“150”, Aptitude Test Questions and Answers for ICT Officer II (Application programmer) – e-GA.
ABSTRACT
This 150-question aptitude test
preparation package is designed specifically for candidates applying for ICT
Officer II (Application Programmer) at the e-Government Authority (e-GA),
Tanzania. It covers key areas including software development and SDLC, PHP
and Java programming, object-oriented analysis and design, web and mobile
development, databases, APIs and system integration, software testing and
quality assurance, cybersecurity, application servers, cloud and
containerization, microservices, troubleshooting, system performance,
reliability, documentation, and production support. The questions are
deliberately challenging, scenario-based, and designed with closely related
answer choices to assess technical understanding, analytical reasoning,
problem-solving ability, and practical decision-making rather than simple
memorization.
Prepared by: ICT Officer II (Application
programmer)
Compiled by ICT Officer II (Application
programmer)
0628729934.
Date: August 29, 2026
Dear applicants,
This collection of questions and answers
has been prepared to help all of you to understand the key areas tested during
the interview. The goal is to provide a useful, and practical study guide so
you can all perform confidently and fairly in the selection process. I wish you
the best of luck, and may this resource support you in achieving success!
Warm regards,
ICT Officer II (Application programmer)
For Personal Use by Applicants Preparing
for ICT Officer II (Application programmer) - at Public Service Recruitment
Service.
ICT OFFICER II
(APPLICATION PROGRAMMER) – e-GA
150 Aptitude
Test Questions and Answers
1. A government agency plans to introduce an
online application service. During requirements gathering, users state that the
system must allow an applicant to “quickly obtain a service.” The development
team considers this sufficient as a functional requirement. What is the most
appropriate action before implementation begins?
A. Convert the
statement directly into database requirements B. Clarify measurable functional
and non-functional requirements C. Begin prototyping because the intended
service is already known D. Select the application framework before further
requirements work
Answer: B
Rationale: The statement “quickly obtain a service”
is ambiguous because “quickly” has no measurable meaning and does not specify
the actual system behavior required. The development team should clarify both
functional requirements, such as what applicants must be able to do, and
non-functional requirements, such as response-time expectations, availability,
security, and usability. Prototyping can assist clarification, but it should
not replace proper requirements analysis, while choosing a framework or
database before understanding the requirements can introduce unnecessary
technical assumptions. Therefore, defining measurable and testable requirements
is the most appropriate next step.
2. An application contains several classes
representing different government payment methods. All payment methods must
provide a processPayment() operation, but the implementation differs according
to the payment method. Which design most appropriately supports this
requirement?
A. Create one
class containing conditional logic for every payment method B. Duplicate the
payment-processing method separately in every unrelated class C. Define a
common abstraction and allow each payment type to implement it D. Store
payment-processing instructions as configurable values in the database
Answer: C
Rationale: A common abstraction, such as an
interface or abstract class, allows different payment types to expose the same
operation while providing their own implementation, which is a direct
application of polymorphism. This design reduces conditional logic and allows
new payment methods to be added with less impact on existing code. A single
class containing extensive conditions becomes difficult to maintain, duplicated
unrelated implementations weaken the common contract, and database
configuration does not by itself provide the object-oriented behavior required.
Therefore, defining a common abstraction with specialized implementations is
the strongest design.
3. A citizen-service application has a
database table containing several million application records. A frequently
executed query retrieves applications using an exact application_number value,
but the query performs increasingly slowly as the table grows. Assuming the
query itself is correctly written, which improvement is most directly
appropriate?
A. Add an
appropriate index on the application-number column B. Increase the number of
application-server worker threads C. Move application-number validation into
the browser interface D. Increase the frequency of database backup operations
Answer: A
Rationale: An index on a column frequently used for
exact lookups can substantially reduce the amount of data the database must
scan to locate the requested record. As the table grows, an indexed lookup can
remain much more efficient than repeatedly scanning millions of rows.
Increasing application-server threads does not directly solve an inefficient
database lookup, browser-side validation cannot accelerate server-side
retrieval, and backup frequency is unrelated to query performance. The index
should nevertheless be designed appropriately because excessive or unnecessary
indexes can increase storage and write overhead.
4. A PHP application receives an applicant's
identification number through an HTTP request and constructs a SQL statement by
directly concatenating the received value into the query. Which vulnerability
is the primary concern?
A. Cross-site
request forgery caused by missing session expiration B. Cross-site scripting
caused by insufficient HTML output encoding C. SQL injection caused by
incorporating untrusted input into SQL D. Broken authentication caused by
using an HTTP request parameter
Answer: C
Rationale: Directly concatenating untrusted request
data into SQL can allow an attacker to manipulate the structure of the SQL
statement, which is the defining risk of SQL injection. The appropriate defense
is to use parameterized queries or prepared statements and apply suitable input
validation as an additional control. Cross-site scripting concerns malicious
content being interpreted in a user's browser, while CSRF involves unauthorized
actions performed using an authenticated user's session; neither directly describes
the vulnerability presented. Therefore, SQL injection is the primary concern.
5. A developer has completed a new module for
an e-government application. The module passes its individual unit tests, but
failures appear when it communicates with an existing authentication service.
Which type of testing is most directly intended to identify this class
of problem?
A. Unit testing
of individual methods within the new module B. Integration testing between
interacting software components C. Usability testing involving representative
government users D. Acceptance testing against the application's business
objectives
Answer: B
Rationale: Integration testing examines whether
separately developed components communicate and operate correctly together,
making it particularly appropriate when a newly developed module fails while
interacting with an existing authentication service. Unit testing focuses on
isolated components and may therefore pass even when interfaces between
components are incorrect. Usability testing evaluates how effectively users
interact with the system, while acceptance testing determines whether the
overall solution satisfies specified business requirements. Because the failure
occurs at a component boundary, integration testing is the most direct choice.
6. A Java application communicates with an
external service that may temporarily become unavailable. The application
should prevent the failure from terminating the entire request-processing
mechanism and should record the failure for operational investigation. Which
approach is most appropriate?
A. Catch the
relevant exception, log meaningful context, and apply controlled recovery B.
Catch every exception and ignore it so normal processing always continues C.
Declare every possible exception as unchecked to simplify application code D.
Restart the entire application whenever an external service returns an error
Answer: A
Rationale: External service failures are expected
operational conditions that should be handled deliberately. Catching an
appropriate exception, recording useful diagnostic information, and applying a
defined recovery strategy—such as retrying under controlled conditions,
returning a suitable response, or using a fallback—allows the application to
remain reliable without hiding failures. Catching everything and ignoring it
makes problems difficult to diagnose, indiscriminately converting exceptions to
unchecked exceptions does not solve the underlying reliability issue, and
restarting the entire application is generally disproportionate to a temporary
dependency failure. Therefore, controlled exception handling with useful
logging and recovery is most appropriate.
7. During development of a government
information system, a change request introduces a new mandatory field for
applicants. The project team wants to determine which database components,
interfaces, business rules, test cases, and documents may be affected. Which
practice provides the strongest systematic basis for this analysis?
A. Reviewing only
the source files most recently modified B. Searching application logs for
previous occurrences of the field C. Maintaining traceability between
requirements and implementation artifacts D. Asking individual developers to
estimate the likely impact from memory
Answer: C
Rationale: Requirements traceability establishes
relationships between requirements and downstream artifacts such as design
elements, source components, interfaces, test cases, and documentation. When a
requirement changes, these relationships provide a systematic basis for impact
analysis and help ensure that affected areas are not overlooked. Reviewing
recently modified files is incomplete, logs show runtime behavior rather than
design dependencies, and relying on individual memory is inconsistent and
difficult to audit. Traceability is therefore the strongest approach for
controlled change-impact analysis.
8. An e-government application exposes an API
that retrieves the details of a citizen's submitted application. The operation
does not modify server-side state. Which HTTP method is most appropriate
for this operation under conventional RESTful design?
A. POST because
the request contains application identification data B. PUT because the client
specifies the requested application resource C. PATCH because the server
returns only selected application information D. GET because the operation
retrieves a representation of a resource
Answer: D
Rationale: GET is conventionally used to retrieve a
representation of a resource without modifying server-side state. The presence
of parameters identifying the application does not change the semantic purpose
of the operation. POST is generally associated with creating resources or
invoking operations where GET semantics do not apply, PUT is normally used for
replacing a resource representation, and PATCH is intended for partial
modifications. Therefore, a read-only application-details operation should
normally use GET.
9. An e-government platform contains several
independently deployable services, such as identity verification, payment
processing, notification, and application management. Each service owns its
functionality and communicates with other services through defined interfaces.
What architectural approach does this scenario most closely represent?
A. Monolithic
architecture with logically separated source-code packages B. Microservices
architecture with independently managed service boundaries C. Layered
architecture where all modules share one deployment process D. Desktop
architecture where clients execute the primary business functions
Answer: B
Rationale: Microservices architecture decomposes an
application into relatively independent services organized around defined
business capabilities, with communication occurring through explicit interfaces
such as APIs or messaging mechanisms. Independent deployment and service
boundaries are important characteristics of this approach. A monolithic
application can contain well-organized packages but is normally deployed as one
unit, while a layered architecture describes separation by technical
responsibility rather than necessarily independent deployment. A desktop
architecture also does not match the described distributed service model. Thus,
the scenario most closely represents microservices.
10. A production application occasionally
becomes unavailable when a large number of citizens submit applications
simultaneously. Monitoring shows that CPU usage remains moderate, but database
connections reach their configured maximum. Which investigation should receive
the highest priority?
A. Review
database connection-pool configuration and connection usage B. Replace the
user-interface framework with a newer implementation C. Increase browser cache
duration for static government information D. Rewrite all application code
using a different programming language
Answer: A
Rationale: The evidence points directly toward
database connection exhaustion: the application is receiving increased
concurrent demand while the configured connection capacity is being reached.
The development team should investigate connection-pool sizing, connection
leaks, transaction duration, inefficient queries, and whether connections are
being released correctly. Changing the UI framework or browser caching may
improve other aspects of performance but does not directly address exhausted
database connections, while rewriting the application language would be an
unjustified response to a configuration or resource-management problem.
Evidence-driven diagnosis therefore makes connection-pool and connection-usage
analysis the highest priority.
11. A PHP application displays a citizen's
submitted name on a web page. The value is stored in the database, but the
application does not know whether the original input contained malicious HTML
or JavaScript. What is the most appropriate primary defense when
displaying the value in an HTML context?
A. Disable
JavaScript globally in the application server configuration B. Increase the
database column length to accommodate encoded characters C. Convert every
submitted value to an integer before database insertion D. Escape the output
according to the HTML context before rendering it
Answer: D
Rationale: When untrusted data is inserted into an
HTML response, context-appropriate output encoding is a fundamental defense
against cross-site scripting. The application should encode characters so that
potentially executable markup is interpreted as data rather than active
content. Database column length does not provide security, converting arbitrary
names to integers would destroy legitimate data, and disabling JavaScript at
the server does not reliably protect users' browsers from malicious markup.
Input validation is also useful, but for rendering an untrusted name in HTML,
proper output encoding is the key immediate defense.
12. A service class directly creates instances
of several concrete notification providers, including SMS, email, and another
messaging implementation. Every time a new provider is introduced, the service
class must be modified. Which design improvement best reduces this coupling?
A. Add more
conditional branches to the existing notification service B. Move
provider-specific code into the database configuration layer C. Depend on an
abstraction and inject the required notification implementation D. Duplicate
the service class so each notification provider has its own version
Answer: C
Rationale: Depending on an abstraction and injecting
the concrete implementation reduces coupling between the business service and
individual notification providers. The service can work with a common
notification interface while the specific implementation is supplied through
dependency injection or an equivalent mechanism. Adding more conditionals
increases coupling, moving executable provider logic into database
configuration is an inappropriate separation of responsibilities, and
duplicating services increases maintenance complexity. This design therefore
applies dependency inversion and supports easier testing and extension.
13. A government payment operation records a
payment and then changes the corresponding application status. Both changes
must represent one successful business operation. If either operation fails,
neither change should remain committed. Which mechanism most directly
provides this guarantee?
A. Database
replication that maintains synchronized copies of payment records B. A
transaction boundary that commits the related operations as one unit C. An
isolation level that prevents every concurrent database operation D. A
database constraint that validates individual values before storage
Answer: B
Rationale: A transaction boundary groups the
payment-record update and application-status update into a single atomic unit,
allowing both changes to be committed together or rolled back when the
operation cannot complete successfully. Replication maintains additional copies
of data but does not by itself guarantee that two related operations commit or
roll back together. Isolation controls how concurrent transactions interact,
but it does not alone provide the required all-or-nothing behavior. Database
constraints protect specific data rules but cannot generally coordinate
multiple business updates as one atomic operation. Therefore, transaction
management is the mechanism that most directly provides the required guarantee.
14. A Java web application has been
successfully deployed to an application server, but users receive errors
because the application cannot establish a connection to its configured
database. Network connectivity from the server to the database is confirmed. Which
configuration should be examined first?
A. The
application's browser-compatible CSS and responsive layout settings B. The
client device's local browser storage and rendering preferences C. The HTML5
document structure used by the application's user interface D. The server's
configured database datasource and connection parameters
Answer: D
Rationale: Once network connectivity has been
confirmed, the application server's datasource configuration and associated
connection parameters become a logical first point of investigation. These may
include the database URL, credentials, driver configuration, connection-pool
settings, and resource naming expected by the application. CSS, HTML5
structure, and browser storage cannot explain why the server-side application
cannot establish its database connection. Starting with the component directly
responsible for database connectivity also follows an efficient layered
troubleshooting approach.
15. A development team receives a requirement
to introduce a new citizen-notification feature. The requirement is
sufficiently understood, but the team wants to validate the interaction flow
with users before investing heavily in implementation. Which approach is most
appropriate?
A. Build a
complete production implementation before obtaining user feedback B. Create a
prototype representing the proposed interactions for early evaluation C.
Deploy the unfinished functionality directly to all government users D.
Postpone user involvement until system maintenance begins after deployment
Answer: B
Rationale: A prototype provides an early
representation of proposed functionality and interaction flows that users and
stakeholders can evaluate before substantial development effort is committed.
This can expose misunderstandings in requirements and usability expectations at
relatively low cost. Building the complete system first delays feedback,
deploying unfinished functionality to production introduces unnecessary
operational and user risk, and waiting until maintenance is too late to
validate fundamental interaction assumptions. Therefore, prototyping is the
most appropriate approach when early validation is the objective.
16. A Java application frequently checks
whether a unique application identifier already exists among a large collection
of identifiers. The primary operation is membership testing, and duplicate
identifiers should not be stored. Which collection is generally the most
appropriate?
A. ArrayList
because sequential storage provides direct collection management B. LinkedList
because linked nodes efficiently represent unique identifiers C. HashSet because
it is designed for unique elements and efficient average lookup D. Stack
because membership checks naturally follow last-in-first-out behavior
Answer: C
Rationale: HashSet is designed to store unique
elements and provides efficient average-case membership testing based on
hashing, making it well suited to a large collection where duplicate
identifiers are not permitted. ArrayList and LinkedList allow duplicates and
generally require linear searching for membership unless additional structures
are used, while Stack is intended for LIFO access rather than efficient
uniqueness checking. Actual performance also depends on proper hashCode() and
equals() implementations for the stored object type. Therefore, HashSet is the
most appropriate general choice.
17. A government mobile application needs to
access protected backend APIs on behalf of an authenticated user. The API
should verify the caller's identity and authorization without requiring the
mobile application to transmit the user's password with every request. Which
approach is most appropriate?
A. Store the
user's password locally and resend it with each API request B. Use a suitable
token-based authentication mechanism with controlled token lifetime C. Place
the user's credentials inside the application's source code for reuse D. Allow
all API requests from the mobile application without authentication checks
Answer: B
Rationale: Token-based authentication allows an
authenticated client to obtain a credential that can subsequently be presented
when accessing protected APIs, avoiding repeated transmission of the user's
password. Proper implementation requires secure token storage, appropriate
expiration, transport protection, authorization checks, and mechanisms for
revocation or renewal where applicable. Storing or embedding passwords creates
serious security risks, while removing authentication controls exposes
protected services. Therefore, a properly implemented token-based mechanism is
the appropriate approach.
18. A team reports that an application has
passed all planned functional tests, but defects are repeatedly discovered
after deployment because developers modify existing functionality without
rerunning previously successful tests. Which practice would most directly
address this problem?
A. Regression
testing after changes to verify previously working functionality B. Increasing
the number of database tables used by the application C. Replacing functional
requirements with performance requirements D. Limiting testing to the newest
feature introduced in each release
Answer: A
Rationale: Regression testing verifies that existing
functionality continues to work after modifications, fixes, integrations, or
other changes. It is particularly important in systems where new changes can
unintentionally affect previously functioning components. Adding database
tables has no direct relationship to this testing problem, replacing functional
requirements does not address defects, and testing only the newest feature
leaves previously implemented functionality exposed to regressions. Automated
regression suites can make repeated regression testing especially efficient in
continuously changing systems.
19. An e-government portal must provide one
web application that remains usable across desktop computers, tablets, and
smartphones with substantially different viewport widths. The design team wants
the same content and functionality to adapt without creating a separate page
for each device category. Which approach is most appropriate?
A. Use
fixed-width tables and allow users to scroll horizontally on smaller screens B.
Use fixed desktop layouts and rely primarily on browser viewport scaling C.
Create separate fixed-width templates for each major device category D. Use
responsive layouts with flexible dimensions and breakpoint-based CSS rules
Answer: D
Rationale: Responsive web design allows a single web
application to adapt its layout and presentation to different viewport sizes
through flexible dimensions, responsive media, and CSS rules such as media
queries and breakpoints. This approach preserves the same underlying
functionality while adjusting how content is presented on different devices.
Browser scaling does not provide reliable control over usability, separate
device-specific templates increase maintenance complexity, and horizontal
scrolling is generally undesirable for normal responsive interfaces. Therefore,
a responsive layout with flexible dimensions and breakpoint-based CSS is the
most appropriate solution.
20. After a new version of a government
application is deployed, users report that some requests now fail with HTTP 500
responses. The application server is running and basic connectivity tests
succeed. What should the support team do first?
A. Immediately
replace the production server hardware with a newer machine B. Review
application logs and correlate failures with the new deployment C. Disable all
application security controls to eliminate possible restrictions D. Reinstall
the operating system before investigating the application behavior
Answer: B
Rationale: Application logs provide evidence about
exceptions, failed operations, configuration problems, and other server-side
conditions that can produce HTTP 500 responses. Correlating timestamps, request
information, stack traces, and deployment changes provides a disciplined
starting point for diagnosis. Replacing hardware or reinstalling the operating
system without evidence is unnecessarily disruptive, while disabling security
controls can create additional risk and may not address the actual cause.
Production troubleshooting should begin with observable evidence and
progressively narrow the fault domain.
21. In a distributed government system, the
application-service component submits a request to a notification service. The
notification service may occasionally be unavailable, but the
application-service component should not remain blocked indefinitely waiting
for the notification operation to complete. Which approach best addresses
this requirement?
A. Increase the
network timeout to several minutes for every notification request B. Execute
notification processing repeatedly within the user's browser session C. Remove
all communication between the application and notification components D. Use
asynchronous messaging with controlled retries and failure handling
Answer: D
Rationale: Asynchronous messaging allows the
application service to submit a notification request without remaining
synchronously blocked while another service processes it. A queue or message
broker can buffer work during temporary outages, while controlled retries,
dead-letter handling, monitoring, and idempotency can improve reliability.
Increasing synchronous timeouts can actually cause resources to remain occupied
for longer, removing communication defeats the business requirement, and
browser-side processing is inappropriate for a trusted backend notification
workflow. Thus, asynchronous messaging is the strongest architectural response.
22. A Java application uses custom Citizen
objects as keys in a HashMap. Developers override equals() but do not provide a
consistent hashCode() implementation. The map sometimes fails to retrieve a
value using a logically equivalent object. What is the most likely
explanation?
A. HashMap
requires objects to be immutable in every application scenario B. Equal
objects must produce compatible hash codes for hash-based collections C.
equals() is ignored by HashMap whenever custom objects are used as keys D.
Java automatically converts custom objects into strings before performing
lookup
Answer: B
Rationale: Java's contract requires that whenever
two objects are considered equal by equals(), they must return the same hash
code. Hash-based collections such as HashMap use the hash code to identify the
appropriate bucket and then use equality to distinguish matching keys. If
logically equal objects produce different hash codes, the lookup can occur in a
different bucket and fail to find the existing entry. Objects do not need to be
universally immutable for this rule to apply, although mutable fields involved
in equality and hashing can create additional problems. Therefore, maintaining
a consistent equals()/hashCode() contract is essential.
23. An existing government API is already
consumed by several independently developed systems. A proposed change would
rename a response field that those systems currently use. Before implementing
the change, what should the development team most appropriately
consider?
A. Replace the
field immediately because internal API structures can change without consumer
coordination B. Remove the existing endpoint immediately and require every
consumer to discover the replacement C.
Modify the database index first because API field names normally depend on
indexing strategy D. Assess backward compatibility and determine how existing
consumers will be migrated or supported
Answer: D
Rationale: Renaming a field in an API response can
break existing consumers that depend on the current contract, even when the
underlying database and business logic remain unchanged. The team should
therefore assess backward compatibility, identify affected consumers, determine
whether a compatible transition is possible, and establish an appropriate
migration or versioning strategy before removing or changing the existing
contract. Database indexes do not determine API field names, and immediately
replacing or removing a widely consumed interface can cause avoidable service
disruption. Careful API contract management is therefore the appropriate
approach.
24. A database for a government service
stores department information separately from applications. Each application
references its department using a foreign key, but the same department address
is also stored redundantly in every application record. The department address
changes occasionally, creating inconsistent records when some applications are
not updated. Which design change would best improve data integrity?
A. Add another
copy of the department address to each application for verification purposes B.
Replace the foreign key with a duplicated department name in every application
record C. Maintain the department address in the department relation and
retrieve it through the relationship D. Create a separate address column in
each application table and update it through application code
Answer: C
Rationale: The department address is an attribute of
the department rather than an independent attribute of each application.
Maintaining one authoritative address in the department relation and
referencing the department from applications eliminates unnecessary duplication
and reduces update anomalies. Duplicating the address in additional application
columns would increase the possibility of inconsistent values, while replacing
the foreign key with a department name weakens referential integrity and can
introduce naming inconsistencies. Updating duplicated values through
application code also leaves the system vulnerable to synchronization failures.
Therefore, maintaining the address in the department relation is the strongest
design.
25. An e-government web application is
deployed on two application servers behind a load balancer. During periods of
high traffic, one server becomes significantly more loaded than the other even
though both are configured to receive requests. Investigation shows that many
users maintain server-side session state on the first server. Which solution most
appropriately addresses the architectural problem?
A. Increase the
browser's cache size so users send fewer session requests B. Configure
session-aware routing or move session state to a shared suitable store C.
Disable all user sessions so every request becomes completely independent D.
Increase database backup frequency to distribute application-server workload
Answer: B
Rationale: Server-local session state can create
uneven load because users whose sessions reside on one server may need
subsequent requests routed back to that same server, limiting the load
balancer's ability to distribute traffic evenly. Session-aware routing, commonly
called sticky sessions, can preserve this behavior, but a more scalable design
is often to externalize session state into a suitable shared store so requests
can be handled by multiple application servers. Browser caching does not solve
server-side session affinity, disabling sessions may break required application
behavior, and database backup frequency is unrelated to application-server load
distribution. Therefore, session-aware routing or centralized session
management is the appropriate solution.
26. A Java/JEE application is designed using
separate presentation, business, and persistence components. A developer
proposes allowing the presentation layer to directly execute SQL queries
whenever it needs data. Which design concern is most significant with
this approach?
A. It prevents
the database from supporting concurrent transactions effectively B. It makes
HTML rendering impossible when database records are returned C. It guarantees
that every database query will execute more slowly D. It creates tighter
coupling between presentation and persistence responsibilities
Answer: D
Rationale: Allowing presentation components to
directly execute SQL creates tight coupling between the user-interface layer
and persistence concerns. This makes the application harder to maintain because
changes to database structures or persistence mechanisms can propagate into
presentation code, while business rules may become scattered across
inappropriate layers. A properly layered design generally separates
presentation, business logic, and persistence responsibilities through
well-defined interfaces or services. The approach does not inherently prevent
database concurrency, make HTML rendering impossible, or guarantee slower
queries. The primary architectural problem is therefore inappropriate coupling
between layers.
27. An application receives a JSON request
containing a user's nationalId and serviceCode. The developer validates that
both fields are present but does not verify whether the authenticated user is
permitted to access the specified service. Which security control is missing
most directly?
A. Authorization
checking after authentication B. Character encoding before JSON serialization C.
Database indexing for frequently queried identifiers D. Compression of the
request before server processing
Answer: A
Rationale: Authentication establishes who the user
is, whereas authorization determines what that authenticated user is permitted
to access or perform. Merely confirming that nationalId and serviceCode are
present does not establish whether the authenticated user has permission to
access the requested service. Proper authorization should be enforced
server-side based on the user's identity, role, ownership, or other applicable
access-control rules. Encoding, indexing, and compression may have legitimate
purposes but do not address the missing permission check.
28. A PHP application processes a large CSV
file containing government-service records. The current implementation reads
the entire file into memory before processing it, and the application fails
when the file becomes sufficiently large. Which change is most appropriate?
A. Increase the
browser's maximum upload display size B. Convert every CSV record into an HTML
table before processing C. Process the file incrementally rather than loading
it entirely into memory D. Increase the database connection timeout before
reading the file
Answer: C
Rationale: Incremental or streaming processing
allows the application to handle records progressively without retaining the
entire file in memory. This reduces peak memory consumption and allows
substantially larger files to be processed within the application's available
resources. Increasing browser limits does not address server-side memory
consumption, converting records into HTML increases processing overhead, and
database connection timeout settings are unrelated to the amount of memory
consumed while reading the CSV. Therefore, incremental processing is the most
appropriate solution.
29. A Java application exposes a method that
accepts a mutable List from another component and stores the same list
reference internally. The caller subsequently modifies the list, unexpectedly
changing the application's internal state. Which design improvement best
prevents this problem?
A. Replace the
list with a primitive integer value B. Create an appropriate defensive copy
before retaining the collection C. Make every method containing the list
declaration static D. Catch exceptions whenever the caller modifies the
collection
Answer: B
Rationale: A defensive copy prevents external code
from retaining a reference to the same mutable collection used internally. By
copying the collection when ownership is transferred, subsequent modifications
by the caller do not unexpectedly alter the receiving object's state. Making
methods static does not address object ownership, exceptions do not occur
simply because a caller changes a shared collection, and replacing the
collection with an integer would not satisfy the underlying data requirement.
Defensive copying is therefore the appropriate encapsulation technique when
mutable state must not be externally controlled.
30. A government portal allows users to upload
supporting documents. The application checks only the filename extension and
accepts a file named document.pdf. The development team wants to reduce the
risk of malicious uploads. Which control provides the strongest improvement?
A. Increase the
maximum filename length allowed by the application B. Allow uploads only
during normal government office hours C. Store every uploaded file using the
original client-provided filename D. Validate file type and content, restrict
storage, and prevent executable interpretation
Answer: D
Rationale: File-upload security requires multiple
controls because a filename extension alone cannot reliably establish the
nature or safety of a file. The application should validate the actual file
type and relevant content, impose size and type restrictions, generate safe
server-side filenames where appropriate, store files outside executable web
paths when possible, and ensure uploaded content cannot be interpreted as
executable code. Increasing filename length, restricting upload times, or
preserving client-provided filenames does not adequately address malicious
uploads. A defense-in-depth approach is therefore required.
📘 Get the Full Aptitude Test Questions PDF through your Gmail (Questions 1–150)
You’ve just accessed the first 30 questions. The full set of 150 expertly prepared aptitude test questions for ICT Officer II (Application programmer) – e-GA., Is available, pay, and get access.
To get access to the full PDF, please make a payment of Tsh 10,000 to the LIPA numbers below:
After payment, please send a text message to notify us of your payment:
⚠️ Important Notice
- The PDF will be watermarked with your name and phone number and protected for personal use only.
- Redistribution, sharing, screenshotting, or copying the contents is strictly prohibited. When you share unlawfully, your name and phone number are visible and easy to trace as you leaked a document to other third parties.
- Legal action may be taken against the misuse of this material.
Thank you for supporting quality content. Best of luck in your interview preparation!
 – e-GA.){kind=link}
0 Comments
PLACE YOUR COMMENT HERE
WARNING: DO NOT USE ABUSIVE LANGUAGE BECAUSE IT IS AGAINST THE LAW.
THE COMMENTS OF OUR READERS IS NOT OUR RESPONSIBILITY.