Full-Stack Development Risk Assessment & Management 5 — Questions and Answers
Question 1: A startup decides to launch without penetration testing because the timeline is tight. This decision is an example of which risk response?
- Risk mitigation
- Risk avoidance
- Risk acceptance (Correct answer)
- Risk transfer
Correct answer: Risk acceptance
Knowingly proceeding without a security control due to business constraints is risk acceptance — acknowledging the risk and choosing to bear it.
Question 2: Which of the following is the BEST definition of 'attack surface' in a full-stack application?
- The total number of bugs found in code review
- The sum of all different points where an attacker can try to enter or extract data (Correct answer)
- The maximum server load the app can handle
- The number of external APIs the app consumes
Correct answer: The sum of all different points where an attacker can try to enter or extract data
Attack surface encompasses all input vectors, APIs, interfaces, and entry points that an attacker could potentially exploit.
Question 3: A team implements automated dependency scanning in their CI pipeline using tools like Snyk or Dependabot. This primarily addresses which risk category?
- Performance degradation risk
- Third-party library vulnerability risk (Correct answer)
- Database schema drift risk
- UI regression risk
Correct answer: Third-party library vulnerability risk
Automated dependency scanning continuously monitors for known CVEs in third-party packages, directly addressing supply chain vulnerability risk.
Question 4: What does RPO (Recovery Point Objective) define in disaster recovery planning?
- How fast the system must be restored after failure
- The maximum amount of data loss acceptable, measured in time (Correct answer)
- The number of redundant servers required
- The response time for customer support tickets
Correct answer: The maximum amount of data loss acceptable, measured in time
RPO defines the maximum acceptable data loss expressed as a time interval — e.g., RPO of 1 hour means at most 1 hour of data can be lost.
Question 5: A full-stack application handles medical records. A risk assessment rates a data breach as HIGH impact. Under HIPAA, which additional obligation does this HIGH impact rating trigger?
- Optional notification to affected patients
- Mandatory breach notification to HHS and affected individuals (Correct answer)
- Only internal documentation is required
- The breach can be classified as a minor incident
Correct answer: Mandatory breach notification to HHS and affected individuals
HIPAA's Breach Notification Rule requires covered entities to notify HHS and affected individuals of breaches involving unsecured PHI.
Question 6: A team uses chaos engineering (e.g., Netflix's Chaos Monkey) to randomly terminate production instances. From a risk management perspective, this is PRIMARILY intended to:
- Reduce infrastructure costs by eliminating unnecessary servers
- Identify resilience weaknesses before real failures cause unplanned outages (Correct answer)
- Test developer response times to incidents
- Simulate DDoS attacks on the application
Correct answer: Identify resilience weaknesses before real failures cause unplanned outages
Chaos engineering proactively exposes system weaknesses by injecting controlled failures, allowing teams to fix them before they cause real incidents.
Question 7: When performing a DREAD risk scoring assessment, what does the 'D' stand for and what does it measure?
- Duration — how long an attack takes to execute
- Damage potential — how bad would the damage be if the exploit succeeded (Correct answer)
- Detectability — how easily logs capture the attack
- Distribution — how many users would be affected
Correct answer: Damage potential — how bad would the damage be if the exploit succeeded
In DREAD (Damage, Reproducibility, Exploitability, Affected users, Discoverability), 'D' for Damage measures the severity of harm if the vulnerability is exploited.
Full-Stack Development Risk Assessment & Management 5
A startup decides to launch without penetration testing because the timeline is tight.
This decision is an example of which risk response?