Full-Stack Development Risk Assessment & Management 2 — Questions and Answers
Question 1: A full-stack team is launching a feature that processes credit card data. Which risk treatment strategy is MOST appropriate for PCI DSS compliance gaps discovered during assessment?
- Accept the risk and document it
- Transfer the risk to a payment processor like Stripe (Correct answer)
- Avoid the risk by canceling the feature
- Ignore the risk until after launch
Correct answer: Transfer the risk to a payment processor like Stripe
Transferring payment processing to a certified payment processor (risk transfer) reduces PCI DSS scope and liability.
Question 2: In a risk register, what does 'residual risk' refer to?
- Risk that has been fully eliminated
- Risk remaining after controls have been applied (Correct answer)
- Risk discovered after project completion
- Risk transferred to a third party
Correct answer: Risk remaining after controls have been applied
Residual risk is the level of risk that remains after mitigation controls have been implemented.
Question 3: A Node.js API has a known SQL injection vulnerability in a rarely-used admin endpoint. The team estimates a 5% chance of exploitation causing $10,000 damage. What is the Annual Loss Expectancy (ALE)?
- $500 (Correct answer)
- $10,000
- $50,000
- $2,000
Correct answer: $500
ALE = Annual Rate of Occurrence (0.05) × Single Loss Expectancy ($10,000) = $500.
Question 4: Which approach best describes 'shift-left' security in a full-stack development context?
- Moving security testing to after production deployment
- Integrating security checks early in the development lifecycle (Correct answer)
- Assigning security responsibilities to the operations team only
- Conducting security audits annually
Correct answer: Integrating security checks early in the development lifecycle
Shift-left security means incorporating security practices (threat modeling, SAST) early in development rather than at the end.
Question 5: A React frontend communicates with a third-party weather API. The third-party API goes down. Which risk category does this represent?
- Internal technical risk
- Third-party dependency risk (Correct answer)
- User error risk
- Regulatory compliance risk
Correct answer: Third-party dependency risk
Reliance on external APIs introduces third-party dependency risk, where outages are outside the team's control.
Question 6: What is the PRIMARY purpose of a Business Impact Analysis (BIA) in a full-stack application context?
- To estimate the cost of hiring developers
- To identify critical systems and quantify the impact of their failure (Correct answer)
- To plan marketing strategies for the application
- To document all code dependencies
Correct answer: To identify critical systems and quantify the impact of their failure
A BIA identifies which systems are critical and measures the financial/operational impact if they fail or become unavailable.
Question 7: A development team discovers their Docker base image has a HIGH-severity CVE. The fix requires upgrading a major version that may break compatibility. What is the BEST immediate risk response?
- Deploy the vulnerable image to production immediately
- Assess the exploitability in your context, apply compensating controls, and plan the upgrade (Correct answer)
- Delete the image and stop all deployments
- Mark the CVE as a false positive
Correct answer: Assess the exploitability in your context, apply compensating controls, and plan the upgrade
Assessing exploitability in context allows for prioritized, controlled remediation with interim compensating controls while planning the breaking upgrade.
Full-Stack Development Risk Assessment & Management 2
A full-stack team is launching a feature that processes credit card data.
Which risk treatment strategy is MOST appropriate for PCI DSS compliance gaps discovered during assessment?