Full-Stack Development Risk Assessment & Management 5

Question 1

A startup decides to launch without penetration testing because the timeline is tight. This decision is an example of which risk response?

Accepted Answer

Risk acceptance

Answer

Knowingly proceeding without a security control due to business constraints is risk acceptance — acknowledging the risk and choosing to bear it.

Question 2

Which of the following is the BEST definition of 'attack surface' in a full-stack application?

Accepted Answer

The sum of all different points where an attacker can try to enter or extract data

Answer

Attack surface encompasses all input vectors, APIs, interfaces, and entry points that an attacker could potentially exploit.

Question 3

A team implements automated dependency scanning in their CI pipeline using tools like Snyk or Dependabot. This primarily addresses which risk category?

Accepted Answer

Third-party library vulnerability risk

Answer

Automated dependency scanning continuously monitors for known CVEs in third-party packages, directly addressing supply chain vulnerability risk.

Question 4

What does RPO (Recovery Point Objective) define in disaster recovery planning?

Accepted Answer

The maximum amount of data loss acceptable, measured in time

Answer

RPO defines the maximum acceptable data loss expressed as a time interval — e.g., RPO of 1 hour means at most 1 hour of data can be lost.

Question 5

A full-stack application handles medical records. A risk assessment rates a data breach as HIGH impact. Under HIPAA, which additional obligation does this HIGH impact rating trigger?

Accepted Answer

Mandatory breach notification to HHS and affected individuals

Answer

HIPAA's Breach Notification Rule requires covered entities to notify HHS and affected individuals of breaches involving unsecured PHI.

Full-Stack Development Practice Test

Full-Stack Development Practice Test

Full-Stack Development Risk Assessment & Management 5