Full-Stack Development Cheat Sheet 2026

The 30 highest-yield Full-Stack Development facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. A senior developer argues against writing tests because 'we've always shipped without them.' This reasoning is an example of: → Appeal to tradition (argumentum ad antiquitatem)
2. What is JWT (JSON Web Token) primarily used for in web applications? → Stateless authentication by encoding user claims in a signed token sent with each request
3. Which type of testing verifies that a new code change has not broken existing functionality? → Regression testing
4. What is the maximum fine under GDPR for the most serious violations, such as unlawful processing of data? → €20 million or 4% of global annual turnover
5. An e-commerce platform must display a 'Do Not Sell My Personal Information' link. Which regulation requires this? → CCPA
6. In accessibility testing, what does WCAG 2.1 Level AA compliance require for color contrast? → 4.5:1 ratio for normal text and 3:1 for large text
7. What is the purpose of regular risk reviews in Full-Stack Development practice? → To identify new risks, evaluate control effectiveness, and update mitigation strategies
8. In a Node.js application, what does the `process.env` object provide? → Access to environment variables
9. What is the role of professional journals in Full-Stack Development practice? → They disseminate current research, best practices, and professional developments
10. Which SQL clause would you use to filter aggregated results after a `GROUP BY`? → HAVING
11. What is the primary purpose of a CDN (Content Delivery Network) in a full-stack application? → To serve static assets from geographically distributed servers
12. A developer estimates 2 weeks for a feature but the sales team promises the client delivery in 5 days. What should the full-stack developer do? → Immediately escalate the discrepancy to management with the accurate estimate and impact
13. In a risk heat map (matrix), a risk with HIGH likelihood and LOW impact should be prioritized HOW relative to a risk with LOW likelihood and HIGH impact? → They may have similar risk scores; compare ALE values to decide priority
14. Which file format does GitHub Actions use to define CI/CD workflows? → YAML (.yml)
15. In Jest, what does the `beforeEach` hook do? → Runs before every individual test in the describe block
16. A full-stack developer implements TLS 1.0 for backward compatibility. Under PCI DSS v4.0, this is: → Prohibited — PCI DSS v4.0 requires TLS 1.2 or higher
17. Which HTTP security header helps prevent cross-site scripting (XSS) attacks by controlling which resources a browser is allowed to load? → Content-Security-Policy
18. How should Full-Stack Development professionals prioritize identified risks? → Based on likelihood of occurrence combined with severity of potential impact
19. Which practice best supports reproducible research in software experiments? → Publishing code, datasets, and environment specifications together
20. Under HIPAA's Security Rule, which safeguard category requires organizations to implement policies and procedures for managing workforce access to ePHI? → Administrative Safeguards
21. Which security control does NIST recommend as part of its Cybersecurity Framework's 'Protect' function to limit the impact of a potential security event? → Least privilege access control
22. Which tool is commonly used for root cause analysis in Full-Stack Development quality management? → Fishbone (Ishikawa) diagram to identify contributing factors systematically
23. Why is documentation important in Full-Stack Development risk management? → It creates an audit trail, supports decision-making, and demonstrates due diligence
24. Which database isolation level prevents dirty reads but still allows non-repeatable reads? → Read Committed
25. What is 'lazy loading' in the context of a React application? → Deferring the loading of components or resources until they are actually needed
26. Which SQL JOIN type returns all rows from the left table even if there is no match in the right table? → LEFT JOIN
27. Which approach does GraphQL use to solve the over-fetching and under-fetching problems common in REST APIs? → Clients specify exactly the fields they need in the query
28. What is the main benefit of using WebSockets over HTTP polling for real-time features? → WebSockets provide a persistent, full-duplex channel eliminating repeated request overhead
29. A client requests a feature that would violate user privacy regulations like GDPR. A professional developer should: → Inform the client of the legal risk and propose a compliant alternative
30. When should you use `useMemo` in a React component? → To cache the result of an expensive computation between renders