Full-Stack Development Professional Standards & Competencies 2 — Questions and Answers
Question 1: A full-stack developer discovers a critical security vulnerability in a third-party library used in production. What is the FIRST action they should take?
- Immediately remove the library without testing
- Assess the risk and notify the team lead before making changes (Correct answer)
- Patch the library yourself without informing anyone
- Delete the affected endpoints to prevent exploitation
Correct answer: Assess the risk and notify the team lead before making changes
Assessing risk and notifying the team lead ensures coordinated remediation without introducing new bugs from untested changes.
Question 2: Which practice best demonstrates adherence to semantic versioning (SemVer) when releasing a backward-compatible bug fix?
- Increment the MAJOR version
- Increment the MINOR version
- Increment the PATCH version (Correct answer)
- Reset all version numbers to zero
Correct answer: Increment the PATCH version
SemVer specifies that backward-compatible bug fixes increment only the PATCH version (e.g., 1.0.0 → 1.0.1).
Question 3: A developer is asked to estimate a feature that is poorly defined. What is the most professional response?
- Provide a precise hour estimate to seem confident
- Refuse to estimate until all details are known
- Give a range estimate and list the assumptions and unknowns (Correct answer)
- Delegate the estimation to a junior developer
Correct answer: Give a range estimate and list the assumptions and unknowns
Range estimates with documented assumptions are honest and actionable, helping stakeholders plan despite uncertainty.
Question 4: What does the SOLID principle 'Open/Closed Principle' mean for a full-stack developer?
- Code should be open-source and closed to licensing restrictions
- Software entities should be open for extension but closed for modification (Correct answer)
- APIs should be open to all users but closed to anonymous requests
- Functions should be open for reading but closed for writing
Correct answer: Software entities should be open for extension but closed for modification
The Open/Closed Principle states that you should add new behavior by extending code rather than modifying existing, tested code.
Question 5: When a colleague's pull request has a major architectural flaw, the most professional code review approach is to:
- Approve it to avoid conflict and log a tech debt ticket
- Reject it without explanation to save time
- Comment with a specific explanation of the issue and suggest an alternative approach (Correct answer)
- Rewrite the entire PR yourself
Correct answer: Comment with a specific explanation of the issue and suggest an alternative approach
Professional code reviews provide specific, constructive feedback with alternatives to help colleagues improve and unblock the work.
Question 6: What is the purpose of maintaining a CHANGELOG file in a software project?
- To store git commit hashes for rollback purposes
- To document notable changes per release so users and contributors can track history (Correct answer)
- To replace version control systems like Git
- To list all developers who contributed to the project
Correct answer: To document notable changes per release so users and contributors can track history
A CHANGELOG records user-facing changes per release, helping consumers and contributors understand what changed and why.
Question 7: A full-stack developer is the only person who understands a critical legacy system. Which professional standard should they prioritize?
- Keep knowledge private to maintain job security
- Document the system thoroughly and share knowledge with the team (Correct answer)
- Rewrite the system in modern tech immediately without approval
- Archive the system and migrate users without testing
Correct answer: Document the system thoroughly and share knowledge with the team
Documenting and sharing knowledge prevents single points of failure and is a core professional responsibility in software engineering.
Full-Stack Development Professional Standards & Competencies 2
A full-stack developer discovers a critical security vulnerability in a third-party library used in production.
What is the FIRST action they should take?