Laravel Certified Developer — Questions and Answers

Question 1: What does the `verified` middleware do in Laravel?

Ensures the user's account has been approved by an admin
Validates that the request body schema is correct
Restricts access to users who have verified their email address (Correct answer)
Confirms that the request has a valid API key

Correct answer: Restricts access to users who have verified their email address

The verified middleware checks the email_verified_at timestamp and redirects unverified users to the email verification notice page.

Question 2: What Artisan command caches all application routes to speed up route registration?

php artisan route:compile
php artisan optimize:routes
php artisan route:cache (Correct answer)
php artisan routes:save

Correct answer: php artisan route:cache

php artisan route:cache serializes all routes into a single cached file, reducing the overhead of route registration on each request.

Question 3: What is the correct way to register a custom Blade directive in Laravel?

Call Blade::directive('name', fn) on the Blade facade, typically in a service provider (Correct answer)
Call View::directive('name', fn) in AppServiceProvider
Call Template::addDirective('name', fn) in the boot method
Call BladeFactory::register('name', fn) in the boot method

Correct answer: Call Blade::directive('name', fn) on the Blade facade, typically in a service provider

Custom Blade directives are registered using Blade::directive('name', callback) inside a service provider's boot() method.

Question 4: How do you define a named route in Laravel?

Route::get('/path', 'Controller@method', 'route.name')
Route::named('route.name', '/path', 'Controller@method')
Route::get('/path', 'Controller@method')->name('route.name') (Correct answer)
Route::name('route.name')->get('/path', 'Controller@method')

Correct answer: Route::get('/path', 'Controller@method')->name('route.name')

Named routes are created by chaining the ->name() method onto the route definition.

Question 5: Which Laravel package provides a simple, pre-built authentication scaffolding including login, registration, and password reset?

Laravel Breeze (Correct answer)
Laravel Sanctum
Laravel Passport
Laravel Fortify

Correct answer: Laravel Breeze

Laravel Breeze is a minimal authentication starter kit that scaffolds routes, controllers, and Blade views for basic auth features.

Question 6: How do you apply middleware to a controller's specific methods in Laravel?

Annotate controller methods with @middleware
Call $this->middleware('auth')->only(['method1','method2']) in the constructor (Correct answer)
List methods in routes/middleware.php
Define it in the handle() method of the middleware

Correct answer: Call $this->middleware('auth')->only(['method1','method2']) in the constructor

Controller middleware is applied per-method by calling $this->middleware() with ->only() or ->except() inside the constructor.

Question 7: Which Blade directive includes a view only if that view file actually exists?

@tryInclude('view')
@includeIf('view') (Correct answer)
@safe_include('view')
@include('view') ?? null

Correct answer: @includeIf('view')

@includeIf('view.name') silently skips rendering if the specified view file does not exist, preventing errors.

Question 8: An ISO 27001 audit requires evidence of vulnerability management for the Laravel application. Which practice directly addresses this requirement?

Running `php artisan optimize` before each deployment
Regularly running `composer audit` to detect known CVEs in dependencies and maintaining a patch process with documented remediation timelines (Correct answer)
Enabling Laravel Telescope in production to monitor for errors
Setting `APP_ENV=production` to disable debug output

Correct answer: Regularly running `composer audit` to detect known CVEs in dependencies and maintaining a patch process with documented remediation timelines

`composer audit` checks installed packages against the PHP Security Advisory Database, providing the dependency vulnerability scanning evidence ISO 27001 requires.

Question 9: Which Laravel artisan command would you run to verify that application encryption keys and environment variables are not accidentally committed to version control, a common compliance audit finding?

`php artisan key:generate --show`
There is no built-in command; you must inspect `.gitignore` manually to ensure `.env` is excluded (Correct answer)
`php artisan config:audit`
`php artisan env:check`

Correct answer: There is no built-in command; you must inspect `.gitignore` manually to ensure `.env` is excluded

Laravel has no built-in env audit command; compliance requires manually verifying that `.env` is listed in `.gitignore` and that secrets are not in version history.

Question 10: Where must you register a custom middleware in Laravel to apply it globally to every HTTP request?

In the routes/web.php file
In the $middleware array inside app/Http/Kernel.php (Correct answer)
In the .env file under MIDDLEWARE key
In the config/app.php providers array

Correct answer: In the $middleware array inside app/Http/Kernel.php

Global middleware is registered in the $middleware property of the HTTP Kernel class.

Question 11: A webhook from a payment provider includes a JSON body. Which is the correct way to verify HMAC-SHA256 signature in a Laravel controller?

Crypt::decrypt($signature) === $request->getContent()
openssl_verify($request->getContent(), $signature, $secret)
md5($request->getContent()) === $signature
hash_equals(hash_hmac('sha256', $request->getContent(), $secret), $signature) (Correct answer)

Correct answer: hash_equals(hash_hmac('sha256', $request->getContent(), $secret), $signature)

hash_equals() prevents timing attacks while hash_hmac('sha256', ...) computes the expected HMAC to compare against the provider's signature header.

Question 12: Which method is used to generate a URL for a named route in a Laravel Blade template?

route('route.name') (Correct answer)
link('route.name')
path('route.name')
url('route.name')

Correct answer: route('route.name')

The route() helper function generates a URL for a given named route in both Blade templates and PHP code.

Question 13: Which Laravel feature allows you to limit the risk of a compromised queue worker by scoping what a queued job is permitted to do?

Disabling failed_jobs table logging
Setting the queue connection to sync
Job middleware with rate limiting and before/after hooks (Correct answer)
Using route model binding inside jobs

Correct answer: Job middleware with rate limiting and before/after hooks

Job middleware lets you wrap jobs with authorization checks, rate limits, and try/catch hooks to constrain and monitor job behavior.

Question 14: You want to send stakeholders a structured email summary every Monday. Which Laravel feature is best suited for scheduling this?

Task Scheduling via the Console Kernel (Correct answer)
Middleware groups
Event Listeners
Route Model Binding

Correct answer: Task Scheduling via the Console Kernel

Laravel's Task Scheduler in App\Console\Kernel lets you define cron-like schedules (e.g., ->weeklyOn(1)) to dispatch jobs or send notifications automatically.

Question 15: What is the purpose of route model binding in Laravel?

Automatically inject a model instance into a route based on a URI segment (Correct answer)
Cache Eloquent query results per route
Bind a route to a specific database connection
Map route parameters to config values

Correct answer: Automatically inject a model instance into a route based on a URI segment

Route model binding automatically resolves and injects an Eloquent model whose key matches the route segment.

Question 16: A stakeholder requests real-time dashboard updates in your Laravel app. Which driver is NOT a valid Laravel broadcasting driver?

Ably
Pusher
Socket.io (Correct answer)
Reverb

Correct answer: Socket.io

Socket.io is a JavaScript library, not a Laravel broadcasting driver; Laravel supports Pusher, Ably, and its own Reverb server.

Question 17: Which Laravel feature allows you to run code before and after a queued job without modifying the job class?

Job Observers
Job Pipelines
Job Middleware (Correct answer)
Queue Interceptors

Correct answer: Job Middleware

Job middleware lets you wrap additional logic around job execution—like rate limiting—without cluttering the job class itself.

Question 18: Under SOC 2 Type II, a Laravel application must demonstrate that access to administrative functions is restricted and logged. Which combination of Laravel features best satisfies this?

Using `admin` as the route name prefix and database logging of all 500 errors
Storing admin credentials in a separate `.env.admin` file with stricter file permissions
Route groups with `auth` middleware and Laravel Telescope for request logging (Correct answer)
Disabling all API routes for non-admin users in `routes/api.php`

Correct answer: Route groups with `auth` middleware and Laravel Telescope for request logging

Auth middleware enforces access restriction, and Telescope provides the request/action logs needed to demonstrate the control is operating effectively over time.

Question 19: What is a Laravel Policy used for?

Organizing authorization logic for a specific Eloquent model into a dedicated class (Correct answer)
Enforcing GDPR data retention rules
Setting HTTP security headers
Defining application configuration policies

Correct answer: Organizing authorization logic for a specific Eloquent model into a dedicated class

Policies are classes that group authorization methods for a model, providing a clean place to define who can view, update, or delete model instances.

Question 20: Which method on a mailable class sets the Reply-To address for client responses?

->cc('email@example.com')
->returnPath('email@example.com')
->respondTo('email@example.com')
->replyTo('email@example.com') (Correct answer)

Correct answer: ->replyTo('email@example.com')

The replyTo() method on Laravel's Mailable or the Mail facade sets the Reply-To header so client replies go to a specified address.

Question 21: How does Laravel protect against SQL injection when using Eloquent or the query builder?

By running queries in a sandboxed database connection
By validating input against a whitelist before querying
By using PDO parameter binding for all query values automatically (Correct answer)
By escaping all user input with htmlspecialchars()

Correct answer: By using PDO parameter binding for all query values automatically

Eloquent and the query builder pass all user-supplied values as bound parameters via PDO, preventing SQL injection by design.

Question 22: Which Laravel Artisan command lists all registered routes with their methods, URIs, and names?

php artisan route:dump
php artisan route:show
php artisan route:list (Correct answer)
php artisan routes

Correct answer: php artisan route:list

`php artisan route:list` outputs a table of all registered routes, including their HTTP methods, URIs, middleware, and names.

Question 23: Which Blade directive allows you to include a view conditionally based on a boolean expression?

@includeIf($bool, 'view')
@renderWhen($bool, 'view')
@includeWhen($bool, 'view') (Correct answer)
@conditionalInclude('view', $bool)

Correct answer: @includeWhen($bool, 'view')

@includeWhen($condition, 'view.name') renders the included view only when the first argument evaluates to true.

Question 24: What is the difference between the `web` and `api` authentication guards in Laravel?

web is for admin users and api is for regular users
web uses OAuth2 and api uses basic auth
web routes are encrypted while api routes are plain
web uses session/cookie storage while api uses token-based stateless authentication (Correct answer)

Correct answer: web uses session/cookie storage while api uses token-based stateless authentication

The web guard maintains state via session cookies, whereas the api guard is stateless and authenticates each request via a token.

Question 25: Where do you typically register Policies in a Laravel application?

In the .env file under AUTH_POLICIES
In the $policies array inside App\Providers\AuthServiceProvider (Correct answer)
In the routes/auth.php file
In the config/auth.php configuration file

Correct answer: In the $policies array inside App\Providers\AuthServiceProvider

The AuthServiceProvider's $policies array maps Eloquent models to their corresponding policy classes for automatic discovery.

Question 26: In Laravel, which method on the query builder retrieves all matching records as a collection?

all()
get() (Correct answer)
find()
first()

Correct answer: get()

`get()` executes the query and returns an Eloquent Collection containing all matching rows.

Question 27: Which Blade directive renders content only when the current user is authenticated?

@user
@authenticated
@logged_in
@auth (Correct answer)

Correct answer: @auth

@auth ... @endauth wraps content that should only be visible to authenticated users, using Laravel's Auth facade internally.

Question 28: Which middleware is responsible for protecting routes against Cross-Site Request Forgery in Laravel?

\Illuminate\Session\Middleware\StartSession
\App\Http\Middleware\VerifyCsrfToken (Correct answer)
\Illuminate\Auth\Middleware\AuthenticateWithBasicAuth
\App\Http\Middleware\Authenticate

Correct answer: \App\Http\Middleware\VerifyCsrfToken

The VerifyCsrfToken middleware checks every POST/PUT/PATCH/DELETE request for a valid CSRF token.

Question 29: How do you render all content pushed to a named Blade stack?

@output('scripts')
@render('scripts')
@stack('scripts') (Correct answer)
@show('scripts')

Correct answer: @stack('scripts')

@stack('stack-name') outputs everything that was pushed to that stack via @push directives throughout the view hierarchy.

Question 30: What is the purpose of Laravel Sanctum compared to Laravel Passport?

Sanctum handles OAuth2 flows; Passport handles simple API tokens
Sanctum requires a database; Passport is stateless JWT-only
Sanctum is for mobile apps only; Passport is for SPAs only
Sanctum provides lightweight token and SPA authentication; Passport is full OAuth2 server (Correct answer)

Correct answer: Sanctum provides lightweight token and SPA authentication; Passport is full OAuth2 server

Sanctum is a simple, lightweight package for SPA cookies and API tokens, while Passport implements a full OAuth2 server for third-party token issuance.

Question 31: What does `Route::group()` allow you to do in Laravel?

Limit route execution time
Share route attributes like prefix and middleware across multiple routes (Correct answer)
Create resourceful route collections
Bundle routes into a compiled cache

Correct answer: Share route attributes like prefix and middleware across multiple routes

Route::group() lets you share attributes such as middleware, prefix, or namespace across a set of routes.

Question 32: What is the purpose of Laravel Echo in a stakeholder communication context?

It's a JavaScript library that subscribes to Laravel broadcast channels (Correct answer)
It repeats failed queue jobs automatically
It mirrors database writes to a secondary server
It echoes CLI output to log files

Correct answer: It's a JavaScript library that subscribes to Laravel broadcast channels

Laravel Echo is a JavaScript library that makes it easy to subscribe to channels and listen for events broadcast by Laravel on the frontend.

Laravel Certified Developer

The Laravel Certified Developer exam validates proficiency in building web applications with the Laravel PHP framework, covering routing, Eloquent ORM, Blade templates, authentication, and testing. Candidates must demonstrate working knowledge of Laravel v12+ and modern PHP features.

Questions

35 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds