Full-Stack Development Risk Assessment & Management 2

Question 1

A full-stack team is launching a feature that processes credit card data. Which risk treatment strategy is MOST appropriate for PCI DSS compliance gaps discovered during assessment?

Accepted Answer

Transfer the risk to a payment processor like Stripe

Answer

Transferring payment processing to a certified payment processor (risk transfer) reduces PCI DSS scope and liability.

Question 2

In a risk register, what does 'residual risk' refer to?

Accepted Answer

Risk remaining after controls have been applied

Answer

Residual risk is the level of risk that remains after mitigation controls have been implemented.

Question 3

A Node.js API has a known SQL injection vulnerability in a rarely-used admin endpoint. The team estimates a 5% chance of exploitation causing $10,000 damage. What is the Annual Loss Expectancy (ALE)?

Accepted Answer

$500

Answer

ALE = Annual Rate of Occurrence (0.05) × Single Loss Expectancy ($10,000) = $500.

Question 4

Which approach best describes 'shift-left' security in a full-stack development context?

Accepted Answer

Integrating security checks early in the development lifecycle

Answer

Shift-left security means incorporating security practices (threat modeling, SAST) early in development rather than at the end.

Question 5

A React frontend communicates with a third-party weather API. The third-party API goes down. Which risk category does this represent?

Accepted Answer

Third-party dependency risk

Answer

Reliance on external APIs introduces third-party dependency risk, where outages are outside the team's control.

Full-Stack Development Practice Test

Full-Stack Development Practice Test

Full-Stack Development Risk Assessment & Management 2