Front End Development Risk Assessment & Management 5 — Questions and Answers
Question 1: Which front-end testing type provides the MOST direct risk coverage for a complete user checkout flow spanning multiple components?
- Unit tests for individual utility functions
- End-to-end (E2E) tests simulating the full browser interaction (Correct answer)
- Snapshot tests for static component rendering
- Performance tests measuring bundle parse time
Correct answer: End-to-end (E2E) tests simulating the full browser interaction
E2E tests exercise the entire user journey in a real or headless browser, catching integration gaps that unit or snapshot tests miss.
Question 2: A Content Security Policy (CSP) header is primarily used to mitigate which class of front-end attack?
- Cross-site request forgery (CSRF)
- Cross-site scripting (XSS) (Correct answer)
- SQL injection
- Man-in-the-middle attacks
Correct answer: Cross-site scripting (XSS)
CSP restricts which scripts, styles, and resources the browser may execute, blocking many XSS payloads even if injection occurs.
Question 3: Technical debt in a front-end codebase is best classified as which type of risk?
- External risk
- Strategic risk
- Internal operational risk (Correct answer)
- Compliance risk
Correct answer: Internal operational risk
Technical debt is an internally generated risk that increases the probability of defects, slower delivery, and system failure over time.
Question 4: A team ships a breaking change to a shared component library used by five product teams simultaneously. Which risk management practice would have best prevented the outage?
- Using a monorepo for all code
- Semantic versioning with a deprecation period and consumer communication before removal (Correct answer)
- Minimizing the number of components in the library
- Switching from npm to a private registry
Correct answer: Semantic versioning with a deprecation period and consumer communication before removal
Semantic versioning communicates breaking changes via major version bumps and a migration window, allowing consumers to upgrade on their own schedule.
Question 5: An application renders user-supplied HTML directly using `innerHTML`. The MOST appropriate risk control is:
- Encode all output with Base64 before rendering
- Sanitize HTML using a trusted library (e.g., DOMPurify) before insertion (Correct answer)
- Disable JavaScript globally for that page section
- Store user content in cookies instead of DOM nodes
Correct answer: Sanitize HTML using a trusted library (e.g., DOMPurify) before insertion
DOMPurify and similar libraries strip dangerous tags and attributes from HTML before it touches the DOM, preventing XSS.
Question 6: Which action would be categorized as 'risk acceptance' in a front-end project?
- Adding a polyfill to support an older browser
- Documenting a known IE11 rendering issue as out of scope because IE11 usage is <0.1% (Correct answer)
- Rewriting a module to remove a vulnerable dependency
- Purchasing a security scanning tool to detect vulnerabilities
Correct answer: Documenting a known IE11 rendering issue as out of scope because IE11 usage is <0.1%
Risk acceptance means formally acknowledging a risk and deciding not to mitigate it, usually because the cost of mitigation exceeds the expected impact.
Question 7: During a sprint retrospective, the team identifies that unclear API contracts between front-end and back-end teams caused two production bugs. Which risk management action addresses the ROOT CAUSE?
- Add more manual QA testers to the team
- Establish a shared API contract using OpenAPI/Swagger with automated contract testing (Correct answer)
- Deploy more frequently to detect issues faster
- Increase the number of unit tests for front-end components
Correct answer: Establish a shared API contract using OpenAPI/Swagger with automated contract testing
Contract testing with a shared specification prevents front-end/back-end mismatches from reaching production by validating both sides against the same source of truth.
Front End Development Risk Assessment & Management 5
Which front-end testing type provides the MOST direct risk coverage for a complete user checkout flow spanning multiple components?