Full-Stack Development Risk Assessment & Management 3 — Questions and Answers
Question 1: In a risk heat map (matrix), a risk with HIGH likelihood and LOW impact should be prioritized HOW relative to a risk with LOW likelihood and HIGH impact?
- Always prioritize high likelihood risks first
- Always prioritize high impact risks first
- They may have similar risk scores; compare ALE values to decide priority (Correct answer)
- Deprioritize both and focus only on high-high risks
Correct answer: They may have similar risk scores; compare ALE values to decide priority
Both combinations can yield similar risk scores; calculating ALE (ARO × SLE) provides an objective basis for prioritization.
Question 2: A full-stack app stores user passwords in plain text. During a risk assessment, this is classified as which type of risk?
- Strategic risk
- Security/technical risk (Correct answer)
- Market risk
- Operational risk
Correct answer: Security/technical risk
Storing passwords in plain text is a security/technical risk that directly exposes user credentials if the database is breached.
Question 3: What does MTTR measure in the context of full-stack risk management?
- Mean Time To Release — average time between feature releases
- Mean Time To Repair — average time to restore a system after failure (Correct answer)
- Maximum Tolerable Transfer Rate — network throughput threshold
- Minimum Test To Regression — CI/CD gate metric
Correct answer: Mean Time To Repair — average time to restore a system after failure
MTTR (Mean Time To Repair/Restore) measures how quickly a team can recover a system after an incident.
Question 4: A team uses feature flags to gradually roll out a new checkout flow to 5% of users. This is an example of which risk management technique?
- Risk avoidance
- Risk transfer
- Risk mitigation through controlled exposure (Correct answer)
- Risk acceptance
Correct answer: Risk mitigation through controlled exposure
Canary releases via feature flags limit blast radius by exposing new code to a small subset of users, reducing potential impact.
Question 5: Which OWASP tool is specifically designed to help development teams perform threat modeling for web applications?
- OWASP ZAP
- OWASP Threat Dragon (Correct answer)
- OWASP Dependency-Check
- OWASP ASVS
Correct answer: OWASP Threat Dragon
OWASP Threat Dragon is a threat modeling tool that helps teams identify and document threats in a visual diagram format.
Question 6: A SaaS company has an RTO of 4 hours for its main application. What does this mean?
- The app must be restored within 4 hours of a disaster to meet business requirements (Correct answer)
- The app can only be down 4 hours per year total
- Data can be lost up to 4 hours before a backup
- The team has 4 hours to respond to an incident before escalating
Correct answer: The app must be restored within 4 hours of a disaster to meet business requirements
Recovery Time Objective (RTO) is the maximum acceptable time to restore a system after a disruption.
Question 7: A backend engineer discovers that a widely-used npm package in their project has been compromised in a supply chain attack. What is the FIRST action they should take?
- Wait for an official patch from the package maintainer
- Remove the package, assess impact, and notify stakeholders while implementing a safe alternative (Correct answer)
- Roll back the entire application to the previous version
- Publish a blog post about the vulnerability
Correct answer: Remove the package, assess impact, and notify stakeholders while implementing a safe alternative
Removing the compromised package immediately limits exposure, while impact assessment and stakeholder notification enable coordinated response.
Full-Stack Development Risk Assessment & Management 3
In a risk heat map (matrix), a risk with HIGH likelihood and LOW impact should be prioritized HOW relative to a risk with LOW likelihood and HIGH impact?