Question bank
Adobe Commerce Developer Professional
41 Adobe Commerce Developer Professional questions with the correct answer and a written explanation, organised across 6 exam domains.
- 41 questions
- 6 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Architecture & Design
8 questions in this domain
- Question 1Single Choice
Which Adobe Commerce class is the core utility for preventing Cross-Site Scripting (XSS)?
- AEscaperCorrect answer
- BValidator
- CSession
- DCrypt
Why this is the answer
The Escaper class neutralizes output with context-specific methods such as escapeHtml and escapeJs, preventing XSS. It is the fundamental utility used to render data safely in the browser.
- Question 2Multiple Select
What two statements correctly describe input filtering and output escaping?
- AInput filtering cleans data as it enters the system.Correct answer
- BOutput escaping neutralizes data when it is rendered in the browser.Correct answer
- CInput filtering makes output escaping unnecessary.
- DOutput escaping is only needed for SQL queries.
Why this is the answer
Both techniques are required for a defense-in-depth strategy. Input filtering cleans incoming data, while output escaping protects the client at render time.
- Question 3Interactive
The code block shows a database query using a named placeholder. Which security practice does this illustrate?
- AParameterized queryCorrect answer
- BString concatenation
- CBlacklist filtering
- DOutput escaping
Why this is the answer
A parameterized query treats user input strictly as data, preventing it from being interpreted as executable SQL.
- Question 4Single Choice
Which Escaper method should be used to render a variable inside an HTML document?
- AescapeHtmlCorrect answer
- BescapeJs
- CescapeCss
- DescapeAttr
Why this is the answer
The escapeHtml method is specifically designed to neutralize values printed in HTML body content, preventing XSS.
- Question 5Multiple Select
Which three contexts are recognized for context-aware sanitization in Adobe Commerce?
- AHTML bodyCorrect answer
- BJavaScript variableCorrect answer
- CURL parameterCorrect answer
- DDatabase table name
Why this is the answer
Context-aware sanitization changes based on destination: HTML body, JavaScript variables, and URL parameters each require unique encoding.
- Question 6Interactive
The code block processes an untrusted request parameter. Which two security techniques are being used?
- AType castingCorrect answer
- BWhitelistingCorrect answer
- CBlacklisting
- DOutput escaping
Why this is the answer
The parameter is cast to an integer, enforcing a strict data type, and checked against a whitelist of allowed values.
- Question 7Single Choice
Why is whitelisting considered more secure than blacklisting for input validation?
- AWhitelisting permits only known-good values.Correct answer
- BWhitelisting is faster than blacklisting.
- CBlacklisting blocks all novel payloads.
- DWhitelisting removes the need for output escaping.
Why this is the answer
Whitelisting allows only known-good values, while blacklisting can be bypassed by novel payloads and unknown attack patterns.
- Question 8Multiple Select
Which three practices are part of SQL injection prevention using the Adobe Commerce Resource Connection?
- AUsing parameterized queriesCorrect answer
- BUsing prepared statementsCorrect answer
- CTreating user input as dataCorrect answer
- DConcatenating user input directly into SQL
Why this is the answer
Parameterized queries and prepared statements ensure input is treated as data, not executable SQL, preventing injection attacks.
Development
12 questions in this domain
- Question 9Single Choice
In Adobe Commerce, which statement best describes the main purpose of the Escaper class in templates and blocks?
- APrevent XSS through context-specific escapingCorrect answer
- BPrevent SQL injection in custom queries
- CManage user session tokens
- DEncrypt cached product data
Why this is the answer
The Escaper class neutralizes output for contexts such as HTML, JavaScript, CSS, and attributes, preventing XSS attacks.
- Question 10Multiple Select
Which statements correctly describe input filtering and output escaping for defense against XSS in Adobe Commerce?
- AInput filtering cleans data when it enters the systemCorrect answer
- BOutput escaping neutralizes data when it is rendered in the browserCorrect answer
- CBoth techniques are necessary for defense-in-depth against XSSCorrect answer
- DValidating a field length is sufficient to sanitize it
Why this is the answer
Validation only checks constraints; sanitization and escaping are required. Input filtering and output escaping together reduce XSS risks.
- Question 11Interactive
The code block renders a variable inside an inline script tag. Which Escaper method should be selected to prevent XSS in that context?
- AescapeJsCorrect answer
- BescapeHtml
- CescapeUrl
- DescapeCss
Why this is the answer
JavaScript contexts require escapeJs; escapeHtml does not neutralize characters that are meaningful to JavaScript and can lead to XSS.
- Question 12Single Choice
What is the recommended way to prevent SQL injection when using the Adobe Commerce Resource Connection in custom code?
- AUse parameterized queries or prepared statementsCorrect answer
- BConcatenate user input after escaping it
- CRemove all quote characters from input
- DEncode input with base64
Why this is the answer
Parameterized queries and prepared statements ensure user input is treated strictly as data, preventing SQL injection.
- Question 13Multiple Select
Which statements about OAuth 2.0 and OpenID Connect in Adobe Commerce are correct?
- AOAuth 2.0 provides authorization through access and refresh tokensCorrect answer
- BOpenID Connect is an identity layer built on top of OAuth 2.0Correct answer
- COIDC enables client verification of end-user identity for SSOCorrect answer
- DOAuth 2.0 relies on SAML XML assertions for all token exchange
Why this is the answer
OAuth 2.0 is for authorization, while OpenID Connect adds identity verification for SSO. OAuth does not rely on SAML assertions.
- Question 14Interactive
The code block is taken from an Adobe Commerce module configuration. Which type of security resource does this code define?
- AACL resourceCorrect answer
- BRoute configuration
- CDatabase schema
- DCron job
Why this is the answer
acl.xml declares resources that map custom module actions into Adobe Commerce's RBAC engine.
- Question 15Single Choice
In Adobe Commerce security architecture, which question is answered by authentication?
- AWho the client isCorrect answer
- BWhat the client can do
- CWhich resources the client can access
- DWhen the client session expires
Why this is the answer
Authentication verifies identity; authorization determines permitted actions and resource access.
- Question 16Multiple Select
Which practices are common mistakes when implementing CSRF protection in Adobe Commerce custom code?
- AHardcoding form keys or using static tokensCorrect answer
- BRelying solely on isAllowed() without checking request typeCorrect answer
- CAssuming HTTPS alone prevents CSRFCorrect answer
- DUsing session-bound random form keys
Why this is the answer
CSRF protection depends on session-bound random form keys; static keys, missing request-type checks, and assuming HTTPS are common mistakes.
- Question 17Interactive
The code block shows an HTTP response header from Adobe Commerce. Which browser-level CSRF defense is being configured?
- ASameSite Cookie AttributeCorrect answer
- BForm Key Validation
- CContent Security Policy
- DHTTP Strict Transport Security
Why this is the answer
SameSite instructs the browser to restrict cookie sending on cross-site requests, adding a layer of CSRF defense.
- Question 18Single Choice
Why is whitelisting preferred over blacklisting when validating input in Adobe Commerce development?
- APermits only known-good valuesCorrect answer
- BBlocks all known attack payloads
- CAutomatically escapes output
- DEliminates the need for validation
Why this is the answer
Whitelisting defaults to deny and allows only known-good values, while blacklists can be bypassed by novel payloads.
- Question 19Multiple Select
Which statements about context-aware sanitization and escaping in Adobe Commerce are correct?
- AData rendered in URLs must be filtered differently from data in an HTML bodyCorrect answer
- BUsing escapeHtml in a JavaScript variable is not always sufficientCorrect answer
- CApplying escaping logic multiple times can cause double escapingCorrect answer
- DEscaping should be applied at the database layer before storage
Why this is the answer
Each destination context requires its own encoding; multiple escapes cause UI corruption and do not improve security.
- Question 20Interactive
The code block shows a database query in an Adobe Commerce module. Which SQL injection prevention technique is being used?
- AParameterized query / prepared statementCorrect answer
- BBlacklist input filtering
- COutput escaping
- DForm key validation
Why this is the answer
The query uses a placeholder and passes the value as a parameter, so user input remains data instead of executable SQL.
Integration
4 questions in this domain
- Question 21Single Choice
Which Escaper method is used to neutralize output when a value is rendered inside a JavaScript block?
- AescapeHtml
- BescapeJsCorrect answer
- CescapeCss
- DescapeUrl
Why this is the answer
The escapeJs method is required for JavaScript contexts. Using escapeHtml in JS is not sufficient, and escapeUrl is for URLs, while escapeCss is for stylesheets.
- Question 22Multiple Select
Which two statements correctly describe input filtering and output escaping?
- AInput filtering cleans data as it enters the system.Correct answer
- BOutput escaping neutralizes data when it is rendered in the browser.Correct answer
- COutput escaping is only needed for GET requests.
- DInput filtering replaces output escaping in all scenarios.
Why this is the answer
Input filtering sanitizes data at entry; output escaping neutralizes it at render time. Both layers are part of defense-in-depth; output escaping cannot be replaced by input filtering.
- Question 23Interactive
Examine the XML in the code block. What does this ACL resource definition accomplish?
- AAdds a custom ACL resource under Sales.Correct answer
- BCreates an admin user role named View Orders.
- CCreates a new database table for orders.
- DRemoves the Sales resource permission.
Why this is the answer
The XML declares a child resource under Magento_Sales::sales. This custom ACL resource must be defined before it can be assigned to admin roles.
- Question 24Single Choice
Which authorization protocol uses access tokens and refresh tokens for scoped access?
- ASAML
- BOAuth 2.0Correct answer
- CJWT
- DBasic Authentication
Why this is the answer
OAuth 2.0 is the industry-standard authorization framework that uses access tokens and refresh tokens. SAML is XML-based, JWT is a token format, and Basic Authentication sends credentials with each request.
Performance Optimization
6 questions in this domain
- Question 25Single Choice
What is the primary purpose of the Escaper class in Adobe Commerce?
- APrevents XSS by providing context-specific escapingCorrect answer
- BValidates database queries before execution
- CManages user authentication and session tokens
- DCompresses JavaScript and CSS assets to improve page speed
Why this is the answer
The Escaper class prevents cross-site scripting (XSS) by applying the correct escaping method for the output context, such as HTML, JavaScript, or CSS.
- Question 26Multiple Select
What two options accurately characterize input filtering and output escaping as security measures?
- AInput filtering cleans data as it enters the system.Correct answer
- BOutput escaping neutralizes data when it is rendered in the browser.Correct answer
- COutput escaping alone is sufficient for a defense-in-depth strategy.
- DInput filtering should only be applied to stored credit card numbers.
Why this is the answer
Both techniques are required for defense-in-depth: input filtering cleans incoming data, while output escaping protects data during browser rendering.
- Question 27Interactive
The code block renders a variable inside a JavaScript context in a template. Which Escaper method should replace METHOD_NAME?
- AescapeJsCorrect answer
- BescapeHtml
- CescapeUrl
- DescapeCss
Why this is the answer
Use escapeJs for data rendered inside JavaScript contexts so that script-breaking characters are neutralized.
- Question 28Single Choice
What is the recommended technique for preventing SQL injection when using the Magento Resource Connection?
- AUse parameterized queries or prepared statements.Correct answer
- BConcatenate user input directly into the SQL string.
- CStrip or blacklist SQL keywords from the input.
- DDisable SQL error reporting in production.
Why this is the answer
Parameterized queries or prepared statements treat user input as data, not executable SQL, preventing SQL injection.
- Question 29Multiple Select
Which two practices are examples of robust input handling instead of blacklisting?
- ACasting an ID to an integer before using it in a query.Correct answer
- BAllowing only values on an approved whitelist.Correct answer
- CRemoving '<', '>', and quotes from all user input.
- DBlocking a predefined list of dangerous words.
Why this is the answer
Type casting and whitelisting are robust because they enforce known-good data, whereas blacklisting can be bypassed by novel payloads.
- Question 30Interactive
The XML shown in the code block comes from a custom module's ACL configuration. What is the purpose of this XML?
- AIt registers a custom ACL resource that administrators can assign to roles.Correct answer
- BIt automatically grants the current admin user full access.
- CIt changes the storefront URL routing configuration.
- DIt creates a new admin user account.
Why this is the answer
acl.xml defines the available custom resources and permissions; role assignment is done in the Admin user interface.
Security
4 questions in this domain
- Question 31Single Choice
Which Escaper class method should be used to safely render a variable in an HTML body context in Adobe Commerce?
- AescapeHtml()Correct answer
- BescapeJs()
- CescapeCss()
- DescapeAttribute()
Why this is the answer
EscapeHtml is designed for HTML body output. Other methods apply to JavaScript, CSS, and attribute contexts respectively.
- Question 32Multiple Select
Select the two statements that correctly describe input filtering and output escaping in Adobe Commerce.
- AInput filtering cleans data as it enters the system.Correct answer
- BOutput escaping neutralizes data as it is rendered in the browser.Correct answer
- CInput filtering alone is sufficient if the field length is limited.
- DOutput escaping should only be applied to data entered by administrators.
Why this is the answer
Input filtering and output escaping both are required. Length limits are validation, not sanitization, and all rendered output needs escaping.
- Question 33Interactive
Review the code_block. Which security practice is missing from this Adobe Commerce database query?
- AParameterized query or prepared statementCorrect answer
- BOutput escaping
- CForm key validation
- DInput length validation
Why this is the answer
Concatenating user input into SQL allows injection. Use parameterized queries or prepared statements so input is treated as data only.
- Question 34Single Choice
What is the fundamental difference between authentication and authorization in Adobe Commerce?
- AAuthentication verifies identity; authorization determines permitted actions.Correct answer
- BAuthentication determines permissions; authorization verifies identity.
- CAuthentication and authorization are interchangeable terms.
- DAuthentication is only for APIs; authorization is only for the admin panel.
Why this is the answer
Authentication answers 'who are you?', while authorization answers 'what can you do?' based on roles and permissions.
Testing & Debugging
7 questions in this domain
- Question 35Single Choice
Which Escaper method should be used to render user input inside a JavaScript block?
- AescapeHtml()
- BescapeJs()Correct answer
- CescapeCss()
- DescapeUrl()
Why this is the answer
JavaScript context requires escapeJs(); using escapeHtml would not neutralize JavaScript-specific payloads.
- Question 36Multiple Select
Which approaches help prevent SQL injection when using the Adobe Commerce Resource Connection?
- AParameterized queriesCorrect answer
- BPrepared statementsCorrect answer
- CStrict type casting and whitelistingCorrect answer
- DDirect string concatenation of user input
Why this is the answer
Parameterized queries and prepared statements treat input as data; type casting and whitelisting reduce malicious input. Direct concatenation creates SQL injection risk.
- Question 37Interactive
The PHP template in the code block applies an Escaper method before printing a variable. Which output context is this method designed to protect?
- AHTML body
- BJavaScriptCorrect answer
- CCSS
- DURL
Why this is the answer
The code calls escapeJs(), which is specifically designed for JavaScript contexts.
- Question 38Single Choice
Which statement best describes output escaping in Adobe Commerce?
- AStoring data after removing tags
- BNeutralizing data as it is rendered in the browserCorrect answer
- CValidating that data fits a maximum length
- DEncrypting data during transit
Why this is the answer
Output escaping handles data at the point of rendering; input filtering and validation happen before storage.
- Question 39Multiple Select
Which protocols are used to verify an end-user's identity for Single Sign-On?
- AOpenID Connect (OIDC)Correct answer
- BSAMLCorrect answer
- CJWT
- DOAuth 2.0
Why this is the answer
OIDC and SAML are identity protocols for SSO. JWT is a token format, and OAuth 2.0 is an authorization framework.
- Question 40Interactive
The code block shows a token being generated for an API integration. Which token standard is being produced?
- AJSON Web Token (JWT)Correct answer
- BSAML assertion
- COAuth 1.0a token
- DSession ID
Why this is the answer
The code uses a JWT builder to create a compact, URL-safe token for stateless API communication.
- Question 41Single Choice
Where are custom admin resources registered for role-based access control?
- Aacl.xmlCorrect answer
- Bconfig.xml
- Croutes.xml
- Ddi.xml
Why this is the answer
acl.xml defines module-specific resources and maps them to the RBAC engine.
Frequently asked questions
Everything about the Adobe Commerce Developer Professional question bank and how to use it.