MEAN MEAN Stack Security and Deployment 4

Question 1

Which HTTP header should be set to prevent clickjacking attacks in an Express.js application?

Accepted Answer

X-Frame-Options

Answer

X-Frame-Options (set to DENY or SAMEORIGIN) prevents your page from being embedded in iframes, stopping clickjacking attacks.

Question 2

When deploying a MEAN stack app to production, what is the primary purpose of setting NODE_ENV=production?

Accepted Answer

Enables performance optimizations and disables verbose error messages

Answer

Setting NODE_ENV=production enables optimizations like template caching in Express and suppresses detailed error stack traces that could expose sensitive information.

Question 3

Which npm package is commonly used in Express to protect against common web vulnerabilities by setting various HTTP headers?

Accepted Answer

helmet

Answer

Helmet is an Express middleware that sets security-related HTTP headers like Content-Security-Policy, X-Frame-Options, and HSTS to reduce vulnerabilities.

Question 4

In a MongoDB deployment, what is the risk of using the default port 27017 without additional configuration?

Accepted Answer

The database is publicly accessible if the firewall does not block the port

Answer

Running MongoDB on its default port 27017 without firewall rules or bind_ip restrictions can expose the database to unauthorized internet access.

Question 5

What does CSRF stand for and how does the 'csurf' middleware protect against it in Express?

Accepted Answer

Cross-Site Request Forgery; it validates a secret token submitted with each state-changing request

Answer

CSRF (Cross-Site Request Forgery) tricks authenticated users into submitting malicious requests; csurf generates and validates synchronizer tokens to ensure requests originate from your own forms.

MEAN - Stack Development Practice Test

MEAN - Stack Development Practice Test

MEAN MEAN Stack Security and Deployment 4