Front End Development Risk Assessment & Management 2 — Questions and Answers
Question 1: A third-party npm package your front-end relies on is found to have a critical XSS vulnerability. What is the FIRST action you should take?
- Pin the package to the vulnerable version to avoid breaking changes
- Remove the package entirely regardless of impact
- Check if a patched version exists and upgrade immediately (Correct answer)
- Disable all script execution in the browser
Correct answer: Check if a patched version exists and upgrade immediately
Upgrading to a patched release is the fastest way to close the known vulnerability while preserving functionality.
Question 2: Which metric best quantifies the potential financial impact of a risk event when performing a quantitative risk assessment?
- Risk probability
- Risk velocity
- Expected Monetary Value (EMV) (Correct answer)
- Risk appetite
Correct answer: Expected Monetary Value (EMV)
EMV multiplies the probability of a risk by its monetary impact to produce a single comparable figure.
Question 3: A feature toggle (feature flag) system can reduce front-end deployment risk primarily by:
- Encrypting all JavaScript bundles in production
- Allowing instant rollback of a feature without redeployment (Correct answer)
- Compressing assets to reduce load time
- Enforcing strict Content Security Policy headers
Correct answer: Allowing instant rollback of a feature without redeployment
Feature flags let teams disable a problematic feature server-side instantly, eliminating the need for an emergency redeploy.
Question 4: You discover that 40% of your users are on slow 3G connections and your bundle is 4 MB. What risk does this pose?
- Security risk from unencrypted data transfer
- Performance risk leading to high bounce rates and revenue loss (Correct answer)
- Compliance risk under WCAG accessibility guidelines
- Data integrity risk from partial file transfers
Correct answer: Performance risk leading to high bounce rates and revenue loss
A 4 MB bundle on 3G can take 10+ seconds to load, causing users to abandon the page before it becomes interactive.
Question 5: Which risk mitigation strategy is applied when a team decides to use a well-tested UI component library instead of building custom components from scratch?
- Risk avoidance
- Risk acceptance
- Risk transfer
- Risk reduction (Correct answer)
Correct answer: Risk reduction
Using a battle-tested library reduces the probability of introducing bugs compared to untested custom code.
Question 6: A front-end team stores API keys directly in client-side JavaScript. Which risk does this MOST directly create?
- Cross-site request forgery (CSRF)
- Unauthorized access to backend services by anyone who inspects the source (Correct answer)
- Denial of service against the client browser
- SQL injection in the database layer
Correct answer: Unauthorized access to backend services by anyone who inspects the source
Client-side code is publicly visible, so any API key embedded in it can be extracted and misused by attackers.
Question 7: What does a risk register typically document for each identified risk?
- Only the risk description and owner
- Description, probability, impact, mitigation plan, owner, and status (Correct answer)
- The financial budget allocated to resolving risks
- A list of all past incidents sorted by severity
Correct answer: Description, probability, impact, mitigation plan, owner, and status
A complete risk register captures probability, impact, mitigation actions, ownership, and current status so nothing is left untracked.
Front End Development Risk Assessment & Management 2
A third-party npm package your front-end relies on is found to have a critical XSS vulnerability.
What is the FIRST action you should take?