Intermediate Firebase test (Intermediate)

Sample questions

5 sample questions from the Intermediate Firebase test, with the answers. Samples are taken out of the live test, so you will not meet these when you sit it.

1. Which Firebase feature is used to define access control policies for securing Firestore and Storage?

   1. Firebase Authentication
   2. Cloud Functions for Firebase
   3. Firebase Cloud Messaging
   4. Firebase Security Rules

   Answer: D. Firebase Security Rules

   Firebase Security Rules are used to secure Firestore and Storage by defining access control policies. They ensure that only authorized users can read or write data, and they are essential for maintaining data integrity and privacy in Firebase applications.

2. A Firestore query with a WHERE clause is executed by a client that has no matching Firestore security rules allowing access to the documents. What will happen?

   1. The query will fail due to a missing index on the queried field.
   2. The query will fail because Firestore rules are not filters and must provably limit access to allowed documents.
   3. The query will succeed because Firestore rules are filters and will allow the client to filter results later.
   4. The query will succeed if the user is authenticated, regardless of the rules.

   Answer: B. The query will fail because Firestore rules are not filters and must provably limit access to allowed documents.

   Firestore rules are not filters. If a query is not provably limited to allowed documents, the entire query is rejected. This is a core principle of Firestore security rules, as queries must be validated upfront rather than allowing the client to filter results later.

3. A developer is facing a bug where unauthorized users can access files stored in Firebase Storage. The files are uploaded with private access, but the issue persists. What is the correct approach to fix this bug and ensure proper file access control?

   1. The developer should make all files public in Storage and use Firestore to manage user permissions.
   2. The developer should use Firebase Security Rules to restrict access based on user authentication and use Firestore to store file metadata for validation.
   3. The developer should store all file access logic in Firestore queries and rely on Firebase Admin SDK to bypass rules.
   4. The developer should use Firebase Storage rules to restrict access based on user authentication and file metadata, and store file metadata in Firestore for additional validation.

   Answer: D. The developer should use Firebase Storage rules to restrict access based on user authentication and file metadata, and store file metadata in Firestore for additional validation.

   Firebase Storage rules are the correct way to enforce access control for files. Relying solely on download URLs being private is a mistake, as anyone with the URL can access the file. Storing metadata (like owner information) in Firestore allows for additional validation, such as ensuring the requesting user is the owner. Using Firebase Admin SDK to bypass rules is not a solution for access control, and using Firestore queries as a replacement for Storage rules is incorrect since Firestore has no query capability for Storage files.

4. When implementing pagination in Firestore queries, which approach should be preferred and why?

   1. startAfter is not supported in Firestore queries and should be avoided.
   2. startAfter and offset are interchangeable and have the same performance characteristics.
   3. startAfter is less efficient than offset for large datasets because it requires additional indexing.
   4. startAfter is preferred for pagination because it avoids billing for skipped documents and allows efficient cursor-based navigation.

   Answer: D. startAfter is preferred for pagination because it avoids billing for skipped documents and allows efficient cursor-based navigation.

   startAfter is preferred for pagination because it avoids billing for skipped documents and allows efficient cursor-based navigation. In contrast, offset causes all skipped documents to be billed, which can be inefficient and expensive for large datasets.

5. In a project where accurate timestamp handling is crucial, such as tracking document modifications or logging events, how should you handle Firestore document timestamps to ensure consistency and accuracy across all clients?

   1. Use the serverTimestamp() method when writing the document, and read the timestamp from the server using the snapshot.metadata.serverTimestamps() method.
   2. Use the timestamp field from the document and update it manually whenever a change occurs.
   3. Use the timestamp field from the document itself, which is stored locally and may not be synchronized with the server.
   4. Use the current timestamp provided by the client SDK when writing the document and rely on the client's system time for consistency.

   Answer: A. Use the serverTimestamp() method when writing the document, and read the timestamp from the server using the snapshot.metadata.serverTimestamps() method.

   In a project where accurate timestamp handling is crucial, such as logging events or tracking document modifications, the correct approach is to use the serverTimestamp() method when writing the document. This ensures that the timestamp is set by the server, which is more accurate and synchronized across all clients. When reading the document, the snapshot.metadata.serverTimestamps() method can be used to retrieve the server-assigned timestamp, ensuring consistency in timestamp handling across all clients.