{"title":"HTTP Protocol — Advanced","description":"An advanced multiple-choice quiz covering the HTTP protocol in depth: HTTP/1.1, HTTP/2, HTTP/3, request methods, status codes, headers, caching mechanisms, content negotiation, connection management, security (HSTS, CORS), and protocol evolution.","settings":{"shuffle_questions":true,"shuffle_options":true,"reveal_answers":true,"allow_review":true,"time_limit_seconds":600,"pass_percent":65},"questions":[{"kind":"single_choice","prompt":"Which HTTP/2 feature eliminates head-of-line blocking at the application layer by allowing multiple concurrent exchanges over a single TCP connection?","explanation":"HTTP/2 multiplexing allows multiple concurrent streams over a single TCP connection, eliminating HTTP/1.1's head-of-line blocking at the application layer. However, HTTP/2 still suffers from head-of-line blocking at the transport layer since TCP itself is ordered. HTTP/3 solves this by using QUIC over UDP.","points":1,"options":[{"label":"Stream multiplexing"},{"label":"Server push"},{"label":"HPACK header compression"},{"label":"Binary framing layer"}]},{"kind":"single_choice","prompt":"What is the fundamental transport-layer difference between HTTP/3 and its predecessors?","explanation":"HTTP/3 runs over QUIC (which itself runs over UDP), not TCP. QUIC provides built-in encryption (TLS 1.3), multiplexed streams without head-of-line blocking, faster connection establishment (0-RTT), and connection migration. HTTP/1.1 and HTTP/2 both run over TCP.","points":1,"options":[{"label":"HTTP/3 uses QUIC over UDP instead of TCP"},{"label":"HTTP/3 uses a custom kernel-level transport protocol"},{"label":"HTTP/3 still uses TCP but with a different framing layer"},{"label":"HTTP/3 eliminates all transport-layer protocols entirely"}]},{"kind":"single_choice","prompt":"What does the HTTP `Vary` header control?","explanation":"The Vary header tells caches that the response varies based on one or more request headers (e.g. Vary: Accept-Encoding, User-Agent). A cache must store separate versions of the response for different values of those headers. Without Vary, a cache might serve a compressed response to a client that cannot accept it, or a mobile-optimized response to a desktop user.","points":1,"options":[{"label":"It tells caches to store separate response variants based on specified request headers"},{"label":"It varies the response status code based on client IP"},{"label":"It enables content negotiation by varying server-side rendering"},{"label":"It controls which HTTP methods are allowed on a resource"}]},{"kind":"single_choice","prompt":"In HTTP caching, what is the difference between `no-cache` and `no-store` in the Cache-Control header?","explanation":"no-cache means the response must be revalidated with the origin server before every use (it can be stored but must be checked). no-store means the response must not be stored in any cache at all (do not write to disk or memory). They are often confused: no-cache does NOT mean 'do not cache' — it means 'check before using.'","points":1,"options":[{"label":"no-cache allows storage but requires revalidation; no-store prohibits storage entirely"},{"label":"no-cache prohibits storage; no-store allows storage but requires revalidation"},{"label":"Both mean the same thing and are interchangeable"},{"label":"no-cache applies to browsers only; no-store applies to proxy caches only"}]},{"kind":"single_choice","prompt":"What is the purpose of HTTP Strict Transport Security (HSTS)?","explanation":"HSTS (sent as the Strict-Transport-Security header) instructs the browser to always connect to the server over HTTPS, never HTTP. It prevents SSL stripping attacks where an attacker intercepts the initial HTTP request and downgrades the connection. The max-age directive controls how long the policy is remembered, and includeSubDomains applies it to all subdomains.","points":1,"options":[{"label":"Forces the browser to always use HTTPS and prevents SSL stripping attacks"},{"label":"Encrypts HTTP headers in transit using TLS"},{"label":"Prevents cross-site request forgery by validating the Origin header"},{"label":"Compresses HTTP responses to speed up secure connections"}]},{"kind":"single_choice","prompt":"What is a 'conditional request' in HTTP and which headers drive it?","explanation":"Conditional requests use headers like If-None-Match (with ETag) or If-Modified-Since (with Last-Modified) to ask the server to only send the full response if the resource has changed. If unchanged, the server returns 304 Not Modified with no body, saving bandwidth. ETags are strong validators (byte-for-byte comparison), while Last-Modified is a weak validator.","points":1,"options":[{"label":"A request that uses If-None-Match or If-Modified-Since to avoid re-downloading unchanged resources"},{"label":"A request that negotiates which HTTP version to use"},{"label":"A request that is only processed if specific conditions in the request body are met"},{"label":"A preflight request sent by the browser before a cross-origin request"}]},{"kind":"single_choice","prompt":"How does CORS (Cross-Origin Resource Sharing) handle 'simple' vs 'preflighted' requests?","explanation":"Simple requests (GET, HEAD, POST with certain content-types) are sent directly; the browser checks the Access-Control-Allow-Origin header in the response. Preflighted requests (those with custom headers, PUT, DELETE, or non-simple content-types) first send an OPTIONS preflight to check permissions before sending the actual request. The preflight must respond with matching Access-Control-Allow-Methods and Access-Control-Allow-Headers.","points":1,"options":[{"label":"Simple requests skip preflight; non-simple requests send an OPTIONS preflight first"},{"label":"All cross-origin requests require a preflight OPTIONS request"},{"label":"Preflighted requests are sent for GET and POST only"},{"label":"CORS preflight is optional and only needed for HTTPS connections"}]},{"kind":"single_choice","prompt":"What does the HTTP 431 Request Header Fields Too Large status code indicate?","explanation":"431 indicates the server refuses to process the request because the total size of the request headers exceeds the server's limits. This is typically caused by excessively large cookies, long URLs, or bloated header values. It is defined in RFC 6585 along with 429 Too Many Requests and 511 Network Authentication Required.","points":1,"options":[{"label":"The total size of request headers exceeds the server's configured limit"},{"label":"The request body is too large for the server to process"},{"label":"The server cannot handle the number of simultaneous connections"},{"label":"The client's HTTP version is not supported by the server"}]},{"kind":"single_choice","prompt":"In HTTP content negotiation, what is the difference between server-driven and agent-driven (proactive) negotiation?","explanation":"In server-driven negotiation, the server examines request headers (Accept, Accept-Language, Accept-Encoding) and selects the best representation. In agent-driven negotiation, the server returns 300 Multiple Choices or a list of available representations, and the client selects. In practice, server-driven is far more common, with the Vary header ensuring caches handle variations correctly.","points":1,"options":[{"label":"Server-driven: server selects based on request headers. Agent-driven: client selects from options returned by server."},{"label":"Server-driven: server sends all variants. Agent-driven: the client proxy negotiates on behalf of the user."},{"label":"Server-driven is used for content types; agent-driven is used for language only"},{"label":"They are synonymous terms for the same negotiation process"}]},{"kind":"single_choice","prompt":"What is the purpose of the Upgrade header and the 101 Switching Protocols status code?","explanation":"The client sends an Upgrade header (e.g. Upgrade: websocket, h2c) to request a protocol switch. If the server agrees, it responds with 101 Switching Protocols and upgrades the connection. This is how WebSocket connections are established (upgrading from HTTP to WebSocket). It was also used for upgrading to HTTP/2 over cleartext (h2c), though most HTTP/2 connections now start via ALPN in TLS.","points":1,"options":[{"label":"The client requests to switch protocols; the server responds with 101 to confirm the upgrade"},{"label":"The server requests the client to upgrade to a newer HTTP version"},{"label":"The client reports its protocol capabilities; the server downgrades to match"},{"label":"The Upgrade header forces TLS encryption on an existing cleartext connection"}]}]}