Final check
Why it matters Knowing a definition is one thing. Recognising it in the middle of real life, when a link, a banner or a code review is in front of you, is what actually protects you and the people who use your sites. This check asks you to do exactly that, 20 times.
This is the last graded check of the course. Each question is a short scenario: a situation you could meet at home or at work, followed by a choice of what is really going on or what to do next.
Scenario question: a question that describes a situation instead of asking for a definition. You answer by working out which idea from the course applies, and how.
What is covered
Leg 8 builds on the core of the course, Legs 1 to 4, so the 20 questions come from those four legs. The legs of the deep half (5 to 7) were already checked by their own quizzes and projects. If you took them, there is a short self-check for them at the end of this page.
| Questions | Leg | Main ideas |
|---|---|---|
| 1 to 5 | Leg 1: How you are watched | cookies, link decoration, fingerprints, pixels, consent |
| 6 to 10 | Leg 2: See it in code | headers, cookie rules, trackers, blockers, measuring privacy |
| 11 to 15 | Leg 3: Build sites that do not leak | XSS, safe templates, CSP, framing, third parties |
| 16 to 20 | Leg 4: The privacy engineer's toolkit | encryption, passkeys, private AI, threat models, incidents |
How it is graded
You pass when all 20 answers are right. That sounds strict, but you can retry as many times as you like, and your answers are checked in your own browser and never sent anywhere. When you pass, the only thing your browser tells the site is which lesson you passed, so it can count towards your stamp. After you check your answers, each question shows an explanation, so a wrong answer still teaches you something.
Where a question describes how browsers behave today, it is marked "(checked October 2026)". Browsers change, so treat those facts as a snapshot, not a law of nature.
How to approach a scenario
- Read the whole scenario first. The key detail is often in the last sentence.
- Name the idea. Ask yourself: is this about cookies, fingerprints, escaping, encryption? Naming it usually points to the right lesson.
- Rule out the tempting wrong answers. Many wrong options are common beliefs, such as "HTTPS hides everything" or "hashed means anonymous".
- Be wary of "always" and "never". Privacy is full of trade-offs, and absolute answers are usually wrong.
A common misconception
"A scenario question has a trick in it." It does not. Every question here has one answer that a careful reader of the course will find clearly best. If two options seem equally good, reread the scenario for the detail that separates them.
Deep-half self-check (not graded)
If you took Legs 5 to 7, answer each one in your head, then open the answer.
1. You switch on encrypted DNS. Who can still see which names you look up?
Your DNS resolver. Encrypted DNS hides the questions from the network in between, but moves the diary to whoever answers them.
2. Why does JA4 sort the extensions in a TLS ClientHello before hashing?
Some browsers shuffle extension order on each connection, which made older fingerprints change every time. Sorting first gives a stable fingerprint despite the shuffle (checked October 2026).
3. Are http://shop.example and https://shop.example the same site?
No. With schemeful same-site, a different scheme means a different site, so their partitions are separate.
4. Two companies run Private Set Intersection on their customer lists. What do they still learn?
The intersection itself: which customers they share. PSI hides the rest of each list, and the cardinality version reveals only how many are shared.
5. You add padding to defeat website fingerprinting over encrypted traffic. What does it cost?
Bandwidth. Padding lowers the attacker's accuracy by making page loads look alike, at the price of sending extra data.
Recap
- 20 scenario questions, five from each core leg; all must be right, and you can retry.
- Read the whole scenario, name the idea, then rule out the common beliefs.
- Answers are checked in your browser and each one comes with an explanation.
- Deep-half learners have a short ungraded self-check above.
This lesson is locked
Lessons open one at a time. Finish the previous lesson to unlock this one.