ASP.NET Web Forms quiz and interview questions
Many companies still run Web Forms applications and need developers who can maintain and modernise them. Interviews focus on ViewState, postbacks, the page life cycle and state management — and on how you'd move an app to ASP.NET Core.
ASP.NET Web Forms: key concepts
- Postback
- The page's form posts back to the same page, and server-side event handlers (Button_Click) run. Check IsPostBack to run first-load code once.
- ViewState
- Control state stored in a hidden field and sent back with each postback. Convenient, but it can make pages heavy.
- Page life cycle
- Init → Load → control events → PreRender → Render → Unload. Knowing the order explains many "why is my value empty" bugs.
- State management
- ViewState (per page), Session (per user, server side), cookies (client side), Application/cache (shared).
- Master pages and user controls
- Master pages give a shared layout; user controls (.ascx) are reusable page pieces.
- Modernising
- Web Forms runs only on .NET Framework (Windows). New work usually moves to ASP.NET Core MVC, Razor Pages or Blazor.
All 38 ASP.NET Web Forms questions with answers
Try each one first, then open the answer. Making a class test? Use the test maker.
What is a postback in Web Forms?
- A. A redirect to another site
- B. The page posting its form back to itself so server events can run
- C. A database rollback
- D. An email reply
Show answer
B. The page posting its form back to itself so server events can run — Clicking an <asp:Button> posts the page back and runs its Click handler on the server.
What is ViewState?
- A. A CSS feature
- B. Control values kept in a hidden form field across postbacks
- C. Server memory per user
- D. A browser cache
Show answer
B. Control values kept in a hidden form field across postbacks — It lets a TextBox keep its value after a postback without you writing code — at the cost of page size.
When does BindGrid() run?
protected void Page_Load(object sender, EventArgs e) { if (!IsPostBack) { BindGrid(); } }- A. On every request
- B. Only on the first load, not on postbacks
- C. Only on postbacks
- D. Never
Show answer
B. Only on the first load, not on postbacks — IsPostBack is false on the first GET and true on postbacks, so the grid is bound once and kept by ViewState.
Which page life-cycle event runs first?
- A. Load
- B. PreRender
- C. Init
- D. Render
Show answer
C. Init — Init → Load → control events → PreRender → Render → Unload.
What is the difference between Server.Transfer and Response.Redirect?
- A. None
- B. Transfer switches pages on the server (URL doesn't change); Redirect tells the browser to request a new URL
- C. Redirect is server-side
- D. Transfer works across websites
Show answer
B. Transfer switches pages on the server (URL doesn't change); Redirect tells the browser to request a new URL — Redirect costs a round-trip but shows the right URL; Transfer is faster but the address bar keeps the old URL.
What is a master page?
- A. The home page
- B. A shared layout (header, menu, footer) that content pages plug into
- C. An admin page
- D. A database page
Show answer
B. A shared layout (header, menu, footer) that content pages plug into — Content pages fill the master page's ContentPlaceHolder controls.
What is a user control (.ascx)?
- A. A login form
- B. A reusable piece of UI you can drop into several pages
- C. A type of ViewState
- D. A web service
Show answer
B. A reusable piece of UI you can drop into several pages — E.g. an address-entry block used on checkout and profile pages.
Pages are slow and the HTML is huge. What Web Forms feature should you check first?
- A. Master pages
- B. ViewState — disable it on controls that don't need it
- C. Session state
- D. Cookies
Show answer
B. ViewState — disable it on controls that don't need it — Large grids with ViewState enabled can add hundreds of KB to every request and response.
Where is Session state stored by default?
- A. In the browser
- B. On the server, per user
- C. In ViewState
- D. In the URL
Show answer
B. On the server, per user — Session data lives on the server (in-process by default); only a session ID cookie goes to the browser.
Which control makes a field mandatory without writing code?
- A. RangeValidator
- B. RequiredFieldValidator
- C. Label
- D. Panel
Show answer
B. RequiredFieldValidator — Validation controls run in the browser and on the server; check Page.IsValid in your handler.
What is Global.asax used for?
- A. Page styling
- B. Application-level events like Application_Start and Application_Error
- C. Storing passwords
- D. Routing only
Show answer
B. Application-level events like Application_Start and Application_Error — It's where Web Forms apps register routes, start-up code and global error handling.
Why are new projects usually built with ASP.NET Core instead of Web Forms?
- A. Web Forms is faster
- B. Web Forms runs only on .NET Framework (Windows) and isn't part of modern .NET
- C. ASP.NET Core can't do forms
- D. Web Forms has no database support
Show answer
B. Web Forms runs only on .NET Framework (Windows) and isn't part of modern .NET — Modern .NET is cross-platform and actively developed. Web Forms apps are maintained or migrated to MVC, Razor Pages or Blazor.
What does the OutputCache directive do?
- A. Logs output
- B. Caches the rendered page (or control) for a set time so it isn't rebuilt on every request
- C. Compresses images
- D. Stores ViewState
Show answer
B. Caches the rendered page (or control) for a set time so it isn't rebuilt on every request — <%@ OutputCache Duration="60" VaryByParam="none" %> serves the cached HTML for 60 seconds.
Which file extension is a Web Forms page?
- A. .cshtml
- B. .aspx
- C. .razor
- D. .ascx
Show answer
B. .aspx — .aspx is a page, .ascx a user control and .master a master page.
What is the code-behind file?
- A. A CSS file
- B. The .aspx.cs file holding the page's C# event handlers, separate from the markup
- C. A database script
- D. A config file
Show answer
B. The .aspx.cs file holding the page's C# event handlers, separate from the markup — Default.aspx holds markup; Default.aspx.cs holds Page_Load, Button_Click and other handlers.
What does AutoPostBack="true" on a DropDownList do?
- A. Disables the list
- B. Posts the page back as soon as the selection changes
- C. Saves to the database
- D. Loads items via AJAX
Show answer
B. Posts the page back as soon as the selection changes — Useful for cascading lists (country → city), but each change costs a full round-trip.
How does a Repeater differ from a GridView?
- A. Repeater renders tables only
- B. Repeater is lightweight with full control of markup but no built-in paging, sorting or editing
- C. GridView can't bind data
- D. They're identical
Show answer
B. Repeater is lightweight with full control of markup but no built-in paging, sorting or editing — Use GridView for quick admin tables; Repeater (or ListView) when you need custom HTML.
What does an asp:Label render compared with an asp:Literal?
- A. Both render <div>
- B. Label renders a <span>; Literal renders only its text
- C. Literal renders <p>
- D. Label renders nothing
Show answer
B. Label renders a <span>; Literal renders only its text — Literal is handy when you must not add any extra HTML element.
Is it safe to store a user's role or price in ViewState?
- A. Yes, it's encrypted by default
- B. No — ViewState travels to the browser; it's tamper-protected (MAC) but readable, so never trust or store secrets in it
- C. Yes, if the page is HTTPS
- D. Only on intranets
Show answer
B. No — ViewState travels to the browser; it's tamper-protected (MAC) but readable, so never trust or store secrets in it — ViewState is Base64-encoded, not encrypted by default. Keep sensitive data on the server.
How is Application state different from Session state?
- A. No difference
- B. Application state is shared by all users; Session is per user
- C. Session is shared
- D. Application state is stored in cookies
Show answer
B. Application state is shared by all users; Session is per user — Application["VisitorCount"] is global; Session["Cart"] belongs to one visitor.
What is the risk of passing an order id in the query string (?orderId=42)?
- A. None
- B. Users can see and change it, so always check they're allowed to view that order
- C. Query strings are encrypted
- D. It breaks ViewState
Show answer
B. Users can see and change it, so always check they're allowed to view that order — Changing 42 to 43 must not show someone else's order — authorise every request.
How does Forms Authentication work in Web Forms?
- A. Windows accounts
- B. Users log in on a login page and get an encrypted authentication cookie checked on later requests
- C. Client certificates only
- D. IP address checks
Show answer
B. Users log in on a login page and get an encrypted authentication cookie checked on later requests — Configured in web.config with <authentication mode="Forms">, plus FormsAuthentication.SetAuthCookie.
When is Windows authentication a good choice?
- A. Public shopping sites
- B. Company intranets where users already sign in with Active Directory accounts
- C. Mobile apps
- D. Never
Show answer
B. Company intranets where users already sign in with Active Directory accounts — IIS authenticates the domain user automatically — no separate login page.
What does PostBackUrl on a button do?
- A. Redirects after saving
- B. Posts the form to a different page (cross-page posting), which can read PreviousPage
- C. Disables postback
- D. Opens a new window
Show answer
B. Posts the form to a different page (cross-page posting), which can read PreviousPage — The target page reads values with PreviousPage.FindControl(...) or a typed PreviousPage.
Client-side validators passed. Why still check Page.IsValid in the click handler?
- A. You don't need to
- B. Client validation can be bypassed (JavaScript off, crafted requests); server validation is the real check
- C. To speed up the page
- D. It reloads ViewState
Show answer
B. Client validation can be bypassed (JavaScript off, crafted requests); server validation is the real check — Validators also run on the server; Page.IsValid tells you whether they passed.
What does an UpdatePanel do?
- A. Uploads files
- B. Updates part of the page via AJAX instead of a full postback (needs a ScriptManager)
- C. Updates the database
- D. Refreshes the browser
Show answer
B. Updates part of the page via AJAX instead of a full postback (needs a ScriptManager) — Only the panel's HTML is replaced, which feels faster to users.
What is a hidden cost of UpdatePanel?
- A. None
- B. The whole page still runs its life cycle and posts all ViewState — it only looks partial
- C. It disables validation
- D. It requires SQL Server
Show answer
B. The whole page still runs its life cycle and posts all ViewState — it only looks partial — For heavy pages, real AJAX calls to a web method or API are much lighter.
A user clicks the button. What is written to the response?
protected void Page_Init(object s, EventArgs e) { Response.Write("Init "); } protected void Page_Load(object s, EventArgs e) { Response.Write("Load "); } protected void Btn_Click(object s, EventArgs e) { Response.Write("Click "); } protected void Page_PreRender(object s, EventArgs e) { Response.Write("PreRender"); }- A. Click Init Load PreRender
- B. Init Load Click PreRender
- C. Load Init Click PreRender
- D. Init Click Load PreRender
Show answer
B. Init Load Click PreRender — Init, then Load, then control events like the click, then PreRender.
Users edit a row in the grid, click Save, and their selection is lost. Why?
protected void Page_Load(object sender, EventArgs e) { GridView1.DataSource = GetProducts(); GridView1.DataBind(); }- A. GetProducts is slow
- B. The grid is rebound on every postback, wiping the posted state — wrap it in if (!IsPostBack)
- C. DataBind must be async
- D. GridView needs paging
Show answer
B. The grid is rebound on every postback, wiping the posted state — wrap it in if (!IsPostBack) — Bind on first load and after saves; let ViewState carry the grid between postbacks.
What are web.config transformations (Web.Release.config)?
- A. Translations
- B. Rules that change settings like connection strings for each build configuration on publish
- C. Compression
- D. Routing rules
Show answer
B. Rules that change settings like connection strings for each build configuration on publish — Debug and Release builds can point to different databases without editing the main file.
What do customErrors settings in web.config do?
- A. Translate errors
- B. Show friendly error pages to users and hide detailed error messages
- C. Log errors to email
- D. Fix errors
Show answer
B. Show friendly error pages to users and hide detailed error messages — <customErrors mode="RemoteOnly" defaultRedirect="~/Error.aspx" /> shows details only on the server itself.
The site runs on two servers behind a load balancer and users keep losing their session. Why?
- A. Too many users
- B. InProc session lives in one server's memory — use StateServer/SQL Server session or sticky sessions
- C. Cookies are disabled
- D. ViewState is off
Show answer
B. InProc session lives in one server's memory — use StateServer/SQL Server session or sticky sessions — Out-of-process session state is shared by all servers in the farm.
What does the Cache object add over Application state?
- A. Nothing
- B. Expiration times and dependencies, so data can be refreshed or removed automatically
- C. Per-user storage
- D. Encryption
Show answer
B. Expiration times and dependencies, so data can be refreshed or removed automatically — Cache.Insert("products", list, null, DateTime.Now.AddMinutes(10), Cache.NoSlidingExpiration).
What makes an HTML element a server control?
- A. A CSS class
- B. runat="server" (with an id), so code-behind can access it
- C. A data- attribute
- D. Putting it in a master page
Show answer
B. runat="server" (with an id), so code-behind can access it — <input id="Name" runat="server" /> becomes an HtmlInputText you can read in C#.
What is the difference between a persistent cookie and a session cookie?
- A. No difference
- B. A persistent cookie has an expiry date and survives browser restarts; a session cookie is deleted when the browser closes
- C. Session cookies are stored on the server
- D. Persistent cookies are encrypted
Show answer
B. A persistent cookie has an expiry date and survives browser restarts; a session cookie is deleted when the browser closes — "Remember me" uses a persistent authentication cookie.
Which is a sensible first step when modernising a big Web Forms app?
- A. Rewrite everything at once
- B. Move business logic into class libraries and add an API, then migrate pages gradually
- C. Delete ViewState
- D. Switch to VB.NET
Show answer
B. Move business logic into class libraries and add an API, then migrate pages gradually — Incremental migration (the strangler pattern) reduces risk compared with a big-bang rewrite.
What are server-side event handlers wired to in markup?
- A. JavaScript only
- B. Attributes like OnClick="Save_Click" on server controls
- C. CSS classes
- D. web.config
Show answer
B. Attributes like OnClick="Save_Click" on server controls — <asp:Button OnClick="Save_Click" /> calls protected void Save_Click(object sender, EventArgs e) on postback.
What does EnableViewState="false" on a control do?
- A. Hides the control
- B. Stops that control from storing its state in ViewState, making the page smaller
- C. Disables postbacks
- D. Clears session
Show answer
B. Stops that control from storing its state in ViewState, making the page smaller — Turn it off for read-only controls you rebind anyway, such as large display grids.
More subjects
Need software for your business instead? I'm an AI automation & full-stack developer — see what I build.