Laravel Certified Developer — Questions and Answers

Question 1: When researching test coverage for a Laravel application using Pest, which flag generates an HTML coverage report in a specified directory?

--html-report=reports/
--report html reports/
--coverage-html=reports/ (Correct answer)
--coverage-report html

Correct answer: --coverage-html=reports/

Running `./vendor/bin/pest --coverage-html=reports/` generates an HTML coverage report in the specified directory.

Question 2: How does Laravel protect against SQL injection when using Eloquent or the query builder?

By running queries in a sandboxed database connection
By validating input against a whitelist before querying
By using PDO parameter binding for all query values automatically (Correct answer)
By escaping all user input with htmlspecialchars()

Correct answer: By using PDO parameter binding for all query values automatically

Eloquent and the query builder pass all user-supplied values as bound parameters via PDO, preventing SQL injection by design.

Question 3: Where do you typically register Policies in a Laravel application?

In the $policies array inside App\Providers\AuthServiceProvider (Correct answer)
In the .env file under AUTH_POLICIES
In the routes/auth.php file
In the config/auth.php configuration file

Correct answer: In the $policies array inside App\Providers\AuthServiceProvider

The AuthServiceProvider's $policies array maps Eloquent models to their corresponding policy classes for automatic discovery.

Question 4: What Laravel feature allows you to define a set of routes that all share a common URI prefix?

Route::group() (Correct answer)
Route::namespace()
Route::domain()
Route::resource()

Correct answer: Route::group()

`Route::group()` (or `Route::prefix()` within a group) lets you share attributes like a URI prefix across multiple routes.

Question 5: Which Blade syntax outputs a variable with automatic HTML escaping?

@echo($var)
@print($var)
{!! $var !!}
{{ $var }} (Correct answer)

Correct answer: {{ $var }}

Double curly braces {{ $var }} automatically escape HTML entities to prevent XSS attacks.

Question 6: What is the purpose of route model binding in Laravel?

Bind a route to a specific database connection
Map route parameters to config values
Automatically inject a model instance into a route based on a URI segment (Correct answer)
Cache Eloquent query results per route

Correct answer: Automatically inject a model instance into a route based on a URI segment

Route model binding automatically resolves and injects an Eloquent model whose key matches the route segment.

Question 7: Which method verifies a plain-text password against a stored hash in Laravel?

Hash::check($plainText, $hashedValue) (Correct answer)
Hash::verify($plainText, $hashedValue)
Hash::compare($plainText, $hashedValue)
Hash::validate($plainText, $hashedValue)

Correct answer: Hash::check($plainText, $hashedValue)

Hash::check() compares a plain-text string against a hashed value and returns true if they match, used during login validation.

Question 8: Which Laravel configuration option, when enabled, sends all outgoing emails to a single address — a key risk control in staging environments?

MAIL_TO_ADDRESS in combination with a global 'to' override (Correct answer)
MAIL_MAILER=log
MAIL_HOST=localhost
MAIL_ENCRYPTION=none

Correct answer: MAIL_TO_ADDRESS in combination with a global 'to' override

Setting a global 'to' recipient in config/mail.php redirects all mail to a test address, preventing accidental delivery to real users.

Question 9: In Laravel Pest, which function creates a shareable test helper that can be reused across multiple describe blocks?

helpers()
uses() (Correct answer)
beforeAll()
shared()

Correct answer: uses()

uses() applies traits or test case classes to a test file or describe block, enabling shared setup across tests.

Question 10: When faking events in Laravel tests, which method verifies an event was dispatched a specific number of times?

Event::assertFiredCount
Event::assertDispatchedTimes (Correct answer)
Event::assertCount
Event::assertTimesDispatched

Correct answer: Event::assertDispatchedTimes

assertDispatchedTimes accepts an event class and an integer, asserting it was fired exactly that many times.

Question 11: What does the `hasManyThrough` relationship in Eloquent represent?

A model related to a distant model through an intermediate model (Correct answer)
A self-referential parent-child relationship
A polymorphic many-to-many relationship
A model related to another through a pivot table

Correct answer: A model related to a distant model through an intermediate model

`hasManyThrough` provides access to distant models through an intermediate model, e.g., countries have many posts through users.

Question 12: Which Laravel component is used to write browser-based automated tests using a real browser?

Laravel Browser
Laravel Pest
Laravel Dusk (Correct answer)
Laravel Playwright

Correct answer: Laravel Dusk

Laravel Dusk provides an expressive API for browser automation and testing using ChromeDriver.

Question 13: Laravel's `throttle` middleware helps meet which specific compliance or security control requirement?

Preventing SQL injection by limiting query execution speed
Enforcing TLS by rejecting unencrypted HTTP requests
Encrypting sensitive fields before database storage
Protecting against brute-force attacks on authentication endpoints, satisfying account lockout controls required by frameworks like NIST 800-63 (Correct answer)

Correct answer: Protecting against brute-force attacks on authentication endpoints, satisfying account lockout controls required by frameworks like NIST 800-63

Rate limiting via `throttle` directly addresses brute-force risk on login endpoints, which is an account lockout/rate control required by NIST 800-63 and similar frameworks.

Question 14: What does the `throttle` middleware do in Laravel?

Rate-limits the number of requests a client can make within a time window (Correct answer)
Blocks requests from specific IP addresses
Delays request processing
Compresses HTTP responses

Correct answer: Rate-limits the number of requests a client can make within a time window

The throttle middleware applies rate limiting by restricting how many requests a client can send per minute using named rate limiters.

Question 15: What does Laravel's `encrypt()` helper do?

Signs a value with an HMAC digest
Encrypts a value using AES-256-CBC with the application's APP_KEY (Correct answer)
Base64-encodes a string
Hashes a value with bcrypt

Correct answer: Encrypts a value using AES-256-CBC with the application's APP_KEY

The encrypt() helper uses Laravel's Encrypter service to AES-256-CBC encrypt a payload, also signing it to prevent tampering.

Question 16: Which Blade directive iterates over an array or collection?

@foreach (Correct answer)
@iterate
@each
@loop

Correct answer: @foreach

@foreach($items as $item) ... @endforeach loops over an array or collection, equivalent to PHP's foreach.

Question 17: Which config file defines the default authentication guard and user provider in Laravel?

config/security.php
config/auth.php (Correct answer)
config/session.php
config/app.php

Correct answer: config/auth.php

config/auth.php contains the guards, providers, and password broker configuration that controls how users are authenticated.

Question 18: What does `Route::fallback()` do in Laravel?

Redirects to the home page on 404
Logs unmatched routes to the database
Handles any request that does not match any defined routes (Correct answer)
Serves a cached version of the last matched route

Correct answer: Handles any request that does not match any defined routes

Route::fallback() registers a route that is invoked when no other route matches the incoming request URI.

Question 19: What is the difference between the `web` and `api` authentication guards in Laravel?

web uses session/cookie storage while api uses token-based stateless authentication (Correct answer)
web routes are encrypted while api routes are plain
web is for admin users and api is for regular users
web uses OAuth2 and api uses basic auth

Correct answer: web uses session/cookie storage while api uses token-based stateless authentication

The web guard maintains state via session cookies, whereas the api guard is stateless and authenticates each request via a token.

Question 20: Where must you register a custom middleware in Laravel to apply it globally to every HTTP request?

In the .env file under MIDDLEWARE key
In the routes/web.php file
In the config/app.php providers array
In the $middleware array inside app/Http/Kernel.php (Correct answer)

Correct answer: In the $middleware array inside app/Http/Kernel.php

Global middleware is registered in the $middleware property of the HTTP Kernel class.

Question 21: How do you define a named route in Laravel?

Route::named('route.name', '/path', 'Controller@method')
Route::name('route.name')->get('/path', 'Controller@method')
Route::get('/path', 'Controller@method', 'route.name')
Route::get('/path', 'Controller@method')->name('route.name') (Correct answer)

Correct answer: Route::get('/path', 'Controller@method')->name('route.name')

Named routes are created by chaining the ->name() method onto the route definition.

Question 22: What Artisan command caches all application routes to speed up route registration?

php artisan route:cache (Correct answer)
php artisan optimize:routes
php artisan route:compile
php artisan routes:save

Correct answer: php artisan route:cache

php artisan route:cache serializes all routes into a single cached file, reducing the overhead of route registration on each request.

Question 23: What is the correct Blade syntax to write a comment that will NOT appear in the rendered HTML?

@comment This is a comment @endcomment
// This is a comment
{{-- This is a comment --}} (Correct answer)

Correct answer: {{-- This is a comment --}}

{{-- ... --}} is the Blade comment syntax; these comments are stripped during compilation and never appear in the browser's HTML source.

Question 24: Which Artisan command generates a dedicated model factory class in Laravel 8+?

make:seeder
factory:make
make:factory (Correct answer)
make:model --factory

Correct answer: make:factory

php artisan make:factory creates a standalone factory class in the database/factories directory.

Question 25: Which method is used to generate a URL for a named route in a Laravel Blade template?

path('route.name')
link('route.name')
url('route.name')
route('route.name') (Correct answer)

Correct answer: route('route.name')

The route() helper function generates a URL for a given named route in both Blade templates and PHP code.

Question 26: Which Laravel command runs the test suite and displays code coverage as a percentage in the terminal?

php artisan test --clover
php artisan test --coverage (Correct answer)
php artisan test --report
php artisan test --with-coverage

Correct answer: php artisan test --coverage

php artisan test --coverage outputs a coverage summary in the terminal using Xdebug or PCOV.

Question 27: How should Laravel PHP Framework professionals handle conflicts with stakeholders?

Escalate immediately to management
Ignore stakeholder concerns
Avoid all conflict
Address issues professionally through active listening, finding common ground, and seeking resolution (Correct answer)

Correct answer: Address issues professionally through active listening, finding common ground, and seeking resolution

This is fundamental to Laravel PHP Framework practice. Address issues professionally through active listening, finding common ground, and seeking resolution represents the professional standard for communication in the LARAVEL certification framework.

Question 28: In Laravel, which trait must be added to a test class to use model factories with the `create()` method via database interaction?

DatabaseMigrations
WithoutMiddleware
RefreshDatabase (Correct answer)
WithFaker

Correct answer: RefreshDatabase

RefreshDatabase (or DatabaseMigrations/DatabaseTransactions) ensures the schema is available so factory create() can persist records.

Question 29: Which Blade directive allows you to include a view conditionally based on a boolean expression?

@includeIf($bool, 'view')
@renderWhen($bool, 'view')
@conditionalInclude('view', $bool)
@includeWhen($bool, 'view') (Correct answer)

Correct answer: @includeWhen($bool, 'view')

@includeWhen($condition, 'view.name') renders the included view only when the first argument evaluates to true.

Question 30: Which artisan command gives a high-level overview of the application's environment, loaded configuration, cache status, and installed packages?

php artisan make:inspect
php artisan config:list
php artisan about (Correct answer)
php artisan model:show

Correct answer: php artisan about

`php artisan about` shows environment, cache, drivers, and package information about the current Laravel installation.

Question 31: Which Artisan command generates a new policy class in Laravel?

php artisan policy:make PostPolicy
php artisan make:policy PostPolicy --model=Post (Correct answer)
php artisan generate:policy PostPolicy
php artisan create:policy PostPolicy

Correct answer: php artisan make:policy PostPolicy --model=Post

php artisan make:policy generates a policy class, and the --model flag pre-fills CRUD authorization method stubs for the given model.

Question 32: Which Blade directive is used to extend a parent layout?

@include
@extends (Correct answer)
@parent
@layout

Correct answer: @extends

@extends('layout-name') tells Blade that the current view inherits from a parent layout.

Question 33: What is the purpose of the `APP_KEY` value in Laravel's `.env` file?

It is the API authentication key for external services
It uniquely identifies the app to the Composer package registry
It is the encryption key used by the Encrypter for all encrypt/decrypt and cookie signing operations (Correct answer)
It sets the admin password for the application

Correct answer: It is the encryption key used by the Encrypter for all encrypt/decrypt and cookie signing operations

APP_KEY is the 32-byte AES encryption key used by Laravel's Encrypter class to secure cookies, encrypted values, and signed URLs.

Question 34: Which Blade directive renders content only when the current visitor is NOT authenticated (a guest)?

@guest (Correct answer)
@anonymous
@notauth
@unauthenticated

Correct answer: @guest

@guest ... @endguest wraps content intended for unauthenticated visitors, the logical opposite of @auth.

Question 35: Which method allows you to redirect a user to a named route in a Laravel controller?

return redirect()->route('route.name') (Correct answer)
return view()->route('route.name')
return response()->route('route.name')
return back()->route('route.name')

Correct answer: return redirect()->route('route.name')

The redirect()->route() method creates an HTTP redirect response pointing to the URL of a named route.

Question 36: Which artisan command, added in Laravel 10, helps developers research the configuration values currently active in a running application?

php artisan config:list
php artisan config:show (Correct answer)
php artisan config:dump
php artisan env:show

Correct answer: php artisan config:show

`php artisan config:show` displays all resolved configuration values for a given file or dot-notation key.

Question 37: Which file is the primary location for defining web routes in a Laravel application?

routes/api.php
routes/web.php (Correct answer)
config/routes.php
app/Http/routes.php

Correct answer: routes/web.php

In Laravel, routes/web.php contains routes for the web interface with session state and CSRF protection.

Question 38: Which middleware is responsible for protecting routes against Cross-Site Request Forgery in Laravel?

\Illuminate\Auth\Middleware\AuthenticateWithBasicAuth
\App\Http\Middleware\Authenticate
\App\Http\Middleware\VerifyCsrfToken (Correct answer)
\Illuminate\Session\Middleware\StartSession

Correct answer: \App\Http\Middleware\VerifyCsrfToken

The VerifyCsrfToken middleware checks every POST/PUT/PATCH/DELETE request for a valid CSRF token.

Question 39: What does `Route::resource()` automatically create in Laravel?

Seven RESTful routes mapping to controller methods (index, create, store, show, edit, update, destroy) (Correct answer)
A database migration for the resource
A service provider for dependency injection
An API controller with JSON responses

Correct answer: Seven RESTful routes mapping to controller methods (index, create, store, show, edit, update, destroy)

Route::resource() generates the standard seven CRUD routes tied to a resourceful controller in a single declaration.

Question 40: Which Laravel approach supports the NIST Cybersecurity Framework's 'Respond' function by enabling rapid incident detection in a compromised application?

Keeping a manual incident response checklist in the project's README
Using `php artisan down` to put the application in maintenance mode as soon as an incident is suspected
Running `composer outdated` to identify packages that may have introduced vulnerabilities
Integrating Laravel event listeners and notification channels (Slack, PagerDuty) triggered on anomalous events such as repeated failed logins or unexpected privilege escalation attempts (Correct answer)

Correct answer: Integrating Laravel event listeners and notification channels (Slack, PagerDuty) triggered on anomalous events such as repeated failed logins or unexpected privilege escalation attempts

Automated alerting via Laravel events and notifications enables the rapid detection and response capability that the NIST CSF 'Respond' function requires.

Question 41: A partner requires your API responses to include an `X-Request-ID` header for tracing. Where is the cleanest place to add it in Laravel?

In a dedicated Response middleware registered in the HTTP kernel (Correct answer)
In the AppServiceProvider boot() method
Inside every Controller method return statement
In the config/cors.php allowed_headers array

Correct answer: In a dedicated Response middleware registered in the HTTP kernel

A response middleware is the single, reusable place to append custom headers to every outgoing HTTP response without touching individual controllers.

Question 42: What is the correct syntax to pass data to a component using the @component directive?

@component('name', key='value')
@component('name')->with(['key' => 'value'])
@component('name').pass(['key' => 'value'])
@component('name', ['key' => 'value']) (Correct answer)

Correct answer: @component('name', ['key' => 'value'])

Data is passed to a Blade component as the second argument to @component() as a PHP associative array.

Question 43: When researching third-party Laravel packages for reliability on Packagist, which metric is most indicative of long-term community maintenance?

Total downloads
Stars on GitHub
Number of open issues
Number of maintainers and recent release frequency (Correct answer)

Correct answer: Number of maintainers and recent release frequency

Recent release frequency and active maintainers are the strongest evidence of a package being actively supported.

Question 44: A Laravel app stores API credentials directly in controller code. What is the primary risk management remedy?

Move credentials to .env and access them via config() or env() (Correct answer)
Encode credentials with base64 before embedding them
Add the controller file to .gitignore
Store credentials in the database users table

Correct answer: Move credentials to .env and access them via config() or env()

Credentials belong in .env (excluded from VCS) and should be read through Laravel's config layer, keeping secrets out of source code.

Question 45: What is the purpose of Laravel Sanctum?

To encrypt all database columns
To manage OAuth2 server flows for third-party apps
To provide lightweight API token authentication and SPA authentication (Correct answer)
To rate-limit authentication attempts

Correct answer: To provide lightweight API token authentication and SPA authentication

Laravel Sanctum offers a simple token-based authentication system for SPAs, mobile apps, and simple API token issuance without full OAuth2 complexity.

Laravel Certified Developer

The Laravel Certified Developer exam validates proficiency in building web applications with the Laravel PHP framework, covering routing, Eloquent ORM, Blade templates, authentication, and testing. Candidates must demonstrate working knowledge of Laravel v12+ and modern PHP features.

Questions

50 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds