Question bank
Adobe Commerce Developer Expert
40 Adobe Commerce Developer Expert questions with the correct answer and a written explanation, organised across 5 exam domains.
- 40 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Configuration & Deployment
10 questions in this domain
- Question 1Single Choice
What is the immediate consequence if the crypt key stored in app/etc/env.php is lost?
- AAll previously encrypted data becomes unreadableCorrect answer
- BThe system automatically re-encrypts all data with a new key
- COnly passwords become unrecoverable
- DOnly payment information remains accessible
Why this is the answer
The crypt key in env.php is required for all cryptographic operations. Losing it means previously encrypted data cannot be decrypted, while a compromised key exposes the database.
- Question 2Multiple Select
Which session storage backends should be considered for Adobe Commerce production environments that use multiple web nodes?
- ARedisCorrect answer
- BMemcachedCorrect answer
- CLocal file-based storage on each web node
- DPHP default session files
Why this is the answer
File-based storage is the default for single-node environments, but multi-node production requires centralized distributed storage such as Redis or Memcached to ensure session consistency.
- Question 3Interactive
Review the session cookie configuration shown in the code block. Which flag should be set to true to prevent JavaScript from reading the session ID?
- AhttponlyCorrect answer
- Bsecure
- Csamesite
- Dlifetime
Why this is the answer
The HttpOnly flag prevents JavaScript from accessing the session ID, reducing the risk of session theft via cross-site scripting. The Secure flag is also important, but the specific issue described is JavaScript access.
- Question 4Single Choice
How does hashing differ from encryption in Adobe Commerce data protection?
- AHashing is one-way; the original value is not meant to be recoveredCorrect answer
- BHashing can be reversed with the same key
- CEncryption is used for password verification
- DHashing and encryption are interchangeable terms
Why this is the answer
Hashing is a one-way function used for password verification where the original value is never recovered. Encryption is a two-way process used for data that must be retrieved in its original form.
- Question 5Multiple Select
Which practices align with Adobe Commerce's encryption and key-management security guidance?
- AStore sensitive field values using application-level encryption through the Encryptor interfaceCorrect answer
- BMove the crypt key out of version controlCorrect answer
- CUse the Encryptor to encrypt passwords
- DHardcode the crypt key in a module configuration file for portability
Why this is the answer
Application-level encryption through the Encryptor interface is the standard implementation, and the crypt key should be environment-based and outside version control. Passwords must not use reversible Encryptor encryption, and hardcoding the key is a known trap.
- Question 6Interactive
In the code block, which Encryptor method should replace TODO to encrypt the API key using Adobe Commerce's standard symmetric encryption?
- Aencrypt($apiKey)Correct answer
- Bhash($apiKey)
- Cmask($apiKey)
- Dregenerate($apiKey)
Why this is the answer
Magento\\Framework\\Encryption\\EncryptorInterface provides encrypt() to symmetrically encrypt data at rest. Hash, mask, and regenerate are not the correct encryption methods.
- Question 7Single Choice
What is the purpose of data masking in Adobe Commerce?
- AIt obscures sensitive data in the UI, such as showing only the last four digitsCorrect answer
- BIt replaces data with a one-way hash for storage
- CIt uses a public key to encrypt data in the database
- DIt removes sensitive data from the database
Why this is the answer
Masking obscures sensitive data for display, but it is not encryption. Developers must distinguish between storing data encrypted in the database and displaying it securely in the Admin Panel.
- Question 8Multiple Select
Which statements about session lifecycle and expiration are true in Adobe Commerce?
- ASessions must be invalidated upon logoutCorrect answer
- BSession IDs should be regenerated when a user's privilege level changesCorrect answer
- CLong-lived session TTL always reduces security risk
- DLocal file session storage is ideal for multi-node production clusters
Why this is the answer
Logout invalidation prevents unauthorized reuse of a stale session identifier, and session regeneration on privilege change prevents session fixation. Long sessions increase risk, and local file storage is unsuitable for multi-node environments.
- Question 9Interactive
The code block handles a state-changing POST request. Which security mechanism is missing to prevent CSRF attacks?
- AForm key validationCorrect answer
- BSession regeneration
- CData masking
- DCrypt key rotation
Why this is the answer
Adobe Commerce uses unique form keys embedded in requests to validate state-changing actions and prevent CSRF. A valid session ID alone is not sufficient for POST request protection.
- Question 10Single Choice
In Adobe Commerce integrations, when is asymmetric encryption typically used?
- ASecure communication and digital signatures with external payment gateways or identity providersCorrect answer
- BEncrypting customer names in the customer table
- CStoring API credentials at rest in the database
- DHashing customer passwords
Why this is the answer
Asymmetric encryption uses a public/private key pair and is vital for verifying sender identity and secure communication with external payment gateways or identity providers. It is less common for standard database fields.
Development
12 questions in this domain
- Question 11Single Choice
What happens to encrypted data if the Crypt Key in `env.php` is lost?
- APreviously encrypted data becomes unreadable.Correct answer
- BAdobe Commerce automatically generates a new key and decrypts the data.
- COnly the admin password needs to be re-entered.
- DThe data remains readable but cannot be re-encrypted.
Why this is the answer
The crypt key in env.php is required for all cryptographic operations. Losing it means encrypted data can no longer be decrypted, so it is effectively unreadable.
- Question 12Multiple Select
Which statements correctly describe symmetric encryption in Adobe Commerce?
- AThe same key is used for encryption and decryption.Correct answer
- BThe `Magento\\Framework\\Encryption\\Encryptor` interface is the standard implementation to use.Correct answer
- CIt is primarily used for data at rest.Correct answer
- DIt relies on a public/private key pair.
Why this is the answer
Symmetric encryption uses one key for both operations. Adobe Commerce's Encryptor interface implements this approach and is mainly used for data at rest. Public/private key pairs are part of asymmetric encryption.
- Question 13Interactive
Review the code snippet. Which security flaw is present?
- AUsing reversible encryption for passwords instead of a dedicated password hashing mechanism.Correct answer
- BStoring the password in a class property.
- CUsing dependency injection for the Encryptor.
- DFailing to encode the password with base64.
Why this is the answer
Passwords must be hashed, not encrypted. Encryptor is for data that must be retrieved later; using reversible encryption for passwords is a major security flaw.
- Question 14Single Choice
What distinguishes hashing from encryption?
- AHashing is one-way; encryption is two-way.Correct answer
- BEncryption is one-way; hashing is two-way.
- CBoth are reversible with the same key.
- DHashing is used for API credentials; encryption is used for passwords.
Why this is the answer
Hashing is a one-way function used for verification, while encryption is two-way and allows data to be retrieved in its original form.
- Question 15Multiple Select
Which actions are considered security traps in Adobe Commerce development?
- AAssuming MySQL-level encryption is enough for Adobe Commerce compliance.Correct answer
- BUsing the `Encryptor` class to encrypt passwords.Correct answer
- CHardcoding the crypt key in a module configuration file.Correct answer
- DUsing application-level encryption for sensitive fields.
Why this is the answer
Developers must apply application-level encryption, use password hashing, and store the crypt key in env.php rather than hardcoding it in configs.
- Question 16Interactive
Inspect the configuration snippet. What security issue does it introduce?
- AThe crypt key should be stored in `env.php`, not in a module configuration file.Correct answer
- BThe key should be a password hash rather than an encryption key.
- CThe key can only contain numeric characters.
- DThe key must be regenerated on every request.
Why this is the answer
The crypt key belongs in env.php and must not be committed to a module config because hardcoding it exposes the key and breaks environment-based security.
- Question 17Single Choice
Which session storage solution should be used in a production Adobe Commerce environment with multiple web nodes?
- ARedis or MemcachedCorrect answer
- BLocal file-based storage
- CBrowser local storage
- DDatabase-only storage without synchronization
Why this is the answer
Centralized distributed storage such as Redis or Memcached is required to avoid session inconsistencies across web nodes.
- Question 18Multiple Select
Which cookie flags help mitigate man-in-the-middle attacks on session cookies?
- AHttpOnlyCorrect answer
- BSecureCorrect answer
- CSameSite
- DDomain
Why this is the answer
HttpOnly blocks JavaScript access and Secure restricts the cookie to HTTPS, both reducing MitM risk.
- Question 19Interactive
The code snippet sets session cookie metadata. What is misconfigured?
- AHttpOnly is disabled, allowing JavaScript to access the cookie.Correct answer
- BSecure is enabled when it should be disabled.
- CThe path is not restricted to a secure path.
- DPublic cookies cannot have metadata.
Why this is the answer
HttpOnly must be enabled to prevent client-side scripts from accessing the session cookie; disabling it weakens MitM defenses.
- Question 20Single Choice
Why is session regeneration important after a privilege-level change?
- AIt prevents session fixation attacks.Correct answer
- BIt increases the session expiration time.
- CIt encrypts all session data.
- DIt avoids the need for form keys.
Why this is the answer
Session regeneration changes the ID when privilege increases, preventing an attacker from using a pre-known session ID in a session fixation attack.
- Question 21Multiple Select
Which statements about session lifecycle and expiration are correct?
- ALogout must invalidate the server-side session.Correct answer
- BLong session TTLs do not increase security risk.
- CSession TTL balances user convenience with security risk.Correct answer
- DExpired session IDs are automatically reused by the server.
Why this is the answer
Developers should balance TTL between convenience and risk and always invalidate sessions on logout.
- Question 22Interactive
The code runs after a customer logs in. Why is `regenerateId()` necessary?
- AIt prevents session fixation by issuing a new session ID.Correct answer
- BIt deletes the customer's cart data.
- CIt updates the session cookie's Secure flag.
- DIt hashes the customer ID.
Why this is the answer
Calling regenerateId() after a privilege change avoids session fixation because the old pre-known session ID can no longer be reused.
Integration
4 questions in this domain
- Question 23Single Choice
What is the primary risk if the encryption key stored in the env.php file is lost?
- AAll previously encrypted data becomes unreadable.Correct answer
- BThe database automatically creates a new key.
- COnly the admin password needs to be reset.
- DThe application switches to asymmetric encryption.
Why this is the answer
The encryption key in env.php is required for all cryptographic operations. If it is lost, encrypted data cannot be decrypted, making it unreadable.
- Question 24Multiple Select
Which statements about session storage in Adobe Commerce are correct? (Select all that apply)
- AFile-based storage is the default backend.Correct answer
- BRedis and Memcached are centralized distributed storage options for multi-node environments.Correct answer
- CFile-based storage is recommended for load-balanced production environments.
- DSession data is stored in the client-side cookie.
Why this is the answer
Adobe Commerce uses file-based storage by default. For multiple web nodes, centralized storage like Redis or Memcached is required to maintain session consistency. Session data is stored server-side; only the session ID is in the cookie.
- Question 25Interactive
Review the code snippet. Which security principle is being violated?
- APasswords must be hashed, not reversibly encrypted.Correct answer
- BThe encryptor should not be injected via dependency injection.
- CThe crypt key should be hardcoded in the class.
- DSymmetric encryption should never be used in custom modules.
Why this is the answer
Using the Encryptor class for passwords is a trap. Passwords must be protected with a dedicated password hashing mechanism, not reversible encryption.
- Question 26Single Choice
What does the Secure flag on the session cookie accomplish?
- AThe cookie is only sent over HTTPS connections.Correct answer
- BJavaScript is prevented from accessing the session cookie.
- CThe session data is encrypted in the database.
- DThe session ID is regenerated automatically.
Why this is the answer
The Secure flag ensures the session cookie is transmitted only over encrypted HTTPS connections, mitigating man-in-the-middle attacks. The HttpOnly flag prevents JavaScript access.
Performance & Optimization
8 questions in this domain
- Question 27Single Choice
Which sensitive value is stored in the env.php file and required for all cryptographic operations?
- AEncryption keyCorrect answer
- BDatabase password
- CSession storage driver
- DCache backend
Why this is the answer
The env.php file contains the encryption key used for all cryptographic operations. Losing it makes encrypted data unreadable, and exposing it compromises data security.
- Question 28Multiple Select
Which statements about symmetric encryption in Adobe Commerce are true?
- AThe same key is used for encryption and decryption.Correct answer
- BIt is the primary method for encrypting data at rest.Correct answer
- CCustom modules should use the Magento\\Framework\\Encryption\\Encryptor interface.Correct answer
- DIt uses a public and private key pair for database fields.
Why this is the answer
Symmetric encryption uses one shared key for encryption and decryption and is used for data at rest. Adobe Commerce implements it through the Encryptor interface; public and private key pairs are asymmetric.
- Question 29Interactive
Review the PHP service snippet. What cryptographic operation is being performed on the provided value?
- AIt encrypts the value using symmetric encryption.Correct answer
- BIt hashes the value with SHA-256.
- CIt creates a digital signature using a private key.
- DIt validates the value against a whitelist.
Why this is the answer
The EncryptorInterface is Adobe Commerce's standard implementation for symmetric encryption, used to encrypt data at rest.
- Question 30Single Choice
Which session cookie flag prevents JavaScript from accessing the session ID?
- AHttpOnlyCorrect answer
- BSecure
- CSameSite
- DDomain
Why this is the answer
HttpOnly prevents client-side scripts from reading the session cookie, reducing the risk of XSS-based session theft.
- Question 31Multiple Select
Which session storage backends are appropriate for a multi-node production environment?
- ARedisCorrect answer
- BMemcachedCorrect answer
- CFile-based storage
- DLocal memory
Why this is the answer
File-based storage is the default but does not provide shared session state across nodes. Redis and Memcached provide centralized distributed storage for multi-node production.
- Question 32Interactive
Look at the configuration file fragment. Which value is critical for cryptographic operations and must be protected from version control?
- AThe crypt key valueCorrect answer
- BThe session save value
- CThe cache backend value
- DThe frontend name
Why this is the answer
The encryption key in env.php is required for cryptographic operations. Hardcoding or committing it to version control exposes the encrypted database.
- Question 33Single Choice
Which process is one-way, irreversible, and used for password verification?
- AHashingCorrect answer
- BSymmetric encryption
- CAsymmetric encryption
- DData masking
Why this is the answer
Hashing is a one-way function used for password verification; encryption is two-way because the original data must be recoverable.
- Question 34Multiple Select
Select the correct statements about session storage and identification in Adobe Commerce.
- ASession data lives on the server, while the session ID is stored in the client cookie.Correct answer
- BFile-based storage is always sufficient for load-balanced production environments.
- CRedis or Memcached are recommended when multiple web nodes share sessions.Correct answer
- DSession data is stored entirely in the browser and sent to the server with each request.
Why this is the answer
Session data remains server-side; only the identifier is in the cookie. Distributed environments require centralized storage like Redis or Memcached for consistency.
Security
6 questions in this domain
- Question 35Single Choice
In which Adobe Commerce file is the encryption key for cryptographic operations stored?
- Aapp/etc/env.phpCorrect answer
- Bapp/etc/config.php
- Ccomposer.json
- Dauth.json
Why this is the answer
The encryption key lives in app/etc/env.php. Losing it makes encrypted data unreadable, and a compromised key can expose the entire database.
- Question 36Multiple Select
Which statements correctly describe hashing and encryption in Adobe Commerce?
- AHashing is a one-way function used for password verificationCorrect answer
- BEncryption is a two-way process appropriate for API credentialsCorrect answer
- CThe Encryptor class should be used to store passwords
- DSymmetric encryption uses different keys to encrypt and decrypt
Why this is the answer
Hashing is one-way and intended for password verification; encryption is two-way and used for API credentials. Passwords must never be stored with the Encryptor.
- Question 37Interactive
The code snippet injects an encryption service and calls its encrypt method. Which category of cryptographic operation does this represent?
- ASymmetric encryption using the same key for encryption and decryptionCorrect answer
- BAsymmetric encryption using a public/private key pair
- COne-way password hashing
- DData masking for UI display
Why this is the answer
The Encryptor applies symmetric encryption, using the same key for encryption and decryption. This is the standard implementation for custom module data.
- Question 38Single Choice
Which session storage backend is recommended for Adobe Commerce production environments with multiple web nodes?
- AFile-based session storage on the local web node
- BRedis or Memcached centralized storageCorrect answer
- CBrowser sessionStorage
- DDatabase sessions on the origin server only
Why this is the answer
In distributed production environments, file-based storage cannot keep sessions consistent. Redis or Memcached centralizes session data across web nodes.
- Question 39Multiple Select
Which two cookie flags help protect the session identifier from man-in-the-middle attacks?
- AHttpOnlyCorrect answer
- BSecureCorrect answer
- CDomain
- DPath
Why this is the answer
HttpOnly prevents JavaScript access to the session ID, while Secure ensures the cookie is sent only over HTTPS, mitigating MitM attacks.
- Question 40Interactive
The method transforms a credit card number before display. What is this technique called?
- AData maskingCorrect answer
- BEncryption
- CHashing
- DTokenization
Why this is the answer
Masking obscures sensitive data such as credit card numbers in the UI. It is not encryption, hashing, or tokenization.
Frequently asked questions
Everything about the Adobe Commerce Developer Expert question bank and how to use it.