NestJS Professional Standards & Competencies 4 — Questions and Answers
Question 1: A NestJS API receives file uploads. Which professional practice minimizes security risk?
- Accept all file types and sizes without restriction
- Validate file type via MIME type and magic bytes, enforce size limits, and store files outside the web root (Correct answer)
- Store uploaded files in the database as base64 strings
- Use a public S3 bucket with no access controls
Correct answer: Validate file type via MIME type and magic bytes, enforce size limits, and store files outside the web root
Validating MIME type, enforcing size limits, and using secure storage prevents path traversal, malware uploads, and resource exhaustion.
Question 2: What is the correct NestJS pattern for running expensive initialization logic once before the application starts accepting requests?
- Run it inside a controller constructor
- Implement `onModuleInit()` or `onApplicationBootstrap()` in the relevant provider (Correct answer)
- Use a setTimeout in the main bootstrap function
- Run it as a cron job on first startup
Correct answer: Implement `onModuleInit()` or `onApplicationBootstrap()` in the relevant provider
onModuleInit() and onApplicationBootstrap() lifecycle hooks provide deterministic initialization points before the app is fully ready.
Question 3: Which NestJS technique allows different environments (dev, staging, prod) to use different provider implementations without changing business logic?
- Hardcode environment checks inside each service
- Use dynamic modules or conditional providers based on environment variables (Correct answer)
- Create separate codebases for each environment
- Use feature flags stored in the database
Correct answer: Use dynamic modules or conditional providers based on environment variables
Dynamic modules and conditional provider registration allow swapping implementations at bootstrap time based on the environment.
Question 4: A team discovers that a NestJS interceptor is adding latency to every request. What is the professional debugging approach?
- Remove all interceptors immediately
- Use NestJS performance hooks or APM tooling to measure interceptor execution time and identify the bottleneck (Correct answer)
- Rewrite the application without interceptors
- Move interceptor logic to middleware
Correct answer: Use NestJS performance hooks or APM tooling to measure interceptor execution time and identify the bottleneck
Measuring with APM or custom timing identifies the specific interceptor and operation causing latency before making changes.
Question 5: What is the professional standard for handling database transactions that span multiple repository operations in NestJS with TypeORM?
- Call each repository method separately and hope for atomicity
- Use a DataSource QueryRunner or the @Transaction() pattern to wrap operations in a single atomic transaction (Correct answer)
- Use setTimeout to serialize calls
- Rely on database auto-commit for all operations
Correct answer: Use a DataSource QueryRunner or the @Transaction() pattern to wrap operations in a single atomic transaction
QueryRunner-based transactions guarantee atomicity across multiple operations, preventing partial writes on failure.
Question 6: Which NestJS practice improves cold-start time and memory usage in large applications?
- Import all modules eagerly in AppModule
- Use lazy-loaded modules with LazyModuleLoader for features not needed at startup (Correct answer)
- Disable the NestJS IoC container
- Merge all modules into a single flat module
Correct answer: Use lazy-loaded modules with LazyModuleLoader for features not needed at startup
LazyModuleLoader defers module initialization until first use, reducing startup time and initial memory footprint.
Question 7: A NestJS gRPC service must be versioned to avoid breaking existing clients. What is the recommended approach?
- Change the proto file in place and redeploy
- Use package versioning in the .proto file and maintain backward-compatible fields with reserved numbers for removed fields (Correct answer)
- Create a completely new service for each version
- Version via HTTP headers even though gRPC is used
Correct answer: Use package versioning in the .proto file and maintain backward-compatible fields with reserved numbers for removed fields
Proto package versioning combined with field reservation and additive-only changes preserves backward compatibility for existing clients.
NestJS Professional Standards & Competencies 4
A NestJS API receives file uploads.
Which professional practice minimizes security risk?