Zend Certified PHP Engineer (ZCPE) — Questions and Answers

Question 1: Which PHP testing concept verifies that a mock method is called exactly N times?

times(N)->verify()
callCount(N)
expects($this->exactly(N)) (Correct answer)
assertCalled(N)

Correct answer: expects($this->exactly(N))

PHPUnit's expects($this->exactly(N)) sets an expectation that a mocked method is invoked a precise number of times.

Question 2: What is the professional purpose of a `.gitignore` file in a PHP project?

Mark files as read-only in the repository
Exclude files that should not be tracked in version control, such as `vendor/`, `.env`, and build artifacts (Correct answer)
Prevent Git from being installed on the server
Automatically merge conflicting PHP files

Correct answer: Exclude files that should not be tracked in version control, such as `vendor/`, `.env`, and build artifacts

A `.gitignore` keeps the repository clean by excluding generated directories like `vendor/`, sensitive files like `.env`, and IDE-specific config files.

Question 3: A PHP e-commerce checkout must charge a credit card and then save the order. If the charge succeeds but DB insert fails, what pattern prevents charging without saving?

Wrap both operations in a database transaction and rollback if either fails (Correct answer)
Use a try/catch and email the admin on DB failure
Save to the DB first, then charge the card
Use file_put_contents as a backup record before the DB insert

Correct answer: Wrap both operations in a database transaction and rollback if either fails

A database transaction ensures atomicity: if the DB insert fails after a successful charge, the transaction rolls back and compensating logic can refund the charge.

Question 4: What is the recommended way to store user passwords in a PHP application to minimize risk from a database breach?

password_hash() with PASSWORD_BCRYPT or PASSWORD_ARGON2ID (Correct answer)
base64_encode()
md5() with a static salt
sha256() without a salt

Correct answer: password_hash() with PASSWORD_BCRYPT or PASSWORD_ARGON2ID

password_hash() with a strong algorithm like bcrypt or Argon2 produces adaptive, salted hashes that are resistant to brute-force attacks.

Question 5: What does the array_push() function do in PHP?

Returns the first element
Adds one or more elements to the end of an array (Correct answer)
Removes the last element
Sorts the array

Correct answer: Adds one or more elements to the end of an array

array_push() appends one or more elements to the end of an array and returns the new count.

Question 6: Which tool generates human-readable HTML code coverage reports from PHPUnit's coverage data?

phpcbf --html
phpstan --report
phpunit --coverage-html (Correct answer)
phpdoc

Correct answer: phpunit --coverage-html

Running PHPUnit with --coverage-html <dir> generates an HTML report showing line-by-line coverage.

Question 7: In a professional PHP project, where should database credentials and API keys be stored?

In environment variables or a `.env` file excluded from version control (Correct answer)
In a public config file committed to the repo
In a comment block at the top of the main script
Hardcoded in the source files for easy access

Correct answer: In environment variables or a `.env` file excluded from version control

Secrets must be kept out of source control; environment variables or a local `.env` file (gitignored) are the standard approach.

Question 8: Which PHP function returns the length of a string?

size()
count()
len()
strlen() (Correct answer)

Correct answer: strlen()

strlen() returns the number of bytes (characters) in a given string.

Question 9: How do you call the parent class's constructor from a child class in PHP?

this->parent()
parent::__construct() (Correct answer)
super()
base::__construct()

Correct answer: parent::__construct()

parent::__construct() explicitly calls the parent class's constructor from within the child class.

Question 10: Which PHP security mechanism helps mitigate risk from path traversal attacks when reading files based on user input?

Setting open_basedir to the web root
Calling file_exists() before reading
Using dirname() on the input string
Using realpath() to resolve the canonical path and verify it starts with an approved base directory (Correct answer)

Correct answer: Using realpath() to resolve the canonical path and verify it starts with an approved base directory

realpath() resolves ../ sequences to the true path; comparing that against an allowed base directory prevents traversal outside the intended directory.

Question 11: Which combination of cookie attributes should be set when PHP sets sensitive session cookies?

Compress the cookie data to obscure its contents from attackers
Encode the data with base64 and store in the cookie value
Set the Secure, HttpOnly, and SameSite attributes (Correct answer)
Store a raw value alongside an MD5 checksum for integrity

Correct answer: Set the Secure, HttpOnly, and SameSite attributes

Secure restricts transmission to HTTPS, HttpOnly blocks JavaScript access, and SameSite prevents the cookie from being sent with cross-site requests automatically.

Question 12: What is the purpose of the php://output stream in PHP?

Capturing error logs
Streaming file uploads
Reading raw POST input
Writing directly to the response output buffer (Correct answer)

Correct answer: Writing directly to the response output buffer

php://output is a write-only stream that allows writing directly to the output buffer, equivalent to using echo or print.

Question 13: Which PHP function encodes a string into Base64, commonly used when embedding binary data in JSON API payloads?

base64()
bin2base64()
encode_base64()
base64_encode() (Correct answer)

Correct answer: base64_encode()

base64_encode() converts binary data to a Base64-encoded ASCII string safe for inclusion in JSON, XML, or HTTP headers.

Question 14: What is the name of the special method automatically called when an object is created in PHP?

__start()
__construct() (Correct answer)
__new()
__init()

Correct answer: __construct()

__construct() is the PHP magic method that serves as the constructor, called automatically on object instantiation.

Question 15: What is late static binding in PHP accessed through?

parent::
$this::
self::
static:: (Correct answer)

Correct answer: static::

static:: uses late static binding, resolving to the class that was actually called at runtime rather than the class where the method was defined.

Question 16: Which of the following is the correct way to declare a constant in PHP?

const = MY_CONST(10);
define('MY_CONST', 10); (Correct answer)
$MY_CONST = 10;
var MY_CONST = 10;

Correct answer: define('MY_CONST', 10);

define('MY_CONST', 10) creates a global constant; the const keyword can also be used at top-level scope.

Question 17: Which keyword is used to define a class in PHP?

class (Correct answer)
object
define
struct

Correct answer: class

The class keyword is used to declare a class definition in PHP.

Question 18: Which PHP function returns the execution time in microseconds and is commonly used in performance benchmarking research?

microtime(true) (Correct answer)
hrtime(true)
clock_gettime()
time()

Correct answer: microtime(true)

microtime(true) returns the current Unix timestamp as a float including microseconds, making it useful for measuring script execution time.

Question 19: What does $this refer to inside a PHP class method?

The class itself
The most recently created object
The current object instance (Correct answer)
The parent class

Correct answer: The current object instance

$this is a pseudo-variable that refers to the current object (instance) inside a method.

Question 20: What does an interface in PHP define?

A class that can't be extended
A concrete class with default values
A contract of methods that implementing classes must define (Correct answer)
A static utility class

Correct answer: A contract of methods that implementing classes must define

An interface declares method signatures without implementation, and any class that implements it must provide concrete implementations.

Question 21: Which PHP function sets an HTTP cookie that can be used to maintain state between a server and a stakeholder's browser session?

setcookie() (Correct answer)
session_set_cookie()
cookie_set()
header('Set-Cookie: ...')

Correct answer: setcookie()

setcookie() sends an HTTP Set-Cookie header and is the standard PHP function for creating browser cookies.

Question 22: What PHP function can send an email with HTML content by specifying MIME headers in the additional_headers parameter?

mail() (Correct answer)
sendmail()
smtp_send()
email()

Correct answer: mail()

PHP's built-in mail() function accepts additional headers like 'Content-Type: text/html' to send HTML-formatted emails.

Question 23: Which superglobal in PHP contains data sent via an HTML form with method='POST'?

$_REQUEST
$_POST (Correct answer)
$_GET
$_FORM

Correct answer: $_POST

$_POST is the superglobal array that holds key-value pairs submitted via HTTP POST.

Question 24: What does the PHP configuration directive open_basedir accomplish from a security standpoint?

Sets the maximum allowed file size for uploads
Opens a shared base directory accessible to all web users
Restricts PHP file system operations to one or more specified directory trees (Correct answer)
Sets the default working directory for PHP CLI scripts

Correct answer: Restricts PHP file system operations to one or more specified directory trees

open_basedir restricts PHP's file system access to specified directories, preventing directory traversal attacks from reaching sensitive system files outside the web application.

Question 25: Which keyword includes a trait inside a PHP class?

extend
include
import
use (Correct answer)

Correct answer: use

The use keyword inside a class body imports a trait's methods into that class.

Question 26: In PHP, which loop guarantees that the loop body executes at least once?

while
do...while (Correct answer)
foreach
for

Correct answer: do...while

The do...while loop checks its condition after executing the body, so the body runs at least one time.

Question 27: What role does peer review play in PHP Programming Language practice?

It creates unnecessary competition
It replaces formal certification
It provides quality assurance and professional development through collegial evaluation (Correct answer)
It is only for beginners

Correct answer: It provides quality assurance and professional development through collegial evaluation

This is fundamental to PHP Programming Language practice. It provides quality assurance and professional development through collegial evaluation represents the professional standard for professional standards in the PHP certification framework.

Question 28: What security vulnerability can arise when user-controlled input is passed to PHP's include() or require()?

Syntax errors that permanently crash the application
Circular dependency issues between included files
Performance degradation from repeated file parsing overhead
Local or remote file inclusion attacks that execute unintended code (Correct answer)

Correct answer: Local or remote file inclusion attacks that execute unintended code

When user input controls the file path in include/require, attackers can include remote malicious files (RFI) or traverse directories to access sensitive local files (LFI).

Question 29: What does the abstract keyword mean when applied to a PHP class?

The class cannot be instantiated directly (Correct answer)
The class has no properties
The class has no constructor
The class is read-only

Correct answer: The class cannot be instantiated directly

An abstract class cannot be instantiated on its own and must be subclassed before use.

Question 30: What PHP cURL option must be set to true to make PHP follow HTTP redirect responses (301/302) automatically?

CURLOPT_REDIRECT
CURLOPT_MAXREDIRS
CURLOPT_AUTOREDIRECT
CURLOPT_FOLLOWLOCATION (Correct answer)

Correct answer: CURLOPT_FOLLOWLOCATION

CURLOPT_FOLLOWLOCATION tells cURL to automatically follow Location headers when a 3xx redirect response is received.

Question 31: What is mutation testing in the context of PHP quality assurance?

Randomizing test execution order
Introducing small code changes to verify tests catch them (Correct answer)
Transforming test data types automatically
Testing code on multiple PHP versions

Correct answer: Introducing small code changes to verify tests catch them

Mutation testing tools like Infection modify code slightly ('mutants') and confirm that existing tests fail for each change.

Question 32: Which HTTP security header prevents clickjacking attacks by controlling whether a page can be embedded in iframes?

X-Frame-Options (Correct answer)
Content-Security-Policy
Strict-Transport-Security
X-XSS-Protection

Correct answer: X-Frame-Options

X-Frame-Options controls whether a page can be loaded inside a frame or iframe, preventing clickjacking by denying embedding on third-party sites.

Question 33: Which superglobal array holds data submitted via an HTML form using GET?

$_POST
$_REQUEST
$_SERVER
$_GET (Correct answer)

Correct answer: $_GET

$_GET is the PHP superglobal that contains all URL query string parameters passed via GET requests.

Question 34: Which PHP session configuration setting helps mitigate session hijacking via XSS attacks?

session.save_path = /tmp
session.use_cookies = 0
session.use_trans_sid = 1
session.cookie_httponly = 1 (Correct answer)

Correct answer: session.cookie_httponly = 1

Setting session.cookie_httponly = 1 prevents JavaScript from accessing session cookies, stopping XSS attacks from stealing session identifiers.

Question 35: Which PHP function converts a string to all lowercase letters?

strtolower() (Correct answer)
string_lower()
lowercase()
tolower()

Correct answer: strtolower()

strtolower() converts all alphabetic characters in a string to lowercase.

Question 36: What is the purpose of PHP's filter_var() and filter_input() functions in secure development?

To compress data payloads before HTTP transmission
To format output data for display in templates
To validate and sanitize user input using predefined filter constants (Correct answer)
To encode sensitive data before database storage

Correct answer: To validate and sanitize user input using predefined filter constants

filter_var() and filter_input() provide standardized validation and sanitization of external data using PHP's built-in Filter extension, reducing injection vulnerabilities.

Question 37: What role does active listening play in PHP Programming Language practice?

It is only for counseling professionals
It wastes time
It ensures accurate understanding, demonstrates respect, and improves outcomes (Correct answer)
It means staying silent

Correct answer: It ensures accurate understanding, demonstrates respect, and improves outcomes

This is fundamental to PHP Programming Language practice. It ensures accurate understanding, demonstrates respect, and improves outcomes represents the professional standard for communication in the PHP certification framework.

Question 38: Which PHP function converts special characters to HTML entities to prevent XSS attacks?

addslashes()
htmlspecialchars() (Correct answer)
urlencode()
strip_tags()

Correct answer: htmlspecialchars()

htmlspecialchars() converts characters like <, >, &, and quotes to their HTML entity equivalents, neutralizing XSS payloads when output to a browser.

Question 39: Which PHP function retrieves all HTTP request headers sent by the client?

get_headers()
getallheaders() (Correct answer)
apache_request_headers()
http_get_request_headers()

Correct answer: getallheaders()

getallheaders() retrieves all HTTP request headers as an associative array and is available in both Apache and PHP-FPM environments.

Question 40: What is the professional standard for documenting a public PHP method's parameters and return type?

Documentation is optional for public methods
Write a multi-paragraph essay in the docblock
Use only inline comments inside the method body
Use PHP 8 native type declarations and add a concise docblock only when the type alone is insufficient (Correct answer)

Correct answer: Use PHP 8 native type declarations and add a concise docblock only when the type alone is insufficient

PHP 8 typed properties and union types often make docblocks redundant; add `@param`/`@return` only to convey information the type system cannot express alone.

Question 41: Which keyword is used to create a new instance of a class in PHP?

new (Correct answer)
instance
create
make

Correct answer: new

The new keyword instantiates a class, calling its constructor and returning the object.

Question 42: What does PHP's mail() function return when the message is successfully accepted for delivery?

An SMTP response object
The message ID string
1
true (Correct answer)

Correct answer: true

mail() returns true if the message was successfully accepted for delivery, or false on failure.

Question 43: You are profiling a PHP application and find that a database query runs 200 times per page load for the same data. What is the best solution?

Use a faster ORM
Add more database indexes
Split the query into two smaller queries
Cache the query result in memory (APCu or Redis) for the duration of the request or longer (Correct answer)

Correct answer: Cache the query result in memory (APCu or Redis) for the duration of the request or longer

Caching repeated identical queries eliminates redundant database round-trips, the root cause of the N+1 or repeated-fetch problem.

Question 44: When examining PHP source code of installed libraries for research, which directory under a project root contains the vendor packages?

/modules/
/packages/
/lib/
/vendor/ (Correct answer)

Correct answer: /vendor/

Composer installs all third-party dependencies into the /vendor/ directory at the project root by default.

Question 45: Which PHP magic method defines how an object behaves when cast to a string?

__string()
__print()
__toString() (Correct answer)
__serialize()

Correct answer: __toString()

__toString() is called automatically when an object is used in a string context, such as with echo.

Question 46: Which of the following best describes the 'Boy Scout Rule' applied to PHP development?

Never modify legacy code
Always write tests before features
Leave the code cleaner than you found it — fix small issues whenever you touch a file (Correct answer)
Refactor the entire codebase in one sprint

Correct answer: Leave the code cleaner than you found it — fix small issues whenever you touch a file

The Boy Scout Rule encourages incremental improvement: rename a confusing variable, remove dead code, or add a missing type hint each time you edit a file.

Question 47: Which directive in a phpunit.xml file sets the minimum required line coverage percentage?

<require-coverage>
forceCoversAnnotation inside <coverage> (Correct answer)
<minCoverage>
<coverageThreshold>

Correct answer: forceCoversAnnotation inside <coverage>

PHPUnit uses <coverage> configuration with attributes like forceCoversAnnotation and separate minLines/minMethods settings, not a single tag.

Question 48: What does the empty() function return when passed an empty string?

true (Correct answer)
NULL
0
false

Correct answer: true

empty() returns true for values considered empty: empty string, 0, NULL, false, empty array, or '0'.

Question 49: In PHP's $_SERVER superglobal, which key holds the HTTP request method (GET, POST, etc.)?

$_SERVER['HTTP_METHOD']
$_SERVER['METHOD']
$_SERVER['REQUEST_TYPE']
$_SERVER['REQUEST_METHOD'] (Correct answer)

Correct answer: $_SERVER['REQUEST_METHOD']

$_SERVER['REQUEST_METHOD'] contains the HTTP method used for the current request.

Question 50: What is the consequence of non-compliance for PHP Programming Language professionals?

No significant consequences
Potential fines, license revocation, legal liability, and reputational damage (Correct answer)
Just additional paperwork
Only verbal warnings

Correct answer: Potential fines, license revocation, legal liability, and reputational damage

This is fundamental to PHP Programming Language practice. Potential fines, license revocation, legal liability, and reputational damage represents the professional standard for regulatory in the PHP certification framework.

Question 51: What is the best practice for storing sensitive configuration values like database passwords in PHP applications?

Encode them with base64_encode() before embedding in source files
Use environment variables or config files stored outside the web root (Correct answer)
Store them in .htaccess files inside the web root
Hard-code them directly in PHP source files

Correct answer: Use environment variables or config files stored outside the web root

Environment variables or config files outside the web root prevent credential exposure through source code leaks or web server misconfigurations that accidentally serve PHP as text.

Question 52: What PHP interface must be implemented to make an object iterable with foreach?

Countable
Iterator (Correct answer)
ArrayAccess
Traversable

Correct answer: Iterator

Implementing the Iterator interface with its five required methods (current, key, next, rewind, valid) allows foreach iteration.

Question 53: How should PHP professionals stay current with regulatory changes?

Rely on colleagues for updates
Regulations rarely change
Wait until audited
Monitor regulatory updates, participate in professional associations, and attend continuing education (Correct answer)

Correct answer: Monitor regulatory updates, participate in professional associations, and attend continuing education

This is fundamental to PHP Programming Language practice. Monitor regulatory updates, participate in professional associations, and attend continuing education represents the professional standard for regulatory in the PHP certification framework.

Question 54: Which visibility modifier allows access from the class itself and all subclasses, but not from outside?

protected (Correct answer)
public
internal
private

Correct answer: protected

protected members are accessible within the declaring class and any class that inherits from it.

Question 55: What was the historical security danger of null byte injection in PHP file path operations?

It caused NULL values to be silently inserted into database records
A null byte (\0) in a filename truncated the path at the OS level, bypassing extension validation (Correct answer)
It caused PHP to skip input validation whenever null values were present
It overwrote PHP's null coalescing operator (??) behavior unexpectedly

Correct answer: A null byte (\0) in a filename truncated the path at the OS level, bypassing extension validation

In older PHP versions, null bytes caused file paths to be truncated at the operating system level, so 'shell.php\0.jpg' was treated as 'shell.php', bypassing extension-based upload checks.

Question 56: What does the PHP Composer tool manage?

Database migrations
Web server configuration
PHP version upgrades
Package dependencies (Correct answer)

Correct answer: Package dependencies

Composer is PHP's dependency manager, used to declare and install project libraries from Packagist.

Question 57: What is the correct approach to validating user-uploaded files in PHP for security?

Check only the file extension in the uploaded filename
Trust the MIME type stored in $_FILES['file']['type']
Store files in the web root using their original filenames
Inspect actual file content with finfo_file() and use an allowed-type whitelist (Correct answer)

Correct answer: Inspect actual file content with finfo_file() and use an allowed-type whitelist

Attackers can spoof file extensions and MIME types, so actual file content must be inspected with finfo_file() and only whitelisted types accepted.

Question 58: Which PHP magic method is triggered when reading an inaccessible or undefined property?

__fetch()
__get() (Correct answer)
__access()
__read()

Correct answer: __get()

__get() is invoked when attempting to read a property that is inaccessible or does not exist on the object.

Question 59: What is the professional reason to avoid catching broad `Exception` or `Throwable` at the application logic level?

Broad catches always cause memory leaks
Only framework code is allowed to catch exceptions
Catching too broadly hides unexpected errors and prevents proper diagnosis of specific failure modes (Correct answer)
PHP does not allow catching base exception classes

Correct answer: Catching too broadly hides unexpected errors and prevents proper diagnosis of specific failure modes

Catching `Exception` globally masks bugs by treating programming errors as recoverable conditions; catch specific exception types relevant to the operation.

Question 60: What is a risk mitigation strategy in PHP Programming Language practice?

Transferring all responsibility
Only addressing risks after they occur
Implementing controls that reduce the likelihood or impact of identified risks (Correct answer)
Ignoring low-probability risks

Correct answer: Implementing controls that reduce the likelihood or impact of identified risks

This is fundamental to PHP Programming Language practice. Implementing controls that reduce the likelihood or impact of identified risks represents the professional standard for risk management in the PHP certification framework.

Question 61: What is the recommended PHP error display configuration for production environments?

Use trigger_error() to display detailed messages to end users
Set display_errors = On to help users report bugs
Disable all error reporting with error_reporting(0)
Set display_errors = Off and log errors server-side to a file (Correct answer)

Correct answer: Set display_errors = Off and log errors server-side to a file

In production, display_errors should be Off to avoid leaking sensitive stack traces or file paths, while errors are logged server-side for developer review only.

Question 62: Which Content-Security-Policy directive most directly reduces the risk of reflected XSS by restricting inline script execution?

default-src *
frame-ancestors 'none'
script-src 'self' (Correct answer)
img-src data:

Correct answer: script-src 'self'

Setting script-src to 'self' (without 'unsafe-inline') blocks inline and externally hosted scripts not from the same origin, breaking most XSS payloads.

Question 63: In a PHP webhook receiver, what should you do immediately after verifying the webhook signature?

Redirect the webhook sender to a callback URL
Return HTTP 500 to pause delivery
Return HTTP 200 quickly and queue the work asynchronously (Correct answer)
Process the payload synchronously before responding

Correct answer: Return HTTP 200 quickly and queue the work asynchronously

Best practice is to return HTTP 200 immediately and process the payload asynchronously to prevent webhook timeouts.

Question 64: What is the proper method for defining constants in PHP?

Constant ($var)
Constant $var
Const $var
Define("Constant"); (Correct answer)

Correct answer: Define("Constant");

In PHP, constants are defined using the `define()` function. This function takes two main arguments: the name of the constant as a string, and its value. Unlike variables, constants do not start with a dollar sign and cannot be changed once declared, making them useful for fixed values like database credentials or application settings.

Question 65: What does the final keyword prevent when applied to a PHP method?

The method from being made static
The method from accepting parameters
The method from returning a value
Child classes from overriding the method (Correct answer)

Correct answer: Child classes from overriding the method

A final method cannot be overridden in any subclass, locking its behavior.

Question 66: Which PHP function returns the number of elements in an array?

array_count()
count() (Correct answer)
sizeof()
length()

Correct answer: count()

count() returns the number of elements in an array or countable object.

Question 67: Which function would you use to prevent XSS attacks when outputting user data in PHP?

addslashes()
urlencode()
strip_tags()
htmlspecialchars() (Correct answer)

Correct answer: htmlspecialchars()

htmlspecialchars() converts special characters like <, >, and & into their HTML entities, preventing script injection.

Question 68: To create a CURL session, which of the following functions will be used?

Curl_exec()
Curl_init() (Correct answer)
Curl_setopt()
Curl_opt()

Correct answer: Curl_init()

The `curl_init()` function is used to initialize a new cURL session and returns a cURL handle. This handle is then used by other cURL functions, such as `curl_setopt()` to set options and `curl_exec()` to execute the session. It's the essential first step for making HTTP requests with cURL in PHP.

Question 69: What is a PHP trait primarily used for?

Creating abstract interfaces
Enforcing type safety
Defining database schemas
Reusing method implementations across classes without inheritance (Correct answer)

Correct answer: Reusing method implementations across classes without inheritance

Traits allow code reuse across multiple independent classes, solving the single-inheritance limitation in PHP.

Question 70: Which Composer script command is commonly used to run PHPStan static analysis?

composer check
composer lint
composer analyse (Correct answer)
composer test

Correct answer: composer analyse

By convention, projects add a 'analyse' script in composer.json that runs PHPStan, though the name is configurable.

Zend Certified PHP Engineer (ZCPE)

The Zend Certified PHP Engineer certification validates real-world PHP programming proficiency across core language features, OOP, web development, databases, and security through PHP 8.x.

Questions

90 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds