MEAN MEAN Stack Security and Deployment 5 — Questions and Answers
Question 1: What is the recommended way to store sensitive configuration values (e.g., JWT secrets, DB passwords) in a MEAN stack production deployment?
- Hard-code them in the server.js file for reliability
- Store them in a .env file committed to the Git repository
- Use environment variables loaded at runtime, never committed to source control (Correct answer)
- Encrypt them with MD5 and store them in the MongoDB config collection
Correct answer: Use environment variables loaded at runtime, never committed to source control
Sensitive values should be stored as environment variables (e.g., via dotenv locally, secrets managers in production) and never committed to version control.
Question 2: In an Angular application deployed to production, what does the '--configuration production' flag do during the build?
- Skips TypeScript type checking to speed up the build
- Enables AOT compilation, tree-shaking, and minification for optimized output (Correct answer)
- Generates source maps and disables lazy loading
- Runs unit tests before bundling the application
Correct answer: Enables AOT compilation, tree-shaking, and minification for optimized output
The production configuration enables Ahead-of-Time (AOT) compilation, minification, dead code elimination, and other optimizations that reduce bundle size.
Question 3: What is the purpose of a reverse proxy like Nginx in front of a Node.js/Express application?
- It compiles TypeScript files before forwarding requests to Node.js
- It handles SSL termination, load balancing, and serves static files efficiently (Correct answer)
- It replaces the need for MongoDB by caching query results in memory
- It enforces JWT authentication before requests reach Express
Correct answer: It handles SSL termination, load balancing, and serves static files efficiently
Nginx acts as a reverse proxy to handle SSL/TLS termination, distribute traffic across Node.js instances, and efficiently serve static assets without burdening Node.
Question 4: Which bcrypt function parameter directly controls how computationally expensive password hashing is?
- The hash length in bytes
- The salt rounds (cost factor) (Correct answer)
- The encoding algorithm (UTF-8 vs ASCII)
- The pepper string appended before hashing
Correct answer: The salt rounds (cost factor)
The salt rounds (cost factor) determines the number of iterations (2^rounds) bcrypt performs, making brute-force attacks exponentially harder as the value increases.
Question 5: When configuring CORS in Express for a production MEAN stack app, what is the security risk of setting 'origin: *'?
- It forces all responses to use HTTP instead of HTTPS
- It allows any domain to make cross-origin requests to your API, including malicious sites (Correct answer)
- It disables preflight OPTIONS requests, breaking Angular HTTP clients
- It causes Express to reject requests without a Content-Type header
Correct answer: It allows any domain to make cross-origin requests to your API, including malicious sites
Setting origin: '*' permits any website to call your API, which can enable cross-origin attacks; production apps should whitelist only trusted domains.
Question 6: What is the role of a Docker health check in a containerized MEAN stack deployment?
- It scans container images for known CVEs before deployment
- It periodically tests whether the container's application is responding correctly so orchestrators can restart unhealthy instances (Correct answer)
- It monitors MongoDB replication lag and alerts the admin
- It validates environment variables are set before the container starts
Correct answer: It periodically tests whether the container's application is responding correctly so orchestrators can restart unhealthy instances
A Docker health check runs a command at intervals to verify the app inside the container is healthy, allowing Kubernetes or Docker Swarm to restart or replace unresponsive containers.
Question 7: In JWT-based authentication for a MEAN stack API, what vulnerability arises from accepting the 'none' algorithm in the token header?
- The token payload is double-encoded, causing parsing errors in Angular
- An attacker can forge tokens without a signature by specifying alg: 'none' (Correct answer)
- The JWT expiration claim is ignored when no algorithm is specified
- MongoDB rejects unsigned tokens when used as session identifiers
Correct answer: An attacker can forge tokens without a signature by specifying alg: 'none'
Some JWT libraries historically accepted alg: 'none', allowing attackers to strip the signature and craft arbitrary payloads that the server would accept as valid.
MEAN MEAN Stack Security and Deployment 5
What is the recommended way to store sensitive configuration values (e.g., JWT secrets, DB passwords) in a MEAN stack production deployment?