LARAVEL Risk Assessment & Management 5

Question 1

What risk management practice does Laravel's `php artisan config:cache` command require regarding .env changes in production?

Accepted Answer

Config cache must be cleared and regenerated after any .env change, or the app continues using stale cached values

Answer

When config cache is active, Laravel ignores .env at runtime; stale secrets or settings remain live until the cache is regenerated.

Question 2

Which Laravel feature allows you to limit the risk of a compromised queue worker by scoping what a queued job is permitted to do?

Accepted Answer

Job middleware with rate limiting and before/after hooks

Answer

Job middleware lets you wrap jobs with authorization checks, rate limits, and try/catch hooks to constrain and monitor job behavior.

Question 3

What is the primary security risk of exposing Laravel Telescope in a production environment without authentication?

Accepted Answer

Unauthenticated users can view all requests, queries, jobs, mail, and exceptions — leaking sensitive application internals

Answer

Telescope records detailed telemetry including request payloads and DB queries; open access gives attackers a live view of application internals.

Question 4

A Laravel app builds shell commands with user input using exec(). What is the correct Laravel-idiomatic mitigation?

Accepted Answer

Use escapeshellarg() on all user inputs, or better yet avoid exec() entirely by using Laravel's built-in abstractions

Answer

Shell metacharacters in user input enable command injection; escapeshellarg() neutralizes them, but preferring Laravel's Storage, Process facade, or similar APIs eliminates the risk.

Question 5

How does Laravel's policy `before()` method introduce a risk if used carelessly?

Accepted Answer

Returning true from before() grants all permissions unconditionally, bypassing all other policy checks for that user

Answer

The before() hook short-circuits all other policy methods when it returns true, so a bug or overly broad condition silently grants full access.

LARAVEL - Laravel PHP Framework Practice Test

LARAVEL - Laravel PHP Framework Practice Test

LARAVEL Risk Assessment & Management 5