Node.js Professional Standards & Competencies 5 — Questions and Answers
Question 1: What professional standard applies when a Node.js developer discovers a security vulnerability in an open-source package they use?
- Keep it private and exploit it for competitive advantage
- Report it responsibly to the maintainer through the project's security disclosure process (Correct answer)
- Immediately post the vulnerability publicly on social media
- Stop using Node.js entirely
Correct answer: Report it responsibly to the maintainer through the project's security disclosure process
Responsible disclosure gives maintainers time to patch before public exposure, following coordinated vulnerability disclosure standards.
Question 2: Which Node.js coding practice aligns with the principle of 'fail fast'?
- Silently defaulting to fallback values when required config is missing
- Validating required configuration and throwing at startup if critical values are absent (Correct answer)
- Catching all errors and returning empty responses
- Using try/catch to suppress all startup errors
Correct answer: Validating required configuration and throwing at startup if critical values are absent
Failing fast at startup surfaces misconfigurations immediately rather than allowing a half-broken service to silently misbehave.
Question 3: What is the professional standard for code reviews in a Node.js team working on a production application?
- Developers merge their own code immediately to move fast
- All changes require at least one peer review before merging to the main branch (Correct answer)
- Code reviews are optional and only for junior developers
- Review only files larger than 100 lines
Correct answer: All changes require at least one peer review before merging to the main branch
Mandatory peer review catches bugs, spreads knowledge, and maintains code quality standards across the team.
Question 4: How does a professional Node.js developer ensure database query parameters are safe from SQL injection?
- Concatenate user input directly into SQL strings for simplicity
- Use parameterized queries or prepared statements, never string interpolation for user input (Correct answer)
- Sanitize input by removing all special characters before concatenation
- Only allow GET requests to interact with the database
Correct answer: Use parameterized queries or prepared statements, never string interpolation for user input
Parameterized queries separate data from SQL syntax at the driver level, making injection structurally impossible.
Question 5: What professional competency is demonstrated by writing a Node.js module with a single, well-defined responsibility?
- God Object pattern
- Single Responsibility Principle (SRP) (Correct answer)
- Dependency Inversion Principle
- Open/Closed Principle
Correct answer: Single Responsibility Principle (SRP)
SRP means each module does one thing well, making it easier to test, reuse, and change independently.
Question 6: Which approach is the professional standard for documenting a public Node.js REST API?
- Write comments in the source code only for internal developers
- Publish an OpenAPI (Swagger) specification so consumers can explore and test endpoints (Correct answer)
- Share a Word document with the API team via email
- Provide no documentation and expect users to read the source code
Correct answer: Publish an OpenAPI (Swagger) specification so consumers can explore and test endpoints
OpenAPI specs enable auto-generated interactive documentation, client SDKs, and contract testing.
Question 7: A junior developer on a Node.js project commits directly to the main branch and pushes breaking changes. Which professional practice would have prevented this?
- Granting all developers admin access to the repository
- Enforcing branch protection rules that require pull requests and passing CI checks before merging to main (Correct answer)
- Removing all CI/CD pipelines to speed up development
- Allowing only the team lead to read the repository
Correct answer: Enforcing branch protection rules that require pull requests and passing CI checks before merging to main
Branch protection rules with required CI checks create a quality gate that prevents untested or unreviewed code from reaching main.
Node.js Professional Standards & Competencies 5
What professional standard applies when a Node.js developer discovers a security vulnerability in an open-source package they use?