost all of short polling's wasted round-trips by having the server hold the request open until something actually happens or a timeout is reached.

In the Try It scenario, why does a 5-second client timeout against a 30-second server hold window degrade the system?

True or false: exponential backoff should keep doubling the retry delay indefinitely with no upper bound.

Why does the implement-it-yourself backoff function reset delay to baseDelay on a successful poll?

True or false: an unthrottled, immediate retry loop against a failing server can itself worsen or prolong the outage, especially with many clients doing it simultaneously.

What server-side race condition does long-polling need to explicitly handle?

True or false: failing to handle a client disconnecting mid-long-poll (not cleaning up subscriptions/timers) is a real resource leak.

How does long-polling's per-request nature differ fundamentally from a WebSocket connection?

True or false: short polling's total request cost scales with actual event frequency, the same way long-polling's does.

What's the connection between exponential backoff and the shipped redux saga take-pattern work on debouncing, per Under the Hood?

True or false: long-polling requires the same kind of persistent, protocol-upgraded connection management that WebSockets need.

A code review finds a polling client that retries every failed request after exactly 1 second, with no growth in delay over repeated consecutive failures. What's the risk?

True or false: long-polling is best understood as a relic technique with no legitimate place once WebSockets/SSE exist.

Why must the client's long-poll timeout be set with real margin ABOVE the server's hold window, not just barely longer?

What is the specific, demonstrable bug in fixed-window rate limiting?

True or false: in the Try It scenario, the fixed-window implementation technically allows all 2000 requests without violating either individual window's stated limit.

Why doesn't token bucket have the same boundary bug as fixed window?

True or false: a true sliding-window-log approach has zero boundary bug, but at a real memory cost compared to a single counter.

Why does setting a token bucket's capacity EQUAL to the full intended long-run quota reintroduce a burst problem?

True or false: rate-limiting exclusively by IP address is generally more accurate than limiting by authenticated identity.

Why does the topic recommend always returning a Retry-After header on a 429 response?

True or false: in the runnable TokenBucket implementation, tokens are added based on real elapsed wall-clock time since the last check, not on a fixed periodic timer.

How does rate limiting relate to pagination's limit parameter, per Under the Hood?

True or false: a leaked API key without any rate-limit backstop turns the leak into effectively unlimited resource consumption for whoever obtained it.

Why is token bucket's per-client state described as O(1) and cheaper than a true sliding-window-log?

True or false: the 'sliding window counter' approximation interpolates between two fixed windows specifically to avoid storing every individual request timestamp.

A code review finds a rate limiter that resets its counter to 0 at the top of every clock minute, with a limit of 60/minute. What real-world risk does this design have?

True or false: layering rate limiting at multiple levels (coarse per-IP plus a primary per-API-key limit) provides defense-in-depth against different evasion strategies.

Why does the severity of the fixed-window boundary bug scale with the window size (e.g. worse for hourly windows than per-second windows)?

What is the core idea behind REST's resource-oriented URL design?

True or false: PATCH is guaranteed idempotent by the HTTP specification, the same way PUT is.

What does it mean for an HTTP method to be 'safe'?

True or false: an idempotent method guarantees calling it N times produces the same end server-side state as calling it once.

Why is POST explicitly NOT idempotent?

True or false: in the Try It scenario, blindly retrying a PATCH that increments a view count on timeout is safe because PATCH requests are always safe to retry.

What does the topic mean by 'pragmatic REST' versus textbook REST?

True or false: returning HTTP 200 with an error message in the response body is a recommended pattern for signaling failures.

Why can GET requests participate in HTTP caching/CDN edge-caching in a way mutating methods cannot?

True or false: DELETE is idempotent even though calling it a second time on an already-deleted resource typically returns a 404 instead of the original success status.

What's the general fix for making an operation safe to retry when its natural expression (like an increment) is inherently non-idempotent?

True or false: nesting resource URLs arbitrarily deep (e.g. 5+ levels) is always the correct REST design choice with no downsides.

A code review finds POST /users/updateEmail alongside the existing PATCH /users/:id endpoint. What's the issue?

True or false: HATEOAS (responses containing links to related available actions) is rarely fully implemented in real-world production APIs, according to this topic.

What determines whether a specific PATCH request is idempotent — the method name, or something else?

Confirmed by an actual sign/tamper/verify test this session, what happens when a webhook payload is modified after signing?

True or false: a webhook URL should be treated as a real secret, sufficient on its own without signature verification.

What delivery guarantee do nearly all production webhook systems (Stripe, GitHub, etc.) actually provide?

True or false: in the Try It scenario, having a deduplication check present in the code guarantees the handler is actually safe against duplicates.

Why must a webhook receiver return a 2xx status for a successfully-deduplicated duplicate event, not an error status?

True or false: crypto.timingSafeEqual throws an exception (rather than returning false) when comparing buffers of different lengths.

Why should signature verification be performed over the RAW received body, not a re-serialized version of the parsed payload?

True or false: a naive check-then-insert deduplication pattern can still have a race condition under concurrent duplicate deliveries of the same event ID.

Why is a webhook handler that credits a user's balance on every payment.succeeded event, with no deduplication, described as guaranteed to eventually double-credit, not just theoretically at risk?

True or false: processing a slow side effect synchronously within the webhook handler, before responding, is generally recommended.

How does webhook signature verification relate to CSRF token comparison, per Under the Hood?

True or false: a webhook receiver that's briefly overwhelmed and returns 5xx errors can trigger a retry storm that worsens its own overload, connecting directly to rate-limiting concerns.

A code review finds a webhook handler that verifies the signature correctly but processes the side effect BEFORE checking for a duplicate event ID. What's the actual risk level?

True or false: HMAC signing the same payload with the same secret twice produces different signatures each time.

Why does the topic recommend an atomic database unique constraint for the check-and-record deduplication step, rather than a simple read-then-write?

Confirmed by running a real ws server this session, what type is incoming WebSocket message data by default?

True or false: SSE (Server-Sent Events) supports true bidirectional communication over the same connection.

What is the main practical advantage of SSE over WebSockets for a purely server-to-client push requirement?

True or false: in the Try It scenario, comparing WebSocket message data directly with === against a string literal will silently never match, with no error thrown.

Why does a WebSocket start as a regular HTTP request before becoming a persistent connection?

True or false: failing to remove a closed connection from a server-side tracking Set/Map is a genuine, common memory leak source in long-running WebSocket servers.

In the broadcast implementation, why is checking readyState === OPEN necessary before calling client.send()?

True or false: the raw SSE wire format confirmed in this topic (id:/data: lines separated by a blank line) requires a special binary protocol library to parse server-side.

Why does the single-threaded Node event loop make the Set-based broadcast pattern safe without explicit locking?

True or false: reaching for WebSockets by default for any 'real-time-sounding' feature is recommended, even when the actual requirement is purely server-to-client.

What real resource cost does an open WebSocket connection impose that a typical stateless HTTP request doesn't?

True or false: SSE generally passes through existing proxies and corporate firewalls more transparently than WebSockets.

A code review finds a WebSocket handler that does JSON.parse(data) directly on incoming message data. What's the risk?

True or false: the browser's native EventSource API automatically handles reconnection on disconnect for SSE, with no custom client-side code required for that specific behavior.

What's the fundamental deciding factor between choosing WebSockets versus SSE, per this topic?

What does OAuth 2.0 fundamentally provide, on its own?

True or false: OpenID Connect (OIDC) is a completely separate protocol unrelated to OAuth 2.0.

Which token should an app use to determine the authenticated user's identity in an OIDC flow?

True or false: an attacker who intercepts the authorization code (e.g. via a browser history entry) can complete the token exchange without needing anything else.

Why does PKCE exist as an extension to the authorization code flow?

True or false: PKCE is now broadly recommended as a default for essentially all OAuth clients, not just ones that technically cannot hold a client_secret.

In the Implement It Yourself PKCE example, why does the attacker's guessed code_verifier fail verification?

True or false: skipping state parameter validation on an OAuth callback endpoint exposes the flow to a CSRF-style attack.

Why is embedding a client_secret in a mobile app's binary or in browser-shipped JavaScript considered unsafe?

True or false: the code-for-token exchange step happens directly from the browser to the identity provider, the same as the initial authorization redirect.

What's the recommended practice regarding the identity provider's own tokens once the OAuth/OIDC flow completes?

True or false: the extra redirect round-trips in the authorization code flow are considered an unnecessary performance cost that should be optimized away.

A code review finds an app decoding the access_token to extract a 'name' field for display purposes, assuming this works reliably across any OAuth provider. What's the issue?

True or false: 'sign in with Google' style flows work as authentication specifically because they combine OAuth 2.0 with OpenID Connect, not because of OAuth alone.

What specifically makes the authorization code safe to pass through the browser's less-trusted redirect channel, despite the risk of it appearing in browser history or referrer headers?

What is the current, accurate distinction between 'OpenAPI' and 'Swagger'?

True or false: an OpenAPI document is purely descriptive prose meant only for human reading, with no machine-readable structure.

In the Try It scenario, why does the generated TypeScript client compile fine but fail at RUNTIME?

True or false: this exact drift failure mode (spec says one thing, real API does another, generated client silently trusts the wrong spec) is structurally IMPOSSIBLE in tRPC's approach.

What is OpenAPI's genuine advantage over tRPC, named explicitly in this topic?

True or false: a hand-maintained OpenAPI spec that has drifted from the real API is generally considered WORSE than having no formal documentation at all.

What's the recommended way to prevent OpenAPI spec drift, per this topic?

True or false: OpenAPI's error response schemas can reference the same RFC 9457 problem-details format covered elsewhere in this course.

In the Implement It Yourself example, why does deriving the OpenAPI path doc from UserSchema (rather than hand-writing it) help prevent drift?

True or false: contract tests that verify a live API's actual behavior against its OpenAPI spec are a recommended practice for catching drift.

Why might a team choose OpenAPI over tRPC even for a project where both ends happen to currently be TypeScript?

True or false: Swagger UI is an example of tooling that CONSUMES an OpenAPI spec to produce interactive documentation, rather than being the spec format itself.

A code review finds a hand-written OpenAPI YAML file with no CI check verifying it matches the actual route implementations, on a codebase where routes change weekly. What risk should be flagged?

True or false: an OpenAPI document can only describe successful (2xx) responses, not error response shapes.

What does generating a client SDK from an OpenAPI spec fundamentally NOT protect against, that tRPC does structurally protect against?

What makes session cookies inherently, trivially revocable, unlike a stateless bearer token?

True or false: a bearer token is automatically attached to outgoing requests by the browser, the same way a cookie is.

In the Try It scenario, why are bearer tokens the better fit for a native mobile app compared to cookie-based sessions?

True or false: refresh token rotation alone, without checking for reuse of an already-invalidated token, provides the same theft-detection benefit as rotation WITH reuse detection.

In the implement-it-yourself token family example, what specifically triggers 'THEFT DETECTED' and family-wide revocation?

True or false: storing a bearer token in localStorage makes it directly readable by any JavaScript running on the page, including an XSS payload.

Why does the topic push back on the framing 'JWTs are stateless, so they're just better than sessions'?

True or false: HttpOnly and SameSite cookie attributes protect against the same specific attack.

Why is it recommended that a well-designed system commonly uses BOTH session cookies and bearer tokens, rather than picking just one universally?

True or false: a session-based approach is inherently always slower than a token-based approach due to requiring server-side state.

What does 'family-wide' refresh token revocation mean, and why revoke the WHOLE family rather than just the reused token?

True or false: bearer tokens are naturally immune to the classic cookie-based CSRF attack pattern.

A code review finds an SPA storing its access token in sessionStorage instead of relying on an HttpOnly cookie, with no other justification given. What should be flagged?

True or false: this app's own next-auth v5 configuration ships HttpOnly, Secure, and SameSite=Lax on its session cookie by default, confirmed in the CSRF topic's verification.

Why does a SHORT access-token lifetime matter even though the refresh token is the one that's actually revocable?

Confirmed via a real tsc compile this session, what happens when frontend code accesses a field that doesn't exist on the server's actual return type?

True or false: tRPC requires a separate schema definition language (like .proto for gRPC or an OpenAPI YAML file) to define its API contract.

What is the ONE hard constraint that makes tRPC's approach possible?

True or false: using `import type { AppRouter }` instead of a plain value import matters because it guarantees zero runtime bundle cost from server-only code.

Why is zod's runtime input validation still necessary even though TypeScript already provides compile-time type checking?

True or false: in the Try It scenario, renaming a server field from email to emailAddress causes the frontend build to fail at compile time, given a shared router type.

How does tRPC's approach to type safety fundamentally differ from gRPC's, per Under the Hood?

True or false: tRPC could reasonably be used between a TypeScript frontend and a Python backend by sharing types through some conversion tool.

What real mechanism does the Implement It Yourself example use to achieve dynamic property-based method calls while preserving compile-time types?

True or false: httpBatchLink can automatically combine multiple tRPC calls issued in the same tick into a single HTTP request.

When should a team choose gRPC over tRPC for a new internal service, per this topic's framing?

True or false: a tRPC compile error on a breaking API change should generally be treated as unwanted friction to work around.

A code review finds a project importing the server's full router implementation (not just its type) into client-side code. What's the risk?

True or false: tRPC requires each API endpoint to be manually documented in a separate specification file for the type safety to work.

Why is a monorepo (or equivalent type-sharing setup) typically required for tRPC to work in practice?

How does the BFF Token Handler pattern protect JWT access tokens from browser XSS attacks?

Which cookie parameter prevents the browser from transmitting cookies alongside cross-site requests, protecting against CSRF attacks?

What is the primary risk of using `Promise.all()` to aggregate data from multiple independent microservices?

Which JavaScript method should you use to run multiple API requests concurrently while catching errors individually for each query?

What is the primary purpose of the Circuit Breaker pattern in microservice gateways?

What does the 'Half-Open' state represent in a Circuit Breaker lifecycle?

What is the primary difference between a generic API Gateway and the Backend for Frontend (BFF) pattern?

Why does the BFF pattern improve performance for mobile users on cellular networks?

In BEM naming, what does `.card__title--large` represent?

What is the core organizing principle of ITCSS (Inverted Triangle CSS)?

In BEM, elements should be chained to reflect DOM nesting depth, e.g. `.card__header__title` for a title nested inside a header nested inside a card.

Why does every BEM-named class having the same specificity (a single class selector) matter architecturally?

What can traditional CSS-in-JS do that plain CSS Modules structurally cannot do as directly?

Traditional (non-zero-runtime) CSS-in-JS libraries like classic styled-components generate and inject CSS entirely at build time, with no work happening in the browser.

Why is traditional CSS-in-JS's runtime style injection model architecturally incompatible with React Server Components?

What does 'zero-runtime CSS-in-JS' (e.g. vanilla-extract) do differently from classic styled-components?

What is the fundamental difference between a CSS custom property and a Sass variable?

Why does `width: var(--base-width) + 10px;` not work as arithmetic, requiring calc() instead?

By default (without using @property), a custom property's value can be smoothly animated/transitioned by the browser, the same as a native property like opacity.

Which styling mechanism is specifically designed to cross the Shadow DOM encapsulation boundary, letting a host page theme a Web Component from outside?

What could CSS NOT do before `:has()` was introduced?

In CSS cascade layers, what determines which rule wins when two rules are in different layers?

`:where()` and `:is()` behave functionally identically for matching purposes, but `:where()` always contributes zero specificity while `:is()` takes the specificity of its most specific argument.

How does CSS cascade layers (@layer) relate to the ITCSS methodology?

What mechanism do CSS Modules use to guarantee class names never collide across different components?

CSS Modules have a runtime performance cost comparable to CSS-in-JS libraries, since both involve JavaScript processing of styles.

What happens when JSX references `styles.titel` (a typo) from a CSS Module import, without typed CSS Module tooling set up?

What does the `:global(...)` syntax do in a CSS Module file?

Which stage of the CSS rendering pipeline can `transform` and `opacity` changes skip entirely, making them cheap to animate?

A loop reads `element.offsetWidth` and immediately writes `element.style.width` for each of 100 elements, interleaved. How many synchronous layout recalculations does this typically force, and why?

Applying `will-change: transform` permanently to every animatable element in an application is a safe, cost-free way to improve performance broadly.

A page has many independent, self-contained widgets, and unrelated interactions elsewhere on the page feel sluggish whenever a widget updates. What CSS property is specifically designed to address this by limiting the 'blast radius' of each widget's internal changes?

Which of these Sass features has now been added natively to CSS, no longer requiring a preprocessor?

A Sass variable ($color) can be read or modified from JavaScript at runtime, the same way a CSS custom property can.

What is the main advantage of Sass's `@use` module system over the older, now-deprecated `@import`?

What Sass feature has no native CSS equivalent at all, remaining one of its clearest unique strengths?

What is the fundamental authoring-model difference between Tailwind's utility-first approach and traditional BEM-style semantic classes?

Why does `<div className={`bg-${color}-500`}>` cause a missing-style bug in a Tailwind production build?

In a component-based framework like React, the idiomatic way to avoid repeating a long Tailwind utility class list is to extract a reusable component, not necessarily to create a new @apply-based CSS class.

What is the purpose of Tailwind's constrained design token scale (e.g. only p-1 through p-96, a fixed color palette)?

What must be true for a `@container` query rule to have any effect?

An element with `container-type: inline-size` set on itself can use `@container` queries to respond to its own width.

A card component needs to lay out differently depending on whether it's placed in a wide page section or a narrow sidebar, at the SAME browser viewport width. What's the right tool?

What's the container query unit equivalent of `vw` (viewport width), scoped to the query container instead of the viewport?

With `flex-direction: column`, which property controls horizontal alignment of items?

Two flex items both have `flex: 1` inside a flex container. Item A contains one word, Item B contains three sentences of text. What are their relative widths?

The CSS `order` property changes an element's position in the DOM, which also updates keyboard tab order and screen reader reading order to match.

What's the difference between `justify-content: space-between` and `justify-content: space-evenly`?

What does the `fr` unit represent in CSS Grid?

What's the key functional difference between grid-template-columns: repeat(auto-fill, minmax(200px, 1fr)) and repeat(auto-fit, minmax(200px, 1fr))?

An item has `grid-column: 1 / 3;`. How many column tracks does it span?

CSS Grid's `subgrid` value allows a nested grid item to inherit and align to its parent grid's actual track definitions, rather than creating independent tracks of its own.

An element has `position: absolute` with no ancestor that has a non-static position. What is it positioned relative to?

Raising a z-index value high enough (e.g. z-index: 999999) will always make an element render on top of everything else on the page.

Which CSS property on an ANCESTOR element can cause a descendant's `position: fixed` to unexpectedly scroll with the page instead of staying pinned to the viewport?

What causes `position: sticky` to stop working, most commonly?

Without the viewport meta tag, what does a mobile browser typically do when rendering a page?

Why is mobile-first (min-width media queries) generally preferred over desktop-first (max-width)?

Using `px` units for font-size instead of `rem` has no meaningful accessibility impact, since both render at the same visual size by default.

A shared card-grid component looks correct on a full-width page but breaks when reused inside a narrow sidebar, even though the browser viewport is still desktop-wide. What's the root cause?

What specific capability does Framer Motion's `AnimatePresence` provide that pure CSS cannot replicate natively in a React app?

Animating the `width` property via a JavaScript animation library like GSAP avoids the layout-recalculation performance cost that animating width via plain CSS incurs.

For a simple 'fade in once when scrolled into view' effect with no scroll-scrubbing or complex sequencing, what's the most appropriate approach?

In a React component using GSAP to create an animation timeline inside a useEffect, why is a cleanup function (`return () => tl.kill()`) necessary?

An element animates from opacity:0 to opacity:1 via @keyframes, but reverts to invisible the instant the animation ends. What property fixes this?

What is the fundamental capability @keyframes animations have that CSS transitions lack?

JavaScript synchronously removes a CSS class that triggers an animation, then immediately re-adds the same class in the very next line. Does the animation restart?

animation-play-state: paused stops a running CSS animation and resets it to its starting keyframe.

What is the key difference between a CSS transition and a CSS @keyframes animation?

Which two CSS properties can be animated purely on the GPU compositor thread, without triggering a layout recalculation on every frame?

You can directly transition a property from a fixed value to `height: auto` and it will animate smoothly.

What's a real downside of using `transition: all` instead of listing specific properties?

Why do serverless environments (like AWS Lambda or Vercel Functions) frequently exhaust traditional SQL database connection limits?

What connection limit parameter (`connection_limit`) is recommended in connection strings for serverless Lambda functions?

What is a primary drawback of heavy ORM libraries like Prisma compared to SQL-like libraries like Drizzle or raw SQL?

Which of the following database queries is vulnerable to an SQL Injection attack?

What is the primary benefit of the 'Cache-Aside' pattern in database design?

What happens in Redis when memory limits are reached if the eviction policy is set to `noeviction`?

According to the CAP Theorem, what happens to a distributed database if a network partition (P) occurs?

When is a NoSQL Document database (like MongoDB) preferred over a Relational SQL database?

What happens in MongoDB if you perform an update without using an update operator like `$set`?

Which query operator would you use to append an item to an array field in a MongoDB document?

If you have a compound index on `{ companyId: 1, age: 1 }`, which of the following queries will NOT be able to utilize this index?

What does a `COLLSCAN` status in MongoDB explain stats represent?

What is the primary risk of using `ReadPreference.secondary` for application queries?

What happens if a monotonically increasing field (like a timestamp) is selected as the Shard Key in MongoDB?

What is the default isolation level of MongoDB transactions, and what does it prevent?

What is a primary risk of long-running transactions in MongoDB?

How does Mongoose's `.populate()` resolve linked references behind the scenes?

Which option must be enabled to enforce validation rules during update operations like `updateOne`?

What is the primary purpose of the 'Expand-and-Contract' pattern in database schema migrations?

Which SQL command should you use in production PostgreSQL to create an index without locking concurrent write queries?

How does Prisma achieve compile-time type safety for database queries?

What is the consequence of querying relationships by calling Prisma operations inside a `.map()` loop?

What does an `Index Only Scan` represent in an SQL explain plan?

Why does writing `WHERE YEAR(created_at) = 2026` fail to utilize a standard index built on `created_at`?

What is the difference between an `INNER JOIN` and a `LEFT JOIN` in SQL?

What design rule is violated if a non-key column in a table depends on another non-key column?

Which isolation anomaly occurs when a transaction reads the same row twice and gets different values because another transaction modified and committed the row in between?

How does PostgreSQL handle concurrent writes that conflict under `SERIALIZABLE` isolation?

How does GitHub Actions run separate Jobs declared in a workflow file by default?

Where should production API tokens be stored for use in GitHub Actions workflows?

What is the primary benefit of using Multi-Stage Builds in a Dockerfile?

Why should `COPY package.json ./` and `RUN npm install` be placed before `COPY . .` in a Dockerfile?

What happens in Next.js if you try to access an environment variable that does NOT have the `NEXT_PUBLIC_` prefix inside a browser Client Component?

Why should environment variables be validated using schemas like Zod at server startup?

What is the primary technical reason why Edge runtimes (like Cloudflare Workers) achieve near-zero cold start times compared to Serverless functions?

Why will writing files to the local disk fail to persist on platforms like Vercel or Netlify?

What is the difference between a Liveness probe and a Readiness probe in container monitoring?

Why is running heavy database calculations inside a health-check endpoint considered an anti-pattern?

How does Express differentiate a generic middleware function from an error-handling middleware function?

Why should raw error stack traces (`err.stack`) be stripped from API response payloads in production environments?

Which encoding format must be set on client forms to send binary files to an Express server?

What is the primary risk of using Multer's default Memory Storage for file uploads?

What happens if a middleware function neither calls `next()` nor sends a response via `res`?

How should middleware pass a runtime error to Express's global error-handling stack?

Which HTTP status code is the correct semantic response when a client submits a POST request that successfully creates a new resource?

What happens to the `req.body` parameter if `app.use(express.json())` is missing from the Express setup?

How does Express evaluate route matching when multiple routes match the same incoming request path?

What error occurs if code execution in a handler continues after `res.send()` and reaches another response statement?

What is the difference between Authentication and Authorization in web security?

Which HTTP status code is the correct semantic response when a user presents a valid token but lacks the roles needed to access the route?

What does a preflight request represent, and which HTTP method does it execute under?

Why will a browser block a cross-origin API call if the server responds with `Access-Control-Allow-Origin: *` and the fetch includes `{ credentials: 'include' }`?

What is the primary responsibility of a Controller in the MVC pattern?

Why is Path (URI) versioning (like `/v1/` and `/v2/`) preferred in public API design?

What header is stripped when you run `app.disable('x-powered-by')` or register Helmet?

Why must you configure `app.set('trust proxy', 1)` in Express when applying rate limiters behind a load balancer?

Why should `app.listen()` be kept in a separate file from the main Express routes export file when writing test suites?

Which Supertest method would you use to verify that a route accepts POST JSON payloads successfully?

What is the primary benefit of using Schema Validation libraries (like Zod or Joi) over manual controller checks?

Why do query parameters like `/api?limit=5` require type transformation inside schema validators?

In Vite's dev mode, how does it serve your application?

Why does Rollup produce smaller library bundles than Webpack?

What is the purpose of `[contenthash]` in Webpack/Vite output filenames?

In the Network waterfall, a request shows a large green TTFB segment. What does this indicate?

You want to find a JavaScript memory leak. What is the correct sequence using the Memory panel?

What is a 'Logpoint' in DevTools Sources panel?

What is the purpose of `eslint-config-prettier`?

What does lint-staged do that plain ESLint pre-commit hooks don't?

What happens when you run this Node.js code (package.json has no `type` field)?

Why can't CommonJS `require()` load an ES module synchronously?

What does `export default` vs named `export` mean for tree shaking?

What does `^18.2.0` mean in `package.json`?

What is a 'phantom dependency' in the context of npm?

What is the difference between `npm install` and `npm ci`?

What does this code output?

What is the difference between `.match(/pattern/)` and `.match(/pattern/g)`?

What does `(?<=\$)\d+` match in the string '$100 and 200'?

A developer changes an element's `left` property via JS inside a `requestAnimationFrame` callback. What rendering steps does this trigger?

What does the following code cause, and why is it a performance problem?

Which CSS properties can be animated at 60fps without triggering layout or paint?

An element has `display: none`. Is it in the render tree?

A CNAME record for `api.example.com` points to `backend.myapp.io`. DNS TTL is 300s. You change the CNAME to point to `backend2.myapp.io`. How long at most before all users see the change?

TLS 1.3 achieves 1 RTT for the handshake. What is the key mechanism that allows this vs TLS 1.2's 2 RTTs?

What does `Strict-Transport-Security: max-age=31536000; includeSubDomains` mean?

What is the key difference between HTTP/2 multiplexing and HTTP/1.1 pipelining?

A user is authenticated but tries to access a resource they don't have permission to see. What status code should the server return?

An API response includes `Cache-Control: no-cache`. A browser makes the same request an hour later. What happens?

Which HTTP/3 feature specifically eliminates TCP head-of-line blocking?

In what order does the browser check caches before making a network request?

How many round trips does a brand-new HTTPS connection over TLS 1.3 require before the first byte of HTTP response?

A `<script src='app.js'>` tag (no async/defer) is placed in `<head>`. What happens?

You add `Cache-Control: private, max-age=3600` to an API response. What does this mean?

Which of the following is considered an Atom in Atomic Design?

What distinguishes a Template from a Page in this hierarchy?

How does the Dependency Inversion Principle apply to frontend API integration?

In Frontend Clean Architecture, where do Custom React Hooks typically fit?

What are design tokens in a design system?

What is a primary benefit of building components in Storybook?

What is the primary benefit of feature-based folder organization?

Why is a root-level `index.ts` (barrel file) important in a feature directory?

What is the primary benefit of Preview Deployments in frontend development pipelines?

Why should you build your application once and promote the same artifact, rather than rebuilding for production?

What is a primary benefit of using Feature Flags alongside trunk-based development?

What is the flash of layout shift called when a client-side feature flag evaluation resolves after initial render?

What is the purpose of CSS Logical Properties in internationalization?

Which native JS object should you use to format currencies internationally without third-party dependencies?

What is the primary role of the App Shell in a Micro Frontend architecture?

How should decoupled Micro Frontends communicate to prevent tight coupling?

What does a 'Remote' represent in Module Federation?

Why is setting `{ singleton: true }` important for libraries like React in shared configurations?

What is the role of workspaces in package managers like pnpm or Yarn?

How does Turborepo speed up builds via Caching?

Why should source maps be uploaded to error trackers like Sentry but deleted from public CDN directories?

What are 'breadcrumbs' in error tracking tools like Sentry?

Confirmed via the currently-installed web-vitals v5.3.0 library's own exports, what are the three CURRENT Core Web Vitals?

True or false: FCP (First Contentful Paint) is itself one of the Core Web Vitals.

Confirmed via LCPThresholds ([2500, 4000]), what rating does a 3200ms LCP receive?

True or false: CLS only accounts for layout shifts that happen during the initial page load.

Why did INP replace FID as the responsiveness Core Web Vital?

True or false: a page can have a fast FCP and a slow LCP simultaneously.

What does the 'rating' field on a web-vitals Metric object represent?

True or false: navigator.sendBeacon is preferred over a normal fetch() call for reporting vitals specifically because it reliably delivers even if the page is being unloaded right after the call.

What's the most common, most fixable cause of poor CLS?

True or false: real-user 'field' data (via the web-vitals library) and lab data (via Lighthouse) answer the exact same question and are redundant with each other.

Why does a page that's snappy on its first click but janky on a later interaction now get correctly penalized under INP, unlike under the old FID metric?

True or false: LCP improvements are primarily about raw download bandwidth, not resource discovery/priority timing.

A team reports 'Our Core Web Vitals are LCP: good, FID: good, CLS: good' in a status update. What should be flagged?

True or false: CLS is measured in milliseconds, the same unit as LCP and INP.

Why do LCP and CLS both trace back to the browser's paint/layout pipeline, per Under the Hood?

True or false: onLCP, onCLS, and onINP are the only vitals-related functions the web-vitals library exports.

What does the metric.id field on a reported Web Vitals metric protect against?

True or false: DevTools' Performance panel and the web-vitals library are measuring fundamentally different underlying browser events.

A hero image is the largest element on a page, but it's referenced only via a CSS background-image property, discoverable only after the CSS file finishes loading. What Core Web Vital is most directly affected?

True or false: Core Web Vitals are used only for internal team performance tracking and have no relationship to Google Search ranking.

What does Lighthouse actually do to produce its report?

True or false: the Lighthouse Performance score is a simple average of the Core Web Vitals.

In the Try It scenario, why does a page with 'good' LCP AND 'good' CLS still get a mediocre overall Lighthouse score?

True or false: Total Blocking Time (TBT) has a direct, equivalent field-measured Core Web Vital.

Why does Lighthouse apply simulated throttling by default, regardless of the actual machine running the audit?

True or false: the full performance trace Lighthouse records uses the same underlying Chrome tracing infrastructure as DevTools' own Performance panel.

What does a very poor Total Blocking Time typically indicate is happening during page load?

True or false: chasing a perfect 100 Lighthouse score as a goal disconnected from real-user field data is a recommended practice.

In the implement-it-yourself weighted score calculator, why does a TBT sub-score of 25 (out of 100) have such an outsized effect on the final composite score of ~74?

True or false: running Lighthouse in CI on every deploy is recommended specifically to catch performance regressions immediately when they're introduced.

Why should Lighthouse's specific optimization suggestions be treated as an investigation starting point rather than a literal checklist?

True or false: a disagreement between Lighthouse (lab) scores and real-user (field) Web Vitals data always means one of the two measurements is broken or wrong.

A team sees LCP: good, CLS: good in their field data dashboard but a Lighthouse CI check just failed a score threshold. What's the most likely next diagnostic step?

True or false: each individual metric in Lighthouse's composite score first gets converted to its own 0-100 sub-score via a scoring curve, before being combined by weight into the final number.

Why is running Lighthouse in CI on every single commit a real tradeoff, not a free choice?

What does a 'memory leak' actually mean in a garbage-collected language like JavaScript?

True or false: removing a DOM element from the document (el.remove()) automatically makes it and its associated data unreachable and eligible for garbage collection.

In the Try It scenario, why does hugeData remain reachable even though onClick only references summary?

True or false: a growing heap size observed while using an app is, by itself, sufficient proof of a memory leak.

What is the actual technique for confirming a suspected leak, per this topic?

True or false: an event listener registered on an element that's later removed from the DOM will always be automatically cleaned up.

Why is a detached DOM node still held in a JS array (like the `detachedNodes` pattern) a genuine leak risk?

True or false: this topic's reachability-based leak model is a separate concept from normal garbage collection mechanics, requiring its own distinct mental model.

Why does the topic recommend scoping large data OUT of long-lived closures when only a derived value is needed later?

True or false: a small per-operation memory leak matters more for a long-running single-page app than for a page that reloads frequently.

A code review finds a WebSocket message handler that pushes every received message into a module-level array with no size limit or clearing logic, in an app users leave open for hours. What's the risk?

True or false: forcing garbage collection manually is something that should be done routinely in production code to prevent leaks.

What's the fundamental shared mechanism across all three leak patterns covered in this topic (event listeners, detached DOM references, over-capturing closures)?

True or false: DevTools' heap snapshot comparison feature (in the Memory panel) is specifically built for the before/after leak-confirmation technique described in this topic.

In the Implement It Yourself example, why does simulateFixedOperation() NOT contribute to heap growth the way simulateLeakyOperation() does?

Confirmed via this app's own bundled Next.js 16 docs, what happened to Turbopack starting in Next.js 16?

True or false: @next/bundle-analyzer works identically whether a project uses webpack or Turbopack.

What is next experimental-analyze, confirmed by actually running it this session?

True or false: a raw chunk file size number alone tells you exactly which specific dependency or module to fix.

In the Try It scenario, what could cause formatCurrency and debounce to remain in the final bundle even though only formatDate is imported?

True or false: tree-shaking generally applies the same way to CommonJS require() as it does to ES module import statements.

Why should bundle analysis be re-run after adding a significant new dependency, per this topic?

True or false: in the implement-it-yourself example, the analyzeChunkSizes function attributes bytes to specific SOURCE MODULES within a chunk, the same way a real interactive analyzer UI does.

Confirmed against this app's own real .next/static/chunks output, what was the largest single observed chunk size?

True or false: bundle analysis has a meaningful runtime performance cost in production.

A team runs ANALYZE=true npm run build on their Next.js 16 project (using default Turbopack) expecting @next/bundle-analyzer's report, but gets no analyzer output. What's the most likely explanation?

True or false: next experimental-analyze can filter its module inspection by route, environment (client/server), and file type.

Why does the topic connect bundle analysis directly to the memoization topic's recommended workflow?

True or false: a namespace import (import * as utils from './utils.js') is generally at LEAST as tree-shakeable as specific named imports.

What's the actual value of bundle analysis tooling's byte-attribution capability, per this topic's Performance Tips?

Confirmed by running this app's own production build, what splitting happens automatically with zero manual dynamic() calls?

True or false: automatic route-based splitting also handles splitting a heavy, rarely-used component WITHIN a single page (e.g., only needed after a specific button click).

What's the real tradeoff introduced by wrapping a component in dynamic()?

True or false: in the Try It scenario, splitting out a Modal that nearly every user opens immediately is likely to make the EXPERIENCED latency worse, not better.

What does the `loading` option on dynamic() actually improve?

True or false: ssr: false should be used as the default setting on every dynamic() call, regardless of the component.

In the Implement It Yourself example, why does calling heavyModule.load() twice concurrently NOT trigger two separate network requests?

True or false: manually wrapping a component in dynamic() when it's only ever rendered on its own separate route provides a real, additional benefit beyond what automatic route-based splitting already does.

Why should bundle analysis (measurement) generally precede a decision to split out a specific component?

True or false: the real, confirmed chunk sizes from this app's build ranged up to 228KB for a single chunk file.

A code review finds a heavy date-picker library wrapped in dynamic() with no loading fallback, used in a form field most users interact with within the first few seconds of landing on the page. What should be flagged?

True or false: this app's build confirmed that Next.js automatically separates framework/vendor code from application-specific code into different chunks.

What determines whether splitting out a specific component is a net win, per this topic's framing?

True or false: the actual network/parse cost of a dynamically-imported module, once resolved, is paid again on every subsequent call to load it.

Why is 'should we code-split this app' framed as usually the wrong question in this topic?

Confirmed against this app's own bundled Next.js 16 docs, what happened to the `priority` prop on next/image?

True or false: the current documentation recommends using `preload` as the default choice for any image that needs to load quickly.

Why does next/image require width/height (or a sized fill container)?

True or false: in the Try It scenario, setting preload on the small logo instead of the hero banner is likely correct if the hero banner is actually the LCP element on most viewports.

What underlying browser mechanism does next/image's preload prop actually generate?

True or false: the srcset/sizes mechanism lets the BROWSER decide which image size to download, based on the actual device, rather than requiring JavaScript-side device detection.

Why does the documentation specifically warn against preload when multiple images could be the LCP element depending on viewport?

True or false: next/image lazy-loads images by default using native browser lazy loading.

A developer follows an older tutorial and writes `<Image src="/hero.jpg" priority />` on this app's actual installed Next.js version. What's the accurate assessment?

True or false: remotePatterns configuration is required before next/image will serve images from an external (non-local) domain, as a deliberate security boundary.

Why is automatic format conversion to WebP (where supported) described as a 'close-to-free win'?

True or false: this topic's verification approach for next/image claims used the SAME method (checking this app's own bundled documentation) as the standing verification method for the rest of the Next.js domain.

What happens if a next/image component uses `fill` without a properly sized parent container?

True or false: setting fetchPriority="high" is explicitly mentioned in the current documentation as a preferred alternative to preload in most cases.

Why does verifying prop names/behavior against the actual installed framework version matter specifically for image-optimization code, per this topic?

Confirmed against this app's own bundled Next.js 16 docs, what is the current status of the React Compiler?

True or false: useMemo and useCallback solve the exact same problem and are interchangeable.

In the Try It scenario, why does ExpensiveChild still re-render despite being wrapped in React.memo?

True or false: useMemo's dependency comparison uses deep equality, correctly detecting when two different object references have identical contents.

Why is memoizing a trivially cheap calculation (like x * 2) often counterproductive?

True or false: React.memo and useCallback are usually most effective when used TOGETHER, since one alone frequently accomplishes nothing.

Why does this topic explicitly warn against assuming React Compiler is 'already handling this automatically'?

True or false: memoization is a pure performance win with no real tradeoff or cost.

What specifically does the memoize() function in Implement It Yourself use to decide whether to recompute?

True or false: profiling to confirm a re-render or recalculation is genuinely expensive is recommended as a step BEFORE reaching for memoization.

A code review finds `<Child data={{ id: props.id }} />` passed to a React.memo-wrapped Child on every render of the parent. What's the issue?

True or false: the React Compiler, once enabled, aims to make manual useMemo/useCallback/React.memo largely unnecessary by inserting equivalent optimizations automatically at build time.

Why does this topic explicitly avoid framing manual memoization as 'obsolete' despite React Compiler being stable?

True or false: useMemo still executes on every render — it just skips running the expensive callback function if dependencies are unchanged.

What real, current path exists for reducing how much MANUAL memoization a team needs to hand-write, per this topic?

Confirmed via this topic's exact walkthrough, what real LCP improvement did adding a preload hint produce?

True or false: preload, prefetch, and preconnect are essentially interchangeable ways of saying 'load this faster.'

What happens, confirmed as real browser behavior, if a preloaded resource isn't actually used within a few seconds?

True or false: prefetch guarantees a resource will be fully downloaded before a likely future navigation actually happens.

What does preconnect actually do, mechanically?

True or false: dns-prefetch performs the same full connection setup as preconnect, just with a different name.

In the Try It scenario, why is prefetch the wrong hint for the checkout-bundle scenario specifically?

True or false: preconnect has zero cost even if the connection ultimately goes unused.

How do resource hints (preload/prefetch/preconnect) relate to HTTP caching (Cache-Control/ETag), per Under the Hood?

True or false: preconnect's latency-saving benefit is most pronounced on higher-latency (e.g. slower mobile) connections.

A page includes <link rel="preload" as="font" href="/rare-font.woff2"> for a font only used on a settings page most users never visit from the current page. What's the likely observable consequence?

True or false: resource hints are extremely cheap to ADD (a single link tag) but 'cheap to add' does not mean 'free of consequence if misapplied.'

Why does the hero-image-via-CSS-background scenario in the WaterfallVisualizer walkthrough delay LCP without preload?

True or false: a framework's own navigation-level prefetching (e.g. covered in the Next.js Performance topic) is necessarily identical in behavior to the raw HTML prefetch resource hint.

What's the fundamental difference in what preload/prefetch DO versus what preconnect DOES?

Confirmed against this app's own bundled Next.js 16 docs, what does enabling cacheComponents do to the App Router's data-fetching default?

True or false: this app's own actual configuration has cacheComponents enabled.

What does Partial Prerendering (PPR), as implemented by cacheComponents, actually do?

True or false: confirmed via the bundled docs, navigating away from a route under cacheComponents always fully unmounts that route's components.

In the Try It scenario, why does the ExpandableSection remain expanded after navigating away and back?

True or false: a component's mount-only initialization logic (empty-deps useEffect) is guaranteed to re-run every time a user 'returns' to that route under cacheComponents's navigation model.

What is the granularity of caching decisions under the confirmed cacheComponents model, via the 'use cache' directive?

True or false: Next.js keeps an unlimited number of previously-visited routes hidden via Activity, with no limit.

How does a static-shell-first pattern (PPR) directly benefit LCP specifically, per this topic?

True or false: verifying whether cacheComponents is actually enabled in a specific project is necessary before reasoning about its behavior, per this topic's recommended practice.

A team assumes 'we're on Next.js 16, so our forms reset automatically every time a user navigates back to this page.' What's the risk in this assumption?

True or false: the static-shell-plus-streaming pattern requires blocking the entire response until the slowest dynamic data resolves, the same as the older all-or-nothing model.

What happens to a component's EFFECTS (not its state) when its route is set to Activity 'hidden' mode?

True or false: granular, function-level 'use cache' decisions allow caching the reusable/shared portions of a page's data while keeping genuinely personalized portions dynamic, within the same route.

Why does this topic explicitly distinguish itself from the shipped nextjs.performance topic in the general Next.js domain?

Demonstrated live in the stale-closure preset, what happens with an effect that has an empty dependency array but reads a state variable inside a setInterval callback?

True or false: confirmed against this app's own bundled Next.js 16 docs, useEffectEvent is a genuinely new React 19.2 hook, not a training-data hallucination or a third-party library.

What specifically does useEffectEvent solve, per its confirmed purpose?

True or false: in the Try It scenario, keeping `query` in the effect's dependency array alongside using useEffectEvent for the search callback is a mistake.

What is the key distinguishing question for deciding whether a value belongs in a dependency array versus inside a useEffectEvent-wrapped function?

True or false: a manual useRef-based 'latest value' workaround for the stale-closure problem stopped working once useEffectEvent shipped.

What does list virtualization fundamentally do?

True or false: virtualization should be applied to every list component regardless of size, as a general best practice.

In the implement-it-yourself getVisibleRange function, what is 'overscan' for?

True or false: virtualization and memoization (React.memo etc.) solve the exact same problem and are redundant with each other.

Why is adding a value to a dependency array 'just to silence a lint warning,' without considering whether it should genuinely be reactive, flagged as a mistake?

True or false: there's a real crossover point where virtualization's own overhead can exceed its benefit for small enough lists.

A code review finds useEffectEvent used to wrap an ENTIRE effect body, with the surrounding useEffect having an empty dependency array despite the effect's timing genuinely needing to restart on a specific prop change. What's the issue?

True or false: this topic's stale-closure demonstration and its confirmed fix both come from real, verified sources — a live shipped component (HookTimeline) and this app's own bundled Next.js 16 documentation, respectively.

What real DOM/reconciliation cost does virtualization avoid for a 10,000-item list?

Demonstrated live in the parent-cascade demo, what is React's DEFAULT behavior when a component's state changes?

True or false: in the memo-boundary demo, a memoized component that receives a genuinely changing prop re-rendering every time is a memoization FAILURE.

Demonstrated live in context-blast, why does a React.memo-wrapped component still re-render when a context value it subscribes to changes?

True or false: per the Try It scenario, a memoized component that does NOT call useContext for the changed context still correctly stays frozen when that context value changes.

What is the actual fix for the context-bypass-memo problem, since React.memo itself cannot address it?

True or false: combining several unrelated pieces of state into one large context object is generally a GOOD practice for simplifying provider setup.

Why does this topic emphasize that all its demonstrations come from the ALREADY-SHIPPED RenderVisualizer component?

True or false: a re-render is always wasteful and should always be the target of an optimization effort.

Why can a memoized component still cascade re-renders despite React.memo, even without any context involvement?

True or false: splitting contexts has no real tradeoff and should be applied to every context in an application by default.

A code review finds a large AppContext holding { theme, user, cartItems }, with a component that only reads `theme` wrapped in React.memo. The cartItems update frequently. What's the actual re-render behavior of that theme-only component?

True or false: this topic's rendering-optimization coverage and the React Performance Patterns topic build on the exact same underlying React.memo/context mechanics, just at a broader applied-patterns level in the latter.

Why is understanding the context-bypass gotcha described as 'genuinely high-leverage' in Performance Tips?

True or false: React DevTools' Profiler is mentioned as a way to verify whether a suspected rendering optimization actually worked, rather than just assuming it did.

What's the precise, narrow, actionable version of the context-bypass gotcha, per the Try It solution?

For a query returning a list of N users, each with a nested posts field resolved via a separate database call per user, how many total queries fire?

True or false: DataLoader's batch function is confirmed to receive DEDUPLICATED keys — a duplicate key requested via .load() twice only appears once in the batch.

Two .load() calls issued synchronously back-to-back, and a third issued inside a setTimeout callback — how many total batch calls fire, confirmed by execution?

True or false: DataLoader's batching window is a fixed time duration (like 10ms), rather than being tied to the event loop's tick structure.

Why is sharing a single DataLoader instance across multiple requests a serious bug, not just a minor inefficiency?

True or false: the correct pattern is creating one DataLoader instance at server startup and reusing it for the lifetime of the server process.

What's the most reliable diagnostic signature of an N+1 problem, as opposed to other causes of slow responses?

True or false: the N+1 problem is typically invisible during local development with small datasets and only becomes apparent at production scale.

What underlying JavaScript mechanism does DataLoader's batching rely on for its collect-then-flush behavior?

True or false: DataLoader's resolver code change from the naive N+1 version to the batched version is minimal — largely just swapping a direct fetch call for a loader.load() call.

What's the key structural difference between a typical REST API and a GraphQL API?

True or false: multiple top-level mutation fields in a single operation are guaranteed by the GraphQL spec to execute serially, one completing before the next starts.

Are top-level QUERY fields guaranteed to execute in the order they're written, the same way mutation fields are?

True or false: variables should be avoided in favor of directly interpolating values into the query string, for simplicity.

What problem do aliases solve?

True or false: a fragment is a named, reusable set of fields for a given type that can be spread into multiple queries.

Why does GraphQL guarantee serial execution specifically for mutations but not queries?

True or false: fragments have a measurable runtime performance cost during query execution.

A client needs to fetch the same 'greeting' field twice in one query, once for name 'A' and once for name 'B'. What's required to do this correctly?

True or false: the response shape of a GraphQL query always exactly mirrors the shape of the query itself.

What does declaring a variable as $who: String! (with the exclamation mark) mean?

True or false: because query field ordering is unspecified, a well-implemented server can resolve independent sibling query fields concurrently, a real performance opportunity mutations don't have.

Are GraphQL fields nullable or non-null by default?

True or false: when a non-null field's resolver throws, only that specific field becomes null in the response, leaving sibling fields unaffected.

Given `type Query { user: User }` (nullable) and a failing non-null `name` field inside User, where does the null bubbling stop?

True or false: if EVERY field from the failing one up to the root is non-null, the null bubbling can wipe out the entire response, making `data` itself null.

When should a union be used instead of an interface?

True or false: a client selects type-specific fields from a union using inline fragments, like `... on Book { title }`.

What's the purpose of an input type in GraphQL SDL?

True or false: marking every field non-null by default, reflexively, is a recommended schema-design practice.

What's a genuine tradeoff of code-first schema frameworks (like Pothos/Nexus) compared to schema-first (writing SDL directly)?

True or false: poor nullability choices can indirectly hurt performance/UX by forcing a client to re-fetch an entire response when only one deeply-nested field actually failed.

What's the fundamental difference between a subscription and a query/mutation?

True or false: subscriptions-transport-ws is confirmed deprecated, with its own published notice recommending graphql-ws as the replacement.

On the current version of graphql-subscriptions (v3), which PubSub method is confirmed to actually exist for creating a subscribable async iterable?

True or false: calling the older asyncIterator() method name from an outdated tutorial against the current graphql-subscriptions package will silently work with slightly different behavior.

When multiple clients are subscribed to the same event, and pubsub.publish() is called once, how many of them receive the pushed payload?

True or false: a subscription resolver's subscribe function must return (or resolve to) an async iterable.

When should pubsub.publish() be called relative to a mutation's actual database write?

True or false: an open subscription connection consumes server resources only briefly, similar to a typical query's request/response cycle.

Why can't code written for subscriptions-transport-ws simply be pointed at a graphql-ws server without changes?

True or false: variables, aliases, and fragments (covered in Queries & Mutations) still work inside a subscription operation's selection set.

Confirmed directly: in the currently installed Apollo Client version, where do useQuery and useMutation live?

True or false: ApolloClient and InMemoryCache, the core client/cache classes, are still importable from the root @apollo/client package in v4.

What does Apollo Client's normalized cache do when two DIFFERENT queries both return an object with the same __typename and id?

True or false: updating one entity's data in the cache (e.g. via a mutation response) automatically updates every OTHER query result that references that same entity, with no manual sync code needed.

Why is including __typename and id in a mutation's response selection important?

True or false: useQuery and useMutation are built on entirely custom React internals, unrelated to standard React hooks rules.

A developer upgrades from Apollo Client 3 to 4 and their app fails with 'useQuery is not a function.' What's the most likely cause?

True or false: normalization means storing every fetched object as a completely flat, deeply-copied entry with no shared references, to keep queries independent of each other.

What's a practical performance benefit normalization provides, beyond just avoiding duplicate storage?

True or false: cache.identify() is recommended over manually constructing cache-entry ID strings by hand.

Confirmed directly: what happens when attempting to resolve the `apollo-server` package in this project's dependency tree?

True or false: ApolloServer instances in the current major version have a .listen() method, the same as older versions.

What does startStandaloneServer confirmed to do, based on real execution?

True or false: mounting Apollo Server into an existing Express app requires a separate, dedicated integration package rather than something bundled directly into @apollo/server.

How often is the context function called, confirmed by direct testing?

True or false: the context function's per-request execution is the actual mechanism that makes the DataLoader-per-request best practice implementable.

What's a common mistake when migrating from startStandaloneServer to an Express integration?

True or false: Apollo Server's standalone and Express integration modes run on top of Node's own http module underneath, rather than replacing it with something else.

Why does creating a DataLoader at module scope (outside the context function) defeat its purpose?

True or false: verifying Apollo Server code/tutorials against the actually-installed major version is unnecessary, since the API has been stable across all versions.

What does Apollo Client's default fetchPolicy, 'cache-first', actually do?

True or false: cache.readQuery() throws an error when nothing has been cached for the given query yet.

What's the key difference between network-only and no-cache fetchPolicy values?

True or false: server-side/CDN caching (via @cacheControl) and Apollo Client's normalized cache solve the same problem for the same audience.

Why are GraphQL requests normally NOT cacheable by standard HTTP/CDN caching, unlike a typical REST GET endpoint?

True or false: Automatic Persisted Queries are confirmed to be built into Apollo Server's core package, not a separate required plugin dependency.

What does a persisted query send on repeat requests, instead of the full query text?

True or false: cache-and-network returns cached data immediately (if available) AND fires a network request anyway, updating the UI again once it resolves.

Once data IS written to the cache under any fetchPolicy (including network-only), what still applies?

True or false: server-side response caching reduces backend compute/database load across all clients, a benefit client-side caching alone cannot provide.

What does the @key directive on a type declare in a federated subgraph?

True or false: __resolveReference is confirmed to be the resolver called when another subgraph has only an entity's key fields and needs the rest of the entity filled in.

Confirmed via Apollo's own current guidance: what is now recommended for the production federation gateway/router layer, instead of the older @apollo/gateway Node.js package?

True or false: individual subgraphs also need to be rewritten in Rust to work with the modern Apollo Router.

Is @apollo/gateway (the older Node.js gateway) still usable at all?

True or false: buildSubgraphSchema is required (instead of a plain schema-building function) specifically because federation needs additional machinery wired up beyond a standalone GraphQL schema.

In the _entities query mechanism confirmed via real execution, what does the router send to a subgraph to resolve an entity reference?

True or false: a type marked @key without a corresponding __resolveReference resolver is a complete, correctly functioning federated entity.

What's the key structural difference between federation's entity model and older schema-stitching approaches?

True or false: entity reference resolution should ideally be batched (multiple references resolved in one call) rather than resolved one at a time, for the same reasons covered in the N+1 Problem topic.

Confirmed via execution: at what stage does query depth limiting reject an overly deep query?

True or false: a query that's shallow (low nesting depth) but requests very large lists via pagination arguments (like first: 10000) is guaranteed to be caught by depth limiting alone.

What does query complexity analysis add beyond what depth limiting alone provides?

True or false: confirmed by execution, setting introspection: false on Apollo Server genuinely blocks __schema/__type queries with a real error, rather than just hiding a UI toggle.

What's the genuine tradeoff of leaving introspection enabled on a public production GraphQL endpoint?

True or false: persisted queries in strict mode (rejecting any non-registered query) close off the entire class of 'attacker crafts a novel expensive query' attacks, since only pre-approved query shapes can execute at all.

Why does rejecting an expensive query at the validation stage (before execution) matter for performance, not just security?

True or false: rate limiting alone (capping request volume) is sufficient protection without also needing query-level depth/complexity controls.

What general security principle from Node.js security does query depth/complexity limiting directly apply to the GraphQL context?

True or false: it's recommended to configure both depth limiting AND complexity limiting together for a production API, rather than choosing just one.

What does 'immediate-mode' mean in the context of the Canvas API?

Why does setting a canvas's size via CSS (e.g. `canvas { width: 800px }`) instead of the width/height HTML attributes cause blurry rendering?

By default, content drawn to a <canvas> element is part of the accessibility tree and announced by screen readers.

Why is requestAnimationFrame preferred over setInterval for Canvas animation?

Why is IntersectionObserver preferred over a scroll event listener + getBoundingClientRect() for detecting when an element enters the viewport?

What is the fundamental limitation of a Web Worker compared to main-thread JavaScript?

Calling e.preventDefault() inside a 'dragover' event handler is required for the corresponding 'drop' event to fire at all.

Why can't you use CSS `fill: blue` from the host page to change the color of an SVG embedded via `<img src="icon.svg">`?

What does the SVG `viewBox` attribute define?

SVG is fundamentally an 'immediate-mode' format, like Canvas — shapes are pixels with no retained DOM representation.

What is the standard pattern for reusing the same icon dozens of times across a page without duplicating its path data?

Why must every custom element name contain a hyphen (e.g. `user-card`, not `usercard`)?

A component's global page CSS rule `user-card .title { color: red }` has no effect on markup inside that component's shadow DOM. Why?

Content placed inside a <template> element is immediately rendered and visible in the page, just like a <div>.

Which custom element lifecycle callback is the correct place to do initial setup like fetching data or attaching event listeners?

Which client-side storage mechanism is automatically sent to the server with every matching HTTP request?

Why is an HttpOnly cookie safer than localStorage for storing an auth token, specifically with respect to XSS?

The 'storage' event fires in the same tab/window that made the localStorage change, allowing you to react to your own writes.

You need to store thousands of structured records with the ability to query by an indexed field, entirely offline. Which storage mechanism fits best?

What WCAG conformance level is the practical baseline referenced by most legal accessibility requirements (ADA case law, EN 301 549, AODA)?

What's wrong with assigning tabindex="1", tabindex="2", tabindex="3" to manually control tab order?

A Lighthouse accessibility score of 100 is a reliable guarantee that a product is fully usable by screen reader users.

When a modal dialog closes, where should keyboard focus go?

What is 'the first rule of ARIA'?

What is the key difference between aria-live="polite" and aria-live="assertive"?

Setting aria-expanded="false" in the initial HTML markup is sufficient — screen readers will detect the actual open/closed state automatically once JavaScript toggles a CSS class.

aria-hidden="true" is applied to a <button> that remains visually visible and clickable. What's the resulting bug?

What is the primary accessibility problem with using `placeholder` instead of `<label>`?

Which HTML input attribute lets you inspect exactly *why* validation failed (e.g. tooShort vs. typeMismatch vs. valueMissing) via JavaScript?

Client-side HTML form validation (required, pattern, type constraints) is sufficient security and doesn't need to be duplicated on the server.

A radio button group is missing a <fieldset>/<legend> wrapper. What's the concrete accessibility impact?

Which pair of elements is functionally equivalent to `<div class="btn" onclick="...">` in terms of built-in keyboard accessibility?

What is the correct distinguishing factor between <article> and <section>?

It's valid HTML5 to use multiple <h1> elements on a single page, one per <section>, because of the outline algorithm.

A screen reader user presses their landmark-navigation shortcut on a page built entirely from semantic <header>, <nav>, <main>, <aside>, and <footer> elements with no ARIA attributes added. What regions will they be able to jump between?

Which of these is a direct search ranking factor, versus one that mainly affects click-through rate on the results page?

robots.txt is a security mechanism that prevents unauthorized users from accessing disallowed pages.

Why might a fully client-side-rendered React SPA (no SSR/SSG) underperform in organic search compared to an equivalent server-rendered page?

What format does Google explicitly recommend for structured data, over Microdata/RDFa inline attributes?

A site permanently renames a product URL and uses a 302 redirect from the old URL to the new one. What's the SEO consequence?

A sitemap.xml guarantees that every URL listed in it will be indexed by search engines.

What is a 'soft 404' and why is it harmful for SEO?

What does the STAR method stand for?

Which section of a STAR answer should generally be the longest and most detailed?

True or false: a good behavioral answer to a 'failure' prompt should describe something that wasn't really a significant failure, to avoid looking bad.

What's the main problem with the weak sample answer analyzed in the Try It section?

True or false: a strong leadership story for an individual contributor requires having had formal management authority over other people.

Why is building a story bank before the interview recommended over improvising stories on the spot?

True or false: memorizing a behavioral answer word-for-word is generally the most robust way to deliver it under interview conditions.

If asked specifically about a disagreement with a teammate, what's the mistake in answering with a strong story about a disagreement with an external vendor instead?

True or false: a single real story from a candidate's work history can typically only be used to answer one specific behavioral theme.

In the strengthened version of the disagreement story in the Try It section, what specific action moved the disagreement toward resolution?

Which of these Result statements is strongest, per this topic's framing?

True or false: the Situation and Task sections of a STAR answer should generally be brief, to leave more time for the Action section.

What's the risk of over-rehearsing a behavioral story to the point of reciting it verbatim?

According to this topic, what two prompt types do candidates most often try to weakly improvise in the moment, and should specifically prepare in advance?

True or false: STAR should be applied as a rigid, identical script regardless of what specific behavioral prompt is being asked.

What makes a story a poor fit specifically for a 'leadership without authority' prompt?

True or false: the story bank template's 'Themes this could answer' tagging step is meant to identify a single, exclusive theme per story.

Why does behavioral interviewing rely on past-behavior questions rather than purely hypothetical ones?

True or false: a 2-3 minute spoken answer is a reasonable general target length for a STAR response, per this topic's performance tips.

What's the recommended self-check for whether a drafted STAR story's Action section is strong enough?

What three components make up the Action + Context + Result bullet formula?

Why is 'Responsible for the checkout flow' considered a weak bullet?

True or false: every strong resume bullet must include a precise percentage or numeric metric.

According to this topic, what does a hiring manager typically try to determine from a portfolio in the first few minutes of skimming it?

True or false: a portfolio with ten small, similarly-polished demo projects generally gives a hiring manager more useful signal than one or two projects with a detailed account of real technical decisions.

What's the specific problem with a portfolio project whose live demo link is broken?

True or false: including every role and task from an entire career, regardless of relevance to the role being applied for, is generally good practice because it shows the full breadth of experience.

Which fallback approaches does this topic recommend for quantifying impact when a precise metric isn't available? (Select all that apply conceptually — pick the option listing valid fallbacks)

True or false: for most candidates with several years of relevant experience, a one-page resume is generally recommended over a longer, more exhaustive one.

A candidate writes: 'Worked on the company's React codebase, fixing bugs and adding features as needed.' What is this bullet missing, per the Try It analysis?

True or false: a strong portfolio project entry should ideally explain what problem the project solves, not just describe what the project technically is.

Why does the topic recommend front-loading the strongest, most specific part of a bullet at its beginning?

True or false: when tailoring a resume for a specific role, every bullet from every past role should always be included regardless of relevance, to be thorough.

In the strengthened bullet example from the Try It section ('Fixed a memory leak... cutting the dashboard's reported crash rate by roughly 90%...'), what specifically establishes the CONTEXT part of the formula?

True or false: describing something a candidate's TEAM did in general, without clarifying the candidate's own specific contribution, is generally as strong as describing the candidate's own specific action.

What is the main practical risk of a resume that reads as trying to include everything the candidate has ever done?

True or false: a resume's job, per this topic's framing, is to fully document a candidate's entire career history.

Which portfolio placement practice does this topic recommend?

True or false: a resume bullet without a precise numeric metric is automatically as weak as one using only vague adjectives like 'significantly'.

What's the recommended fix when a candidate has a bullet describing an ongoing responsibility with no clear accomplishment attached?

Why does volunteering your current salary early in a process risk hurting your negotiation?

When responding to an early 'what are your salary expectations' question, what does this topic recommend over stating a single specific number?

True or false: if pushed for a single number rather than a range, giving the middle of your researched range is generally better than giving the top.

What's the main risk of relying on just one compensation-data aggregator's number without cross-checking it?

True or false: once a company has extended a real written offer, a well-reasoned counter is generally considered a normal, expected part of the process rather than a confrontational move.

What four elements make up the core offer-counter script described in this topic?

True or false: without a competing offer, there is no legitimate basis for countering a written offer.

Why is base salary often the least flexible part of an offer, per this topic?

True or false: if a candidate hits a genuine hard ceiling on base salary, the negotiation is generally considered fully over with no other productive options.

What's the specific problem with fabricating a competing offer as negotiation leverage?

True or false: the weak sample response analyzed in the Try It section ('whatever you think is fair') is problematic mainly because it sounds impolite.

In the strengthened version of the early-salary-question response from Try It, what did the candidate keep from the original weak response?

True or false: it's advisable to get final negotiated compensation terms in writing before resigning from a current role.

What does this topic identify as often the single biggest practical barrier to negotiating well, separate from knowing the right facts or scripts?