NestJS Risk Assessment & Management 2 — Questions and Answers
Question 1: In a NestJS application, which built-in utility validates and transforms incoming request payloads to reduce data-integrity risks?
- ValidationPipe (Correct answer)
- ExceptionFilter
- Interceptor
- Guard
Correct answer: ValidationPipe
ValidationPipe leverages class-validator and class-transformer to automatically validate DTOs, preventing malformed data from reaching business logic.
Question 2: Which NestJS feature should you enable to mitigate the risk of exposing sensitive properties in API responses?
- Response serialization via ClassSerializerInterceptor (Correct answer)
- Global exception filters
- Request throttling with ThrottlerGuard
- Helmet middleware
Correct answer: Response serialization via ClassSerializerInterceptor
ClassSerializerInterceptor uses @Exclude() and @Expose() decorators from class-transformer to strip sensitive fields before sending responses.
Question 3: A NestJS service depends on an external API. Which pattern best manages the risk of cascading failures when that API is unavailable?
- Circuit breaker pattern (Correct answer)
- Repository pattern
- Decorator pattern
- Saga pattern
Correct answer: Circuit breaker pattern
A circuit breaker stops forwarding requests to a failing dependency after a threshold, preventing resource exhaustion and cascading failures.
Question 4: When using NestJS with TypeORM, what risk does enabling synchronize: true in production introduce?
- Automatic schema changes can silently drop or alter columns, causing data loss (Correct answer)
- It disables query caching, reducing performance
- It prevents lazy loading of relations
- It exposes raw SQL errors to API consumers
Correct answer: Automatic schema changes can silently drop or alter columns, causing data loss
With synchronize: true, TypeORM auto-applies schema diffs on startup, which can destructively drop columns without any migration review.
Question 5: Which NestJS module configuration practice reduces the risk of secrets like database passwords being hard-coded in source code?
- Using ConfigModule with environment variables and a .env file excluded from version control (Correct answer)
- Storing secrets in app.module.ts constants
- Passing secrets as query parameters
- Using module forRoot() with inline credential strings
Correct answer: Using ConfigModule with environment variables and a .env file excluded from version control
ConfigModule reads secrets from environment variables, keeping credentials out of the codebase and away from version control.
Question 6: In NestJS, what is the primary security risk addressed by applying the @UseGuards(AuthGuard('jwt')) decorator to a controller?
- Unauthorized access by unauthenticated users (Correct answer)
- SQL injection in query parameters
- Memory leaks from unresolved promises
- CORS policy violations
Correct answer: Unauthorized access by unauthenticated users
AuthGuard enforces JWT verification before the route handler executes, blocking requests from unauthenticated callers.
Question 7: A NestJS app stores user sessions in memory. What availability risk does this introduce in a horizontally scaled deployment?
- Sessions are node-local, so users hitting different instances lose their session state (Correct answer)
- JWT tokens expire faster
- Database connections are exhausted
- Response times increase due to garbage collection
Correct answer: Sessions are node-local, so users hitting different instances lose their session state
In-memory sessions are not shared across multiple Node.js processes, causing session loss when load balancers route requests to different instances.
NestJS Risk Assessment & Management 2
In a NestJS application, which built-in utility validates and transforms incoming request payloads to reduce data-integrity risks?