Full-Stack Development Risk Assessment & Management 4 — Questions and Answers
Question 1: Which metric best measures the effectiveness of a risk monitoring program over time?
- Number of features shipped per sprint
- Reduction in residual risk scores after control implementation (Correct answer)
- Lines of code written per developer
- Number of security tools installed
Correct answer: Reduction in residual risk scores after control implementation
Tracking residual risk score reduction demonstrates whether controls are actually decreasing exposure, not just adding overhead.
Question 2: A full-stack app uses a microservices architecture. A risk assessment reveals a single authentication service handles all auth for 12 services. This represents which architectural risk pattern?
- Polyglot persistence risk
- Single point of failure (SPOF) (Correct answer)
- N+1 query risk
- Schema migration risk
Correct answer: Single point of failure (SPOF)
A single auth service with no redundancy is a SPOF — if it fails, all 12 dependent services lose authentication capability.
Question 3: During a risk workshop, a developer argues that an XSS vulnerability is 'low risk' because 'nobody would bother attacking our small app.' This reasoning is an example of which cognitive bias?
- Confirmation bias
- Optimism bias / security through obscurity fallacy (Correct answer)
- Anchoring bias
- Availability heuristic
Correct answer: Optimism bias / security through obscurity fallacy
Assuming small size equals low target value is optimism bias combined with the security through obscurity fallacy, both of which underestimate real risk.
Question 4: What is the purpose of a 'risk appetite statement' in an engineering organization?
- To document every known risk in the system
- To define how much risk the organization is willing to accept in pursuit of its goals (Correct answer)
- To list all security vulnerabilities by severity
- To schedule penetration tests
Correct answer: To define how much risk the organization is willing to accept in pursuit of its goals
A risk appetite statement sets the boundaries of acceptable risk, guiding teams on when to accept vs. mitigate vs. escalate risks.
Question 5: A team is evaluating whether to store sensitive user data in localStorage or httpOnly cookies. From a risk assessment perspective, which is SAFER and why?
- localStorage, because it is encrypted by default
- httpOnly cookies, because they are inaccessible to JavaScript and resistant to XSS (Correct answer)
- localStorage, because it persists across sessions
- Both are equally risky
Correct answer: httpOnly cookies, because they are inaccessible to JavaScript and resistant to XSS
httpOnly cookies cannot be read by JavaScript, making them immune to XSS-based token theft, unlike localStorage.
Question 6: A CI/CD pipeline runs SAST (Static Application Security Testing) and fails the build on CRITICAL findings. A developer marks a real critical SQLi vulnerability as a 'false positive' to unblock the build. What risk management failure does this represent?
- Inadequate test coverage
- Control circumvention / policy violation (Correct answer)
- Over-engineering of the pipeline
- Insufficient developer training
Correct answer: Control circumvention / policy violation
Falsely marking a real vulnerability as a false positive to bypass a security gate is control circumvention, which invalidates the risk management control.
Question 7: In risk management terminology, what is the difference between a 'threat' and a 'vulnerability'?
- They are synonyms used interchangeably
- A threat is a potential harmful event; a vulnerability is a weakness that can be exploited by a threat (Correct answer)
- A vulnerability is an external attacker; a threat is an internal weakness
- A threat is always intentional; a vulnerability is always accidental
Correct answer: A threat is a potential harmful event; a vulnerability is a weakness that can be exploited by a threat
A threat is any potential cause of harm (e.g., a hacker), while a vulnerability is a weakness (e.g., unpatched software) that a threat can exploit.
Full-Stack Development Risk Assessment & Management 4
Which metric best measures the effectiveness of a risk monitoring program over time?