Advanced Ruby test (Advanced)

Sample questions

5 sample questions from the Advanced Ruby test, with the answers. Samples are taken out of the live test, so you will not meet these when you sit it.

1. Which of the following correctly describes the behavior of `prepend` when adding a module to a class?

   1. prepend inserts the module before the class in the ancestors chain
   2. extend inserts the module before the class in the ancestors chain
   3. prepend inserts the module after the class in the ancestors chain
   4. include inserts the module before the class in the ancestors chain

   Answer: A. prepend inserts the module before the class in the ancestors chain

   In Ruby, `prepend` adds a module to the ancestors chain before the class itself, allowing it to override methods with `super` for wrapping behavior. `include` adds the module after the class, and `extend` adds methods to an object's singleton class.

2. Which of the following best describes the correct usage of define_method in Ruby?

   1. define_method is used to override existing methods in a module.
   2. define_method can be used independently without any evaluation context.
   3. define_method is used to dynamically create classes at runtime.
   4. define_method is used to dynamically define methods in a class, and it is typically called within class_eval or module_eval blocks.

   Answer: D. define_method is used to dynamically define methods in a class, and it is typically called within class_eval or module_eval blocks.

   define_method is used to create methods dynamically, but it must be called within the context of a class or module using class_eval or module_eval. Option 3 correctly states this, while the other options either misrepresent the purpose or the context in which define_method is used.

3. Which statement correctly describes how Rails prevents XSS attacks in views by default?

   1. All user-provided content is automatically rendered as HTML in ERB templates.
   2. Using `html_safe` is the recommended way to prevent XSS in views.
   3. ERB escapes output by default, preventing XSS attacks.
   4. XSS is prevented by default in Rails without any escaping mechanism.

   Answer: C. ERB escapes output by default, preventing XSS attacks.

   In Ruby on Rails, ERB templates automatically escape any output to prevent cross-site scripting (XSS) attacks. This ensures that any user-provided content is rendered as text rather than executable HTML or JavaScript. Using methods like `raw` or `html_safe` bypasses this escaping, which should be done carefully to avoid security vulnerabilities.

4. You have a `User` model with a `has_many :posts, through: :user_posts` association and a `has_many :comments, through: :user_comments` association. When querying `User.all`, you notice N+1 queries are being generated for both `posts` and `comments`. What is the correct approach to avoid this?

   1. Use `preload(:posts, :comments)` to load both associations with separate queries.
   2. Use `includes(:posts, :comments)` to eager load both associations in a single query.
   3. Use `eager_load(:posts, :comments)` to load both associations with a single LEFT OUTER JOIN.
   4. Use `joins(:posts, :comments)` to avoid generating any additional queries.

   Answer: B. Use `includes(:posts, :comments)` to eager load both associations in a single query.

   When using `has_many :through`, Rails may generate N+1 queries if associations are not eager loaded properly. `includes` with multiple associations ensures that both are eager loaded in a single query, avoiding N+1. `preload` and `eager_load` are not as effective in this scenario because they do not handle the intermediate join table correctly. `joins` does not load the associated objects, which is not helpful here.

5. What is the primary purpose of strong parameters in Rails?

   1. Strong parameters are used to encrypt sensitive data in the application.
   2. Strong parameters are used to sanitize user input before saving it to the database.
   3. Strong parameters prevent mass-assignment attacks by explicitly permitting attributes.
   4. Strong parameters are used to filter out malicious SQL queries.

   Answer: C. Strong parameters prevent mass-assignment attacks by explicitly permitting attributes.

   Strong parameters are a security feature in Rails that prevents mass-assignment vulnerabilities by allowing developers to explicitly specify which attributes can be assigned during an update or create action. This ensures that only the permitted attributes are processed, reducing the risk of unauthorized data modification.