MEAN MEAN Stack Security and Deployment 4 — Questions and Answers
Question 1: Which HTTP header should be set to prevent clickjacking attacks in an Express.js application?
- Content-Security-Policy
- X-Frame-Options (Correct answer)
- X-XSS-Protection
- Strict-Transport-Security
Correct answer: X-Frame-Options
X-Frame-Options (set to DENY or SAMEORIGIN) prevents your page from being embedded in iframes, stopping clickjacking attacks.
Question 2: When deploying a MEAN stack app to production, what is the primary purpose of setting NODE_ENV=production?
- Enables debug logging for troubleshooting
- Disables template caching to speed up development
- Enables performance optimizations and disables verbose error messages (Correct answer)
- Automatically scales the application across multiple cores
Correct answer: Enables performance optimizations and disables verbose error messages
Setting NODE_ENV=production enables optimizations like template caching in Express and suppresses detailed error stack traces that could expose sensitive information.
Question 3: Which npm package is commonly used in Express to protect against common web vulnerabilities by setting various HTTP headers?
- cors
- helmet (Correct answer)
- passport
- express-validator
Correct answer: helmet
Helmet is an Express middleware that sets security-related HTTP headers like Content-Security-Policy, X-Frame-Options, and HSTS to reduce vulnerabilities.
Question 4: In a MongoDB deployment, what is the risk of using the default port 27017 without additional configuration?
- MongoDB cannot store JSON documents on the default port
- The database is publicly accessible if the firewall does not block the port (Correct answer)
- Replica sets cannot be configured on the default port
- Authentication tokens expire faster on default ports
Correct answer: The database is publicly accessible if the firewall does not block the port
Running MongoDB on its default port 27017 without firewall rules or bind_ip restrictions can expose the database to unauthorized internet access.
Question 5: What does CSRF stand for and how does the 'csurf' middleware protect against it in Express?
- Cross-Site Request Forgery; it validates a secret token submitted with each state-changing request (Correct answer)
- Cross-Server Resource Fetching; it blocks requests from unknown IP addresses
- Content Security Response Filter; it sanitizes HTML output before rendering
- Client-Side Request Forgery; it encrypts all form submissions with AES
Correct answer: Cross-Site Request Forgery; it validates a secret token submitted with each state-changing request
CSRF (Cross-Site Request Forgery) tricks authenticated users into submitting malicious requests; csurf generates and validates synchronizer tokens to ensure requests originate from your own forms.
Question 6: When using PM2 to deploy a Node.js application, what does the '--watch' flag do in a production environment?
- Monitors CPU and memory usage in real time
- Restarts the app automatically when file changes are detected (Correct answer)
- Watches for incoming HTTP requests and logs them
- Enables cluster mode to utilize all CPU cores
Correct answer: Restarts the app automatically when file changes are detected
PM2's --watch flag restarts the application whenever file changes are detected, which is useful in development but generally avoided in production to prevent unintended restarts.
Question 7: Which strategy best prevents NoSQL injection attacks in a MongoDB/Mongoose application?
- Encoding all query results as base64 before returning them to the client
- Using parameterized SQL queries instead of MongoDB operators
- Validating and sanitizing inputs and using Mongoose schemas to enforce data types (Correct answer)
- Disabling the MongoDB REST API endpoint on port 28017
Correct answer: Validating and sanitizing inputs and using Mongoose schemas to enforce data types
Validating user inputs and using Mongoose schemas enforce expected data types, preventing attackers from injecting MongoDB operators like $where or $gt into queries.
MEAN MEAN Stack Security and Deployment 4
Which HTTP header should be set to prevent clickjacking attacks in an Express.js application?