Full-Stack Development Risk Assessment & Management 4

Question 1

Which metric best measures the effectiveness of a risk monitoring program over time?

Accepted Answer

Reduction in residual risk scores after control implementation

Answer

Tracking residual risk score reduction demonstrates whether controls are actually decreasing exposure, not just adding overhead.

Question 2

A full-stack app uses a microservices architecture. A risk assessment reveals a single authentication service handles all auth for 12 services. This represents which architectural risk pattern?

Accepted Answer

Single point of failure (SPOF)

Answer

A single auth service with no redundancy is a SPOF — if it fails, all 12 dependent services lose authentication capability.

Question 3

During a risk workshop, a developer argues that an XSS vulnerability is 'low risk' because 'nobody would bother attacking our small app.' This reasoning is an example of which cognitive bias?

Accepted Answer

Optimism bias / security through obscurity fallacy

Answer

Assuming small size equals low target value is optimism bias combined with the security through obscurity fallacy, both of which underestimate real risk.

Question 4

What is the purpose of a 'risk appetite statement' in an engineering organization?

Accepted Answer

To define how much risk the organization is willing to accept in pursuit of its goals

Answer

A risk appetite statement sets the boundaries of acceptable risk, guiding teams on when to accept vs. mitigate vs. escalate risks.

Question 5

A team is evaluating whether to store sensitive user data in localStorage or httpOnly cookies. From a risk assessment perspective, which is SAFER and why?

Accepted Answer

httpOnly cookies, because they are inaccessible to JavaScript and resistant to XSS

Answer

httpOnly cookies cannot be read by JavaScript, making them immune to XSS-based token theft, unlike localStorage.

Full-Stack Development Practice Test

Full-Stack Development Practice Test

Full-Stack Development Risk Assessment & Management 4