Django Framework Practice Exam

Question 1 Django Framework

What is JsonResponse used for?

@condition(etag_func=..., last_modified_func=...) enables HTTP conditional GETs. If the client's If-None-Match or If-Modified-Since matches, Django returns 304 Not Modified, saving bandwidth. prefetch_related() performs separate queries for each relationship and joins them in Python. Ideal for ManyToMany and reverse FK relations:
authors = Author.objects.prefetch_related('articles')
Unlike select_related(), it works with any relationship type but uses multiple queries. from django.http import JsonResponse
return JsonResponse({'ok': True, 'count': 5})
It sets Content-Type: application/json and serializes the dict with json.dumps. Pass safe=False for non-dict JSON (e.g. lists). MESSAGE_STORAGE = 'django.contrib.messages.storage.session.SessionStorage' by default. It uses the user's session, so SessionMiddleware must be enabled. Other options include cookie-based storage.

Question 2 Django Framework

What is the default Django database backend?

A function-based view is a Python function that takes an HttpRequest and returns an HttpResponse:

def hello(request):
  return HttpResponse("Hello, World!")

Subclass AbstractUser or AbstractBaseUser and set AUTH_USER_MODEL in settings:

class CustomUser(AbstractUser):
  phone = models.CharField(max_length=15, blank=True)

In settings.py:
AUTH_USER_MODEL = 'myapp.CustomUser'
Do this before the first migration. By default, Django uses SQLite via the django.db.backends.sqlite3 engine. For production, common choices are postgresql, mysql, or oracle via the django.db.backends.* module. ALLOWED_HOSTS is a list of valid host/domain names the site can serve. Django rejects requests with an HTTP 400 if the Host header is not in this list, preventing HTTP Host header attacks.

Question 3 Django Framework

How do you configure a PostgreSQL database in Django?

The project-level urls.py is the root URLconf. It usually contains urlpatterns that delegate to app-level urls.py files via include().
Example:
path('blog/', include('blog.urls')) settings.py is the central configuration module: INSTALLED_APPS, MIDDLEWARE, DATABASES, TEMPLATES, STATIC_URL, STATIC_ROOT, MEDIA_URL, MEDIA_ROOT, ALLOWED_HOSTS, SECRET_KEY, DEBUG, USE_TZ, and auth/password validators. In settings.py:

DATABASES = {
  'default': {
    'ENGINE': 'django.db.backends.postgresql',
    'NAME': 'mydb',
    'USER': 'mydbuser',
    'PASSWORD': 'secret',
    'HOST': 'localhost',
    'PORT': '5432',
  }
}

manage.py is a thin wrapper around django-admin that sets the DJANGO_SETTINGS_MODULE to the project's settings.py. It is the recommended entry point for project-level commands like migrate, runserver, and shell.

Question 4 Django Framework

How do you bulk create objects in Django?

class ArticleList(ListView):
  paginate_by = 20

This enables pagination. The view passes page_obj and paginator to the template, and reads the page from the ?page= query parameter. Use bulk_create():

Article.objects.bulk_create([
  Article(title='A'), Article(title='B')
])

It issues a single INSERT and skips per-row save() signals. MESSAGE_STORAGE = 'django.contrib.messages.storage.session.SessionStorage' by default. It uses the user's session, so SessionMiddleware must be enabled. Other options include cookie-based storage. filter() returns a QuerySet (zero or more objects), while get() returns a single object or raises exceptions:

DoesNotExist – if no match is found
MultipleObjectsReturned – if more than one match exists

Question 5 Django Framework

What is the 500 error handler?

Inside {% for item in items %} the forloop object exposes:

forloop.counter – 1-indexed count
forloop.counter0 – 0-indexed count
forloop.first / forloop.last – booleans
forloop.parentloop – outer loop context

Specify the migration name to revert to:
python manage.py migrate myapp 0003_previous
To undo all migrations for an app:
python manage.py migrate myapp zero By default, Django uses SQLite via the django.db.backends.sqlite3 engine. For production, common choices are postgresql, mysql, or oracle via the django.db.backends.* module. Define handler500 = 'myapp.views.custom_500' in the root urls.py. The view receives request and returns an HttpResponse. Avoid leaking stack traces — Django only shows them when DEBUG=True.

Question 6 Django Framework

How do you delete many records at once?

Django uses LANGUAGE_CODE by default. django.middleware.locale.LocaleMiddleware selects language from Accept-Language, the session, or a cookie (LANGUAGE_COOKIE_NAME). Set USE_I18N = True in settings. Use the queryset delete() method:
Article.objects.filter(created__year=2024).delete()
It returns a tuple (total_deleted, {model_label: count}). In a view, pass a dictionary to render():

def my_view(request):
  context = {'articles': Article.objects.all()}
  return render(request, 'my_template.html', context)

Variables are then accessible as {{ articles }} in the template. from django.core.cache import cache
cache.set('key', value, timeout=300)
cache.get('key')
cache.get_or_set('key', default, 300)
cache.delete('key')
The default timeout is in seconds; None caches forever.

Question 7 Django Framework

How do you retrieve all objects from a model?

Defining __str__(self) returns a human-readable string representation of a model instance. The Django admin and shell display this value, and it is used by default in ModelChoiceField. Use the all() method on the model's manager:
all_articles = Article.objects.all()
This returns a QuerySet containing all rows in the corresponding table. Django's template engine uses HTML files with special syntax:

{{ variable }} – output a variable
{% tag %} – template tags for logic (if, for, block)
{{ value|filter }} – apply filters like date, length, lower

Templates are stored in the app's templates/ directory. A project is the entire Django installation (settings, root URLconf). An app is a self-contained Python package that handles a feature (blog, accounts, polls). A project contains many apps; an app can be reused across projects.

Question 8 Django Framework

What is the never_cache decorator?

Override get_queryset():

class PublishedList(ListView):
  def get_queryset(self):
    return Article.objects.filter(status='published')

This is preferred over setting queryset directly when you need request-aware filtering. on_delete specifies behavior when the referenced object is deleted. Options include:

models.CASCADE – delete dependents
models.PROTECT – block deletion
models.SET_NULL – set FK to NULL (requires null=True)
models.SET_DEFAULT – set to default value
models.DO_NOTHING – no action (may raise IntegrityError)

Signals allow decoupled components to be notified when certain actions occur. Common signals:

pre_save / post_save – before/after model save
pre_delete / post_delete – before/after model delete
request_started / request_finished

Connect with @receiver(post_save, sender=MyModel). from django.views.decorators.cache import never_cache ensures the response is not cached by browsers or intermediaries:

@never_cache
def dashboard(request): ...

Useful for personalized or sensitive pages.

Question 9 Django Framework

What is the JSONField in Django?

models.JSONField() stores arbitrary JSON. On Postgres it uses jsonb; on MySQL 5.7+ and SQLite 3.38+ it uses native JSON. Query with key lookups:
Article.objects.filter(metadata__tags__contains=['python']) filter() returns a QuerySet (zero or more objects), while get() returns a single object or raises exceptions:

DoesNotExist – if no match is found
MultipleObjectsReturned – if more than one match exists

@require_http_methods(['GET', 'POST']) rejects any other method with a 405 Method Not Allowed. @require_GET, @require_POST, and @require_safe are shortcuts for ['GET', 'HEAD'] and ['POST']. Middleware is a framework of hooks that processes requests and responses globally. Each middleware is a class with methods like __call__, process_view, and process_exception. They are defined in the MIDDLEWARE setting and executed in order for requests and in reverse for responses.

Question 10 Django Framework

What is a database transaction in Django?

Django provides multiple validation layers:

Field-level – built-in validators and clean_<fieldname>() methods
Form-level – override clean() for cross-field validation
Model-level – model validators and the clean() method on models

Errors are stored in form.errors. django.middleware.http.ConditionalGetMiddleware handles ETag and Last-Modified automatically. It returns 304 Not Modified when the client already has the latest version, saving bandwidth. A transaction groups multiple SQL operations so they commit or roll back atomically. Use transaction.atomic:

from django.db import transaction
with transaction.atomic():
  Item.objects.create(...)
  Log.objects.create(...)

id = models.UUIDField(primary_key=True, default=uuid.uuid4, editable=False)
Stores a 128-bit UUID. Pair with a URL converter <uuid:id> for type-safe routing. Useful when you don't want sequential, guessable primary keys.

Question 11 Django Framework

How do you set the SECRET_KEY safely?

@condition(etag_func=..., last_modified_func=...) enables HTTP conditional GETs. If the client's If-None-Match or If-Modified-Since matches, Django returns 304 Not Modified, saving bandwidth. update_or_create(defaults=None, **kwargs) either updates an existing record matching kwargs with defaults, or creates a new one. Returns (object, created). SECRET_KEY should be loaded from an environment variable:
SECRET_KEY = os.environ['DJANGO_SECRET_KEY']
It is used for signing cookies, password reset tokens, CSRF, and crypto signing. Never commit it to version control. A ModelForm automatically creates form fields from a model:

class ArticleForm(forms.ModelForm):
  class Meta:
    model = Article
    fields = ['title', 'body', 'status']

Calling form.save() directly creates or updates the database record.

Question 12 Django Framework

How do you write a Django management command that accepts arguments?

Use add_arguments(self, parser):

def add_arguments(self, parser):
  parser.add_argument('name', type=str)
  parser.add_argument('--count', type=int, default=1)

Access via self.kwargs['name'] in handle(). For requests, Django runs middleware top-to-bottom in the MIDDLEWARE list (each calling get_response). For responses, it unwinds in reverse order. Place SecurityMiddleware and SessionMiddleware early so they apply before view logic. select_related() performs a SQL JOIN to fetch related objects in a single query, reducing database hits for ForeignKey and OneToOneField relationships:
articles = Article.objects.select_related('author').all()
Use prefetch_related() instead for ManyToManyField and reverse relations. Django extends Python's unittest with TestCase:

from django.test import TestCase
class ArticleTests(TestCase):
  def setUp(self):
    Article.objects.create(title='Test')
  def test_article_str(self):
    a = Article.objects.get(id=1)
    self.assertEqual(str(a), 'Test')

Run with python manage.py test.

Question 13 Django Framework

How do you create a custom template filter?

id = models.UUIDField(primary_key=True, default=uuid.uuid4, editable=False)
Stores a 128-bit UUID. Pair with a URL converter <uuid:id> for type-safe routing. Useful when you don't want sequential, guessable primary keys. Use filter() and exclude():
Article.objects.filter(status='published')
Article.objects.exclude(status='draft')
You can chain lookups like title__icontains='django', date__gte=some_date, and author__name='Alice'. A Manager is the interface for database query operations. The default is objects. Create custom managers for reusable queries:

class PublishedManager(models.Manager):
  def get_queryset(self):
    return super().get_queryset().filter(status='published')

Assign with published = PublishedManager() in your model. Register a Python function in a templatetags/ module:

from django import template
register = template.Library()
@register.filter
def shout(value):
  return value.upper() + '!'

Load with {% load myfilters %} in templates.

Question 14 Django Framework

What is prefetch_related() in Django?

django.core.mail.send_mail(subject, message, from_email, recipient_list) sends a single email via the SMTP backend configured by EMAIL_BACKEND, EMAIL_HOST, EMAIL_PORT, EMAIL_HOST_USER, and EMAIL_HOST_PASSWORD. A transaction groups multiple SQL operations so they commit or roll back atomically. Use transaction.atomic:

from django.db import transaction
with transaction.atomic():
  Item.objects.create(...)
  Log.objects.create(...)

prefetch_related() performs separate queries for each relationship and joins them in Python. Ideal for ManyToMany and reverse FK relations:
authors = Author.objects.prefetch_related('articles')
Unlike select_related(), it works with any relationship type but uses multiple queries.

class ArticleList(ListView):
  paginate_by = 20

This enables pagination. The view passes page_obj and paginator to the template, and reads the page from the ?page= query parameter.

Question 15 Django Framework

How do you cache a queryset in Django?

Functions in TEMPLATES.OPTIONS.context_processors that inject variables into every template. Built-ins include django.template.context_processors.request (adds request), auth (adds user and perms), and messages. A through model is an explicit intermediate model that stores extra fields on a many-to-many relationship, such as joined_at or role. It must contain two ForeignKeys to the participating models. Key built-in middleware:

SecurityMiddleware – HTTPS redirects, HSTS headers
SessionMiddleware – session support
CommonMiddleware – URL rewriting, content length
CsrfViewMiddleware – CSRF protection
AuthenticationMiddleware – attaches request.user
MessageMiddleware – flash messages

Use cache.get_or_set with a string key:

articles = cache.get_or_set(
  'articles:published',
  lambda: list(Article.objects.filter(status='published')),
  300,
)

Question 16 Django Framework

What is DEBUG mode and why should it be off in production?

CreateView (from django.views.generic.edit) handles the "create new object" flow: GET shows an empty form; POST validates and saves, then redirects to success_url or the new object's absolute URL via get_absolute_url(). prefetch_related() performs separate queries for each relationship and joins them in Python. Ideal for ManyToMany and reverse FK relations:
authors = Author.objects.prefetch_related('articles')
Unlike select_related(), it works with any relationship type but uses multiple queries. DEBUG = True enables detailed tracebacks and the technical 500 page. It must be False in production because it leaks settings, environment variables, and query information to anyone who triggers an error. Migrations are version-controlled changes to your database schema. Key commands:
python manage.py makemigrations – creates migration files from model changes
python manage.py migrate – applies migrations to the database
They are stored as Python files in each app's migrations/ directory.

Question 17 Django Framework

What are URL path converters in Django?

django.contrib.auth.models.Group lets you bundle permissions and assign them to multiple users at once. A user in a group inherits the group's permissions automatically. FileResponse streams a file-like object to the client without loading it fully into memory:
return FileResponse(open('big.pdf', 'rb'))
It is preferred for large downloads. @require_http_methods(['GET', 'POST']) rejects any other method with a 405 Method Not Allowed. @require_GET, @require_POST, and @require_safe are shortcuts for ['GET', 'HEAD'] and ['POST']. Path converters capture parts of the URL as typed parameters:

<int:pk> – matches integers
<str:slug> – matches non-empty strings (excluding /)
<slug:slug> – matches slugs (letters, numbers, hyphens, underscores)
<uuid:id> – matches UUIDs

Question 18 Django Framework

How do you write tests in Django?

Template inheritance lets you define a base template with {% block %} placeholders that child templates override:

{% extends "base.html" %}
{% block content %}
  <h1>My Page</h1>
{% endblock %}

This promotes DRY (Don't Repeat Yourself) design. filter() returns a QuerySet (zero or more objects), while get() returns a single object or raises exceptions:

DoesNotExist – if no match is found
MultipleObjectsReturned – if more than one match exists

created = models.DateTimeField(auto_now_add=True) sets the field once on creation. updated = models.DateTimeField(auto_now=True) updates it on every save. Both default to False for the parameter. Django extends Python's unittest with TestCase:

from django.test import TestCase
class ArticleTests(TestCase):
  def setUp(self):
    Article.objects.create(title='Test')
  def test_article_str(self):
    a = Article.objects.get(id=1)
    self.assertEqual(str(a), 'Test')

Run with python manage.py test.

Question 19 Django Framework

What is a Django ModelForm?

A ModelForm automatically creates form fields from a model:

class ArticleForm(forms.ModelForm):
  class Meta:
    model = Article
    fields = ['title', 'body', 'status']

Calling form.save() directly creates or updates the database record. Use filter() and exclude():
Article.objects.filter(status='published')
Article.objects.exclude(status='draft')
You can chain lookups like title__icontains='django', date__gte=some_date, and author__name='Alice'. Django includes built-in protection against:

CSRF – token-based form protection
XSS – automatic template escaping
SQL Injection – parameterized ORM queries
Clickjacking – X-Frame-Options middleware
HTTPS – SecurityMiddleware, HSTS support
Password hashing – PBKDF2 by default

class ArticleList(ListView):
  paginate_by = 20

This enables pagination. The view passes page_obj and paginator to the template, and reads the page from the ?page= query parameter.

Question 20 Django Framework

What is the difference between count() and len(queryset)?

queryset.count() issues SELECT COUNT(*) in the database. len(queryset) forces evaluation of the full queryset and counts in Python. Always use .count() for large tables. Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It follows the MTV (Model-Template-View) architectural pattern and includes built-in features like an ORM, admin interface, and authentication system. CreateView (from django.views.generic.edit) handles the "create new object" flow: GET shows an empty form; POST validates and saves, then redirects to success_url or the new object's absolute URL via get_absolute_url().

class ArticleList(ListView):
  paginate_by = 20

This enables pagination. The view passes page_obj and paginator to the template, and reads the page from the ?page= query parameter.

Question 21 Django Framework

What is the Django admin site?

Use the queryset update() method:
Article.objects.filter(status='draft').update(status='published')
This runs a single UPDATE SQL statement and bypasses save() signals. values() returns dictionaries of field values; values_list() returns tuples. With flat=True and a single field, values_list() returns a flat list:
Article.objects.values_list('id', flat=True) A OneToOneField represents a strict 1:1 link between two models. Common use: extending the User model with a Profile:
user = models.OneToOneField(User, on_delete=models.CASCADE)
It is implemented as a UNIQUE FK. The Django admin is an auto-generated web interface for managing your data. Register models in admin.py:

from django.contrib import admin
from .models import Article
admin.site.register(Article)

Access it at /admin/ after creating a superuser with python manage.py createsuperuser.

Question 22 Django Framework

How do you update many records at once?

models.JSONField() stores arbitrary JSON. On Postgres it uses jsonb; on MySQL 5.7+ and SQLite 3.38+ it uses native JSON. Query with key lookups:
Article.objects.filter(metadata__tags__contains=['python']) Use the queryset update() method:
Article.objects.filter(status='draft').update(status='published')
This runs a single UPDATE SQL statement and bypasses save() signals. ALLOWED_HOSTS = ['learncoachassist.com', 'www.learncoachassist.com'] restricts which Host headers Django accepts. In DEBUG=True it defaults to ['localhost', '127.0.0.1', '[::1]']. Serializer requires you to define each field manually and implement create() and update() methods.
ModelSerializer automatically generates fields from the model and provides default create() and update() implementations. It also auto-generates validators based on model constraints.

Question 23 Django Framework

What are the @cache_page and cache_control decorators?

@cache_page(60 * 15) caches the full view response for 15 minutes. @cache_control(public=True, max_age=3600) sets Cache-Control headers without using Django's cache backend. Use the all() method on the model's manager:
all_articles = Article.objects.all()
This returns a QuerySet containing all rows in the corresponding table. Filters transform template variables:

{{ name|lower }} – lowercase
{{ text|truncatewords:20 }} – truncate
{{ value|default:'N/A' }} – fallback value
{{ html|safe }} – mark as safe (no escaping)
{{ date|date:'Y-m-d' }} – format date

You can chain them: {{ value|lower|truncatechars:30 }} Serializer requires you to define each field manually and implement create() and update() methods.
ModelSerializer automatically generates fields from the model and provides default create() and update() implementations. It also auto-generates validators based on model constraints.

Question 24 Django Framework

How do you configure the cache backend?

UpdateView fetches an existing object by pk from the URL, populates a ModelForm, and on POST saves the changes. Override form_valid() to add side effects like setting updated_by. In settings.py:

CACHES = {
  'default': {
    'BACKEND': 'django.core.cache.backends.redis.RedisCache',
    'LOCATION': 'redis://127.0.0.1:6379/1',
  }
}

Other backends include locmem, db, filebased, and memcached. gettext_lazy returns a lazy proxy that translates when the string is rendered (e.g. in templates), avoiding translation during import. gettext translates immediately. Use gettext_lazy for model fields, app config, and module-level strings. Override ready() in your AppConfig to perform import-time setup, such as registering signals, connecting checks, or initializing third-party clients. It runs once when the app registry is populated.

Question 25 Django Framework

What is the include template tag?

Use the all() method on the model's manager:
all_articles = Article.objects.all()
This returns a QuerySet containing all rows in the corresponding table. Functions in TEMPLATES.OPTIONS.context_processors that inject variables into every template. Built-ins include django.template.context_processors.request (adds request), auth (adds user and perms), and messages. {% include 'partials/card.html' with article=obj %} renders another template inline, optionally passing context. It is the recommended way to share small reusable snippets without inheriting from a base template. In settings.py:

CACHES = {
  'default': {
    'BACKEND': 'django.core.cache.backends.redis.RedisCache',
    'LOCATION': 'redis://127.0.0.1:6379/1',
  }
}

Other backends include locmem, db, filebased, and memcached.

Question 26 Django Framework

What is the messages framework?

apps.py contains the AppConfig subclass for the app. It registers metadata like name and verbose_name and can run startup code in ready() (e.g. registering signals). django.contrib.messages is a one-time notification system. In views:
messages.success(request, 'Saved!')
In templates: {% if messages %}{% for m in messages %}<div class="alert">{{ m }}</div>{% endfor %}{% endif %}
Messages are stored in the session or cookie and shown once. from django.views.decorators.cache import never_cache ensures the response is not cached by browsers or intermediaries:

@never_cache
def dashboard(request): ...

Useful for personalized or sensitive pages. In settings.py:

DATABASES = {
  'default': {
    'ENGINE': 'django.db.backends.postgresql',
    'NAME': 'mydb',
    'USER': 'mydbuser',
    'PASSWORD': 'secret',
    'HOST': 'localhost',
    'PORT': '5432',
  }
}

Question 27 Django Framework

How does get_object_or_404() differ from get()?

get_object_or_404(Article, pk=1) returns the object or raises Http404. Article.objects.get(pk=1) raises DoesNotExist. The shortcut is idiomatic in views because Django's 404 handler renders a friendly page. MTV stands for Model-Template-View:

Model – defines data structure and database schema
Template – handles the presentation layer (HTML)
View – contains business logic and returns responses

null=True allows NULL at the database column level; blank=True allows the field to be empty in forms. Common pattern:
description = models.TextField(null=True, blank=True)
For string-based fields, prefer blank=True alone (empty string instead of NULL). request.user.is_authenticated is True for logged-in users and False for AnonymousUser. is_anonymous is the opposite. Always check is_authenticated in views; AnonymousUser exists for symmetry, not for security checks.

Question 28 Django Framework

What is the purpose of asgi.py in a Django project?

Specify the migration name to revert to:
python manage.py migrate myapp 0003_previous
To undo all migrations for an app:
python manage.py migrate myapp zero asgi.py exposes an ASGI-compatible callable for servers like Daphne or Uvicorn. It enables async views, WebSockets, and long-lived connections (e.g. Django Channels). apps.py contains the AppConfig subclass for the app. It registers metadata like name and verbose_name and can run startup code in ready() (e.g. registering signals). Configure in settings.py:

MEDIA_URL = '/media/'
MEDIA_ROOT = BASE_DIR / 'media'

Use FileField or ImageField in models. In development, add to urls.py:
urlpatterns += static(settings.MEDIA_URL, document_root=settings.MEDIA_ROOT)

Question 29 Django Framework

How do you create a new Django project?

Signals allow decoupled components to be notified when certain actions occur. Common signals:

pre_save / post_save – before/after model save
pre_delete / post_delete – before/after model delete
request_started / request_finished

Connect with @receiver(post_save, sender=MyModel). django.middleware.http.ConditionalGetMiddleware handles ETag and Last-Modified automatically. It returns 304 Not Modified when the client already has the latest version, saving bandwidth. queryset.exists() returns True/False by issuing a fast SELECT 1 ... LIMIT 1. It is cheaper than len(queryset) > 0 or queryset.count() > 0 when you only need to know whether any row matches. Use the command:
django-admin startproject myproject
This generates the project directory with settings.py, urls.py, wsgi.py, asgi.py, and manage.py.

Question 30 Django Framework

What are some built-in Django middleware classes?

Key built-in middleware:

SecurityMiddleware – HTTPS redirects, HSTS headers
SessionMiddleware – session support
CommonMiddleware – URL rewriting, content length
CsrfViewMiddleware – CSRF protection
AuthenticationMiddleware – attaches request.user
MessageMiddleware – flash messages

Configure in settings.py:

MEDIA_URL = '/media/'
MEDIA_ROOT = BASE_DIR / 'media'

Use FileField or ImageField in models. In development, add to urls.py:
urlpatterns += static(settings.MEDIA_URL, document_root=settings.MEDIA_ROOT) Use aggregate() and annotate() with functions from django.db.models:

from django.db.models import Count, Avg, Sum
Article.objects.aggregate(total=Count('id'))
Author.objects.annotate(num_articles=Count('article'))

aggregate() returns a dict; annotate() adds fields to each object. A Django model is a Python class that subclasses django.db.models.Model. Each model maps to a single database table, and each attribute represents a database column. Example:

class Article(models.Model):
  title = models.CharField(max_length=200)

Question 31 Django Framework

What is the ClickjackingMiddleware?

django.middleware.clickjacking.XFrameOptionsMiddleware sets the X-Frame-Options header on responses that don't define one. Enable via MIDDLEWARE in settings.py. @xframe_options_deny sets X-Frame-Options: DENY, preventing the page from being embedded in an iframe (clickjacking protection). Variants: xframe_options_sameorigin and xframe_options_exempt. In settings.py:

CACHES = {
  'default': {
    'BACKEND': 'django.core.cache.backends.redis.RedisCache',
    'LOCATION': 'redis://127.0.0.1:6379/1',
  }
}

Other backends include locmem, db, filebased, and memcached. A Django model is a Python class that subclasses django.db.models.Model. Each model maps to a single database table, and each attribute represents a database column. Example:

class Article(models.Model):
  title = models.CharField(max_length=200)

Question 32 Django Framework

What is timezone.now() vs datetime.now()?

models.JSONField() stores arbitrary JSON. On Postgres it uses jsonb; on MySQL 5.7+ and SQLite 3.38+ it uses native JSON. Query with key lookups:
Article.objects.filter(metadata__tags__contains=['python']) asgi.py exposes an ASGI-compatible callable for servers like Daphne or Uvicorn. It enables async views, WebSockets, and long-lived connections (e.g. Django Channels). Use the all() method on the model's manager:
all_articles = Article.objects.all()
This returns a QuerySet containing all rows in the corresponding table. django.utils.timezone.now() returns an aware datetime in USE_TZ=True mode (UTC), while datetime.datetime.now() is naive. Always use timezone.now() in models and views to avoid timezone bugs.

Question 33 Django Framework

What is the update_or_create() method?

created = models.DateTimeField(auto_now_add=True) sets the field once on creation. updated = models.DateTimeField(auto_now=True) updates it on every save. Both default to False for the parameter. update_or_create(defaults=None, **kwargs) either updates an existing record matching kwargs with defaults, or creates a new one. Returns (object, created). from django.views.decorators.cache import never_cache ensures the response is not cached by browsers or intermediaries:

@never_cache
def dashboard(request): ...

Useful for personalized or sensitive pages. Path converters capture parts of the URL as typed parameters:

<int:pk> – matches integers
<str:slug> – matches non-empty strings (excluding /)
<slug:slug> – matches slugs (letters, numbers, hyphens, underscores)
<uuid:id> – matches UUIDs

Question 34 Django Framework

What is CSRF protection in Django?

SECURE_HSTS_SECONDS = 31536000 sets the Strict-Transport-Security header for one year, telling browsers to always use HTTPS. Requires SECURE_SSL_REDIRECT = True and HTTPS-enabled infrastructure. Register a Python function in a templatetags/ module:

from django import template
register = template.Library()
@register.filter
def shout(value):
  return value.upper() + '!'

Load with {% load myfilters %} in templates. A class-based view subclasses django.views.View or a generic view. It maps HTTP methods to class methods:

class ArticleView(View):
  def get(self, request):
    return HttpResponse("Articles")

Use ArticleView.as_view() in URL configuration. Django protects against Cross-Site Request Forgery attacks using a token-based system. Include {% csrf_token %} in every POST form. The CsrfViewMiddleware verifies that the submitted token matches the one stored in the user's session.

Question 35 Django Framework

What is a Django management command?

Override get_queryset():

class PublishedList(ListView):
  def get_queryset(self):
    return Article.objects.filter(status='published')

This is preferred over setting queryset directly when you need request-aware filtering. ALLOWED_HOSTS = ['learncoachassist.com', 'www.learncoachassist.com'] restricts which Host headers Django accepts. In DEBUG=True it defaults to ['localhost', '127.0.0.1', '[::1]']. MTV stands for Model-Template-View:

Model – defines data structure and database schema
Template – handles the presentation layer (HTML)
View – contains business logic and returns responses

Management commands are run via manage.py. Create custom ones in myapp/management/commands/mycommand.py:

from django.core.management.base import BaseCommand
class Command(BaseCommand):
  help = 'My custom command'
  def handle(self, *args, **options):
    self.stdout.write('Done!')

Run with python manage.py mycommand.

Question 36 Django Framework

What does UpdateView do?

UpdateView fetches an existing object by pk from the URL, populates a ModelForm, and on POST saves the changes. Override form_valid() to add side effects like setting updated_by. {% load static %} then <link rel="stylesheet" href="{% static 'css/main.css' %}">. It prepends STATIC_URL to the relative path and applies any storage backends configured. Defining __str__(self) returns a human-readable string representation of a model instance. The Django admin and shell display this value, and it is used by default in ModelChoiceField. CSRF_COOKIE_HTTPONLY = True prevents JavaScript from reading the CSRF cookie via document.cookie. The CSRF token is still submitted via form input, so this does not break forms.

Question 37 Django Framework

What is get_absolute_url() on a model?

id = models.UUIDField(primary_key=True, default=uuid.uuid4, editable=False)
Stores a 128-bit UUID. Pair with a URL converter <uuid:id> for type-safe routing. Useful when you don't want sequential, guessable primary keys. Use cache.get_or_set with a string key:

articles = cache.get_or_set(
  'articles:published',
  lambda: list(Article.objects.filter(status='published')),
  300,
)

django-admin startproject mysite && cd mysite && django-admin startapp myapp
Note: manage.py is generated with the project, but apps must still be created separately and added to INSTALLED_APPS.

def get_absolute_url(self):
  return reverse('article-detail', kwargs={'pk': self.pk})

It is used by CreateView and UpdateView for the post-save redirect, and by the {% url %} tag with the model:name convention.

Question 38 Django Framework

What is a Django class-based view (CBV)?

Common field types include:

CharField – short text (requires max_length)
TextField – long text
IntegerField – integers
BooleanField – True/False
DateTimeField – date and time
ForeignKey – many-to-one relationship
ManyToManyField – many-to-many relationship

A class-based view subclasses django.views.View or a generic view. It maps HTTP methods to class methods:

class ArticleView(View):
  def get(self, request):
    return HttpResponse("Articles")

Use ArticleView.as_view() in URL configuration. The Object-Relational Mapper (ORM) lets you interact with the database using Python code instead of raw SQL. You use model classes and querysets like MyModel.objects.filter(active=True) to query, create, update, and delete records. F() references a model field value directly in the database, avoiding a Python round-trip:

from django.db.models import F
Article.objects.update(views=F('views') + 1)

This performs the increment atomically in SQL, preventing race conditions.

Question 39 Django Framework

How does Django authentication work?

Generic views handle common patterns out of the box:

ListView – display a list of objects
DetailView – display a single object
CreateView – form to create an object
UpdateView – form to update an object
DeleteView – confirm and delete an object

Import from django.views.generic. Django's django.contrib.auth provides:

User model – stores credentials and profile info
authenticate() – verifies credentials
login() / logout() – manages sessions
@login_required – decorator to protect views
Permission system – per-object and per-model permissions

django.middleware.gzip.GZipMiddleware compresses responses for browsers that send Accept-Encoding: gzip. Avoid compressing already-compressed content (images) — it wastes CPU. django.utils.timezone.now() returns an aware datetime in USE_TZ=True mode (UTC), while datetime.datetime.now() is naive. Always use timezone.now() in models and views to avoid timezone bugs.

Question 40 Django Framework

What does redirect() return?

redirect('view-name', pk=1) returns an HttpResponseRedirect (302) to the resolved URL. You can also pass a model instance with get_absolute_url():
return redirect(article) Run:
python manage.py startapp myapp
Then add 'myapp' to the INSTALLED_APPS list in settings.py to register it with the project. Set EMAIL_BACKEND = 'django.core.mail.backends.console.EmailBackend' to print emails to stdout during development instead of sending them. Use locmem in tests to inspect mail.outbox. django.core.mail.send_mail(subject, message, from_email, recipient_list) sends a single email via the SMTP backend configured by EMAIL_BACKEND, EMAIL_HOST, EMAIL_PORT, EMAIL_HOST_USER, and EMAIL_HOST_PASSWORD.

Question 41 Django Framework

What are Django migrations?

A class-based view subclasses django.views.View or a generic view. It maps HTTP methods to class methods:

class ArticleView(View):
  def get(self, request):
    return HttpResponse("Articles")

Use ArticleView.as_view() in URL configuration. Migrations are version-controlled changes to your database schema. Key commands:
python manage.py makemigrations – creates migration files from model changes
python manage.py migrate – applies migrations to the database
They are stored as Python files in each app's migrations/ directory. apps.py contains the AppConfig subclass for the app. It registers metadata like name and verbose_name and can run startup code in ready() (e.g. registering signals). The Object-Relational Mapper (ORM) lets you interact with the database using Python code instead of raw SQL. You use model classes and querysets like MyModel.objects.filter(active=True) to query, create, update, and delete records.

Question 42 Django Framework

How does Django URL routing work?

@condition(etag_func=..., last_modified_func=...) enables HTTP conditional GETs. If the client's If-None-Match or If-Modified-Since matches, Django returns 304 Not Modified, saving bandwidth. URLs are mapped to views in urls.py using urlpatterns:

from django.urls import path
urlpatterns = [
  path('articles/', views.article_list, name='article-list'),
  path('articles/<int:pk>/', views.article_detail, name='article-detail'),
]

Use include() to reference other app URL configs. Use raise Http404("Article not found") or get_object_or_404(Article, pk=pk). Django's 404 handler renders the 404.html template; custom handlers go in handler404 in the root URLconf. Signals allow decoupled components to be notified when certain actions occur. Common signals:

pre_save / post_save – before/after model save
pre_delete / post_delete – before/after model delete
request_started / request_finished

Connect with @receiver(post_save, sender=MyModel).

Question 43 Django Framework

What is a OneToOneField in Django?

Set requires_system_checks = False in a command to skip Django's check framework. Useful for deployment commands where running checks would be redundant. DetailView looks up the object using pk by default. Set slug_url_kwarg = 'slug' and slug_field = 'slug' in Meta so the URL <slug:slug> works as the lookup key. Use cache.get_or_set with a string key:

articles = cache.get_or_set(
  'articles:published',
  lambda: list(Article.objects.filter(status='published')),
  300,
)

A OneToOneField represents a strict 1:1 link between two models. Common use: extending the User model with a Profile:
user = models.OneToOneField(User, on_delete=models.CASCADE)
It is implemented as a UNIQUE FK.

Question 44 Django Framework

What is a Django function-based view (FBV)?

Exists() from django.db.models returns a boolean subquery used in filter() or annotate():

Author.objects.annotate(
  has_posts=Exists(Post.objects.filter(author=OuterRef('pk')))
)

It generates a correlated EXISTS SQL clause. A function-based view is a Python function that takes an HttpRequest and returns an HttpResponse:

def hello(request):
  return HttpResponse("Hello, World!")

The Object-Relational Mapper (ORM) lets you interact with the database using Python code instead of raw SQL. You use model classes and querysets like MyModel.objects.filter(active=True) to query, create, update, and delete records. Django uses PBKDF2 + SHA256 by default (django.contrib.auth.hashers.PBKDF2PasswordHasher), with 600,000 iterations and a per-user salt. Use user.set_password('new') and user.save() to update; never write to user.password directly.

Question 45 Django Framework

What does DeleteView do?

In settings.py:

DATABASES = {
  'default': {
    'ENGINE': 'django.db.backends.postgresql',
    'NAME': 'mydb',
    'USER': 'mydbuser',
    'PASSWORD': 'secret',
    'HOST': 'localhost',
    'PORT': '5432',
  }
}

DeleteView shows a confirmation template (default <model>_confirm_delete.html) and on POST deletes the object. Always pair with a POST form; never expose GET-based deletes for security. Django uses LANGUAGE_CODE by default. django.middleware.locale.LocaleMiddleware selects language from Accept-Language, the session, or a cookie (LANGUAGE_COOKIE_NAME). Set USE_I18N = True in settings. CreateView (from django.views.generic.edit) handles the "create new object" flow: GET shows an empty form; POST validates and saves, then redirects to success_url or the new object's absolute URL via get_absolute_url().

Question 46 Django Framework

What is SECURE_HSTS_SECONDS?

Configure in settings.py:

STATIC_URL = '/static/'
STATICFILES_DIRS = [BASE_DIR / 'static']
STATIC_ROOT = BASE_DIR / 'staticfiles'

In templates use {% load static %} and {% static 'css/style.css' %}. Run python manage.py collectstatic for production. redirect('view-name', pk=1) returns an HttpResponseRedirect (302) to the resolved URL. You can also pass a model instance with get_absolute_url():
return redirect(article) SECURE_CONTENT_TYPE_NOSNIFF = True emits the X-Content-Type-Options: nosniff header, preventing browsers from MIME-sniffing a response away from the declared Content-Type. SECURE_HSTS_SECONDS = 31536000 sets the Strict-Transport-Security header for one year, telling browsers to always use HTTPS. Requires SECURE_SSL_REDIRECT = True and HTTPS-enabled infrastructure.

Question 47 Django Framework

What is select_related() in Django?

UpdateView fetches an existing object by pk from the URL, populates a ModelForm, and on POST saves the changes. Override form_valid() to add side effects like setting updated_by. django.middleware.clickjacking.XFrameOptionsMiddleware sets the X-Frame-Options header on responses that don't define one. Enable via MIDDLEWARE in settings.py. gettext_lazy returns a lazy proxy that translates when the string is rendered (e.g. in templates), avoiding translation during import. gettext translates immediately. Use gettext_lazy for model fields, app config, and module-level strings. select_related() performs a SQL JOIN to fetch related objects in a single query, reducing database hits for ForeignKey and OneToOneField relationships:
articles = Article.objects.select_related('author').all()
Use prefetch_related() instead for ManyToManyField and reverse relations.

Question 48 Django Framework

What is the Django MTV pattern?

Use filter() and exclude():
Article.objects.filter(status='published')
Article.objects.exclude(status='draft')
You can chain lookups like title__icontains='django', date__gte=some_date, and author__name='Alice'. MTV stands for Model-Template-View:

Model – defines data structure and database schema
Template – handles the presentation layer (HTML)
View – contains business logic and returns responses

@require_http_methods(['GET', 'POST']) rejects any other method with a 405 Method Not Allowed. @require_GET, @require_POST, and @require_safe are shortcuts for ['GET', 'HEAD'] and ['POST']. apps.py contains the AppConfig subclass for the app. It registers metadata like name and verbose_name and can run startup code in ready() (e.g. registering signals).

Question 49 Django Framework

What is CSRF cookie and how is it named?

Common field types include:

CharField – short text (requires max_length)
TextField – long text
IntegerField – integers
BooleanField – True/False
DateTimeField – date and time
ForeignKey – many-to-one relationship
ManyToManyField – many-to-many relationship

Django sets the csrftoken cookie (configurable via CSRF_COOKIE_NAME). It is also exposed in the form via {% csrf_token %}. The middleware compares the cookie/submitted token to the value stored in the session. on_delete specifies behavior when the referenced object is deleted. Options include:

models.CASCADE – delete dependents
models.PROTECT – block deletion
models.SET_NULL – set FK to NULL (requires null=True)
models.SET_DEFAULT – set to default value
models.DO_NOTHING – no action (may raise IntegrityError)

DeleteView shows a confirmation template (default <model>_confirm_delete.html) and on POST deletes the object. Always pair with a POST form; never expose GET-based deletes for security.

Question 50 Django Framework

What are template filters in Django?

Filters transform template variables:

{{ name|lower }} – lowercase
{{ text|truncatewords:20 }} – truncate
{{ value|default:'N/A' }} – fallback value
{{ html|safe }} – mark as safe (no escaping)
{{ date|date:'Y-m-d' }} – format date

You can chain them: {{ value|lower|truncatechars:30 }} {% empty %} inside {% for ... %} renders the fallback block when the iterable is empty:

{% for a in articles %}
  {{ a.title }}
{% empty %}
  No articles yet.
{% endfor %}

select_related() performs a SQL JOIN to fetch related objects in a single query, reducing database hits for ForeignKey and OneToOneField relationships:
articles = Article.objects.select_related('author').all()
Use prefetch_related() instead for ManyToManyField and reverse relations. CSRF_COOKIE_HTTPONLY = True prevents JavaScript from reading the CSRF cookie via document.cookie. The CSRF token is still submitted via form input, so this does not break forms.