NestJS Risk Assessment & Management 3 — Questions and Answers
Question 1: Which NestJS mechanism is best suited to log all unhandled exceptions centrally, supporting post-incident risk analysis?
- A global ExceptionFilter registered with useGlobalFilters() (Correct answer)
- A middleware registered in AppModule
- A lifecycle hook in OnModuleInit
- An interceptor that wraps all handlers
Correct answer: A global ExceptionFilter registered with useGlobalFilters()
A global ExceptionFilter catches every unhandled exception across all routes, making it the correct place to log errors and trigger alerts.
Question 2: What risk does enabling CORS with origin: '*' introduce in a NestJS REST API that uses cookie-based authentication?
- Any website can make credentialed cross-origin requests, enabling CSRF attacks (Correct answer)
- API response time increases due to preflight overhead
- JWT tokens are invalidated on cross-origin requests
- Swagger UI stops rendering correctly
Correct answer: Any website can make credentialed cross-origin requests, enabling CSRF attacks
Wildcard CORS with credentials allows any origin to send authenticated requests, undermining same-origin protections and enabling CSRF.
Question 3: In NestJS microservices, what risk does using a message broker without message validation introduce?
- Malformed or malicious payloads can crash consumers or corrupt data (Correct answer)
- Services cannot subscribe to multiple topics
- Event emitters block the Node.js event loop
- Serialization defaults to XML instead of JSON
Correct answer: Malformed or malicious payloads can crash consumers or corrupt data
Without schema validation on consumed messages, a bad payload can trigger unhandled exceptions in downstream microservices or insert corrupt data.
Question 4: Which NestJS-compatible tool helps assess dependency vulnerabilities as part of a supply-chain risk management process?
- npm audit or Snyk integrated into CI/CD pipelines (Correct answer)
- NestJS DevTools browser extension
- TypeORM migration runner
- Compodoc documentation generator
Correct answer: npm audit or Snyk integrated into CI/CD pipelines
npm audit and Snyk scan installed packages for known CVEs, enabling teams to patch vulnerable dependencies before deployment.
Question 5: A NestJS application processes file uploads. What risk is introduced if uploaded file types and sizes are not validated?
- Attackers can upload malicious executables or exhaust disk/memory with oversized files (Correct answer)
- Multer middleware silently rejects all files
- TypeScript decorators fail to compile
- CORS preflight requests are blocked
Correct answer: Attackers can upload malicious executables or exhaust disk/memory with oversized files
Without file-type and size checks, attackers can upload malware or trigger denial-of-service by sending excessively large files.
Question 6: What is the risk of using the any TypeScript type extensively in a NestJS application from a security perspective?
- It bypasses compile-time type checks, allowing unexpected data shapes to reach sensitive code paths (Correct answer)
- It causes NestJS dependency injection to fail at runtime
- It disables class-validator decorators automatically
- It forces Swagger to omit endpoint schemas
Correct answer: It bypasses compile-time type checks, allowing unexpected data shapes to reach sensitive code paths
Using any eliminates TypeScript's safety net, so malformed or malicious input can propagate unchecked into database queries or business logic.
Question 7: In NestJS, which rate-limiting strategy most directly mitigates the risk of brute-force attacks on an authentication endpoint?
- Applying ThrottlerGuard with a low TTL and limit on the login route (Correct answer)
- Using a global interceptor that logs all requests
- Enabling HTTPS termination at the load balancer
- Storing passwords with bcrypt
Correct answer: Applying ThrottlerGuard with a low TTL and limit on the login route
ThrottlerGuard enforces a maximum number of requests per time window, blocking repeated login attempts that characterize brute-force attacks.
NestJS Risk Assessment & Management 3
Which NestJS mechanism is best suited to log all unhandled exceptions centrally, supporting post-incident risk analysis?