Introduction to Node.js Application Security

Final Quiz

Connecting to LMS... Progress: in progress

Assessment

1. Why does Node.js application security require attention to dependencies? A. Node.js applications often rely heavily on npm packages and transitive dependencies B. Dependencies are always safe if downloaded successfully C. Dependencies replace code review D. Dependencies cannot affect production behavior

2. What is a transitive dependency? A. A database backup B. A dependency required by another dependency rather than directly by the application C. A browser cookie attribute D. A password hashing setting

3. Why should lockfiles be maintained carefully? A. They make every dependency safe forever B. They replace vulnerability management C. They help make dependency versions more reproducible across installs and environments D. They prevent all supply chain attacks

4. Why is input validation still needed in Node.js applications? A. JavaScript automatically validates every request B. JSON parsing proves data is safe C. Validation only matters in compiled languages D. External data still arrives at runtime and may not match expected shape, type, or business rules

5. What is schema validation useful for? A. Defining and enforcing expected fields, types, formats, ranges, and constraints B. Encrypting all responses C. Replacing authentication D. Disabling logging

6. What is mass assignment? A. Compressing too many API responses B. Allowing user-controlled fields to set properties that should not be user-controlled C. Installing many packages at once D. Logging every request header

7. Why should authorization be enforced on the server? A. Browser code is always trusted B. Hidden UI buttons provide complete access control C. Client-side checks can be bypassed, modified, or skipped entirely D. Authorization only matters for databases

8. What is broken object-level authorization? A. A package installation warning B. A JSON formatting issue C. A TLS certificate renewal process D. A condition where a caller can access or modify an object they should not be allowed to use

9. Why can CORS misconfiguration be risky? A. It may allow unintended browser-based cross-origin access patterns B. It always blocks all attacks C. It replaces authentication D. It only affects CSS files

10. Why should secrets not be stored directly in source code? A. Hard-coded secrets rotate automatically B. Source code may be copied, committed, shared, built, logged, or exposed C. Hard-coded secrets are safer than secret managers D. Source code cannot contain secrets

11. What is a key risk of unsafe child_process usage? A. It automatically validates all input B. It prevents injection C. User-controlled input may influence system command execution if command construction is unsafe D. It replaces operating system permissions

12. What is path traversal? A. A package versioning strategy B. A session cookie flag C. A JSON schema keyword D. A risk where input influences file access outside an intended directory

13. What is SSRF at a high level? A. A risk where server-side request functionality can be influenced to access unintended internal or external resources B. A password hashing algorithm C. A CSS layout problem D. A logging format

14. Why should production error responses avoid stack traces? A. Stack traces always improve security B. Stack traces may reveal internal paths, code structure, dependencies, or implementation details C. Stack traces replace logging D. Stack traces are required for every API client

15. Which statement best summarizes Node.js application security? A. Node.js applications are secure by default because they use JavaScript B. Installing popular packages removes the need for review C. Secure Node.js applications combine dependency governance, input validation, access control, secrets management, safe file and process handling, logging, and secure deployment practices D. Security only matters at the web server layer