Front End Development Risk Assessment & Management 4 — Questions and Answers
Question 1: A single-page application stores the user's JWT in localStorage. What is the PRIMARY security risk?
- The JWT will expire too quickly
- Any XSS attack can read and exfiltrate the token (Correct answer)
- The token cannot be sent with CORS requests
- LocalStorage is cleared on every browser restart
Correct answer: Any XSS attack can read and exfiltrate the token
localStorage is accessible via JavaScript, so a successful XSS attack can steal the token and hijack the user's session.
Question 2: A risk is rated HIGH probability but LOW impact. What is typically the recommended response?
- Escalate immediately and halt the project
- Monitor it regularly but avoid spending major resources on mitigation (Correct answer)
- Transfer the risk to a third party via insurance
- Accept the risk with no action since impact is low
Correct answer: Monitor it regularly but avoid spending major resources on mitigation
High-probability, low-impact risks warrant monitoring and lightweight controls rather than costly mitigation efforts.
Question 3: Subresource Integrity (SRI) checks on third-party script tags help mitigate which front-end risk?
- Slow DNS resolution for external scripts
- Serving of a tampered or hijacked third-party file (Correct answer)
- CORS errors when loading cross-origin resources
- Render-blocking caused by synchronous scripts
Correct answer: Serving of a tampered or hijacked third-party file
SRI hashes verify that the fetched file exactly matches the expected content, blocking execution if the CDN-hosted file has been compromised.
Question 4: Which practice is most effective for identifying accessibility risks before a front-end release?
- Reviewing only visual design mockups
- Running automated accessibility audits (e.g., axe) plus manual screen-reader testing (Correct answer)
- Checking browser console for JavaScript errors
- Performing load testing with simulated users
Correct answer: Running automated accessibility audits (e.g., axe) plus manual screen-reader testing
Automated tools catch roughly 30–40% of issues, and manual testing with assistive technology covers the remainder of real-world accessibility risks.
Question 5: Your team is about to migrate from a legacy CSS framework to a new one across 200 components. The HIGHEST risk you should plan for is:
- Increased page load due to larger CSS file size
- Visual regressions across components that break the UI for end users (Correct answer)
- Slower build times during development
- Team members needing to learn new syntax
Correct answer: Visual regressions across components that break the UI for end users
Wide-scope CSS migrations frequently introduce subtle visual regressions that are hard to catch without screenshot-based regression testing.
Question 6: In risk management, 'residual risk' refers to:
- Risks that have been fully eliminated
- The remaining risk after mitigation controls have been applied (Correct answer)
- Newly discovered risks that arise after a project starts
- Risks transferred to a third-party vendor
Correct answer: The remaining risk after mitigation controls have been applied
No mitigation is perfect; residual risk is whatever exposure remains after controls are in place and must be accepted or further reduced.
Question 7: A dependency audit using `npm audit` reports a HIGH-severity vulnerability in a package used only in devDependencies for local linting. What is the appropriate risk response?
- Immediately patch and redeploy to production
- Assess that production users are not exposed, document it, and schedule a routine fix (Correct answer)
- Remove all devDependencies from the project
- Disable npm audit in CI to prevent false alerts
Correct answer: Assess that production users are not exposed, document it, and schedule a routine fix
devDependencies are not shipped to users, so the production risk is negligible—document the finding and fix it in a non-emergency window.
Front End Development Risk Assessment & Management 4
A single-page application stores the user's JWT in localStorage.
What is the PRIMARY security risk?