Node.js Risk Assessment & Management 2 — Questions and Answers
Question 1: Which Node.js built-in module provides cryptographically strong random values for security-sensitive operations?
- Math.random()
- crypto.randomBytes() (Correct answer)
- os.random()
- util.random()
Correct answer: crypto.randomBytes()
crypto.randomBytes() uses the OS CSPRNG and is safe for tokens, keys, and nonces, unlike Math.random() which is not cryptographically secure.
Question 2: A Node.js API endpoint deserializes user-supplied JSON and passes it directly to a database query. What is the primary risk?
- Memory exhaustion from large payloads
- NoSQL/SQL injection via unsanitized input (Correct answer)
- Event loop blocking on parse
- TLS handshake failure
Correct answer: NoSQL/SQL injection via unsanitized input
Passing unsanitized deserialized data directly to queries enables injection attacks that can expose or corrupt data.
Question 3: What risk does setting --max-old-space-size too low in production introduce?
- Slower startup time
- Increased CPU usage
- Process crashes under normal load due to OOM (Correct answer)
- Disabled garbage collection
Correct answer: Process crashes under normal load due to OOM
An undersized heap causes the V8 garbage collector to fail to reclaim enough memory, triggering fatal OOM process exits under typical traffic.
Question 4: Which technique mitigates the risk of prototype pollution attacks in a Node.js application?
- Using var instead of let
- Freezing Object.prototype with Object.freeze() (Correct answer)
- Running with --harmony flag
- Disabling the V8 optimizer
Correct answer: Freezing Object.prototype with Object.freeze()
Object.freeze(Object.prototype) prevents attackers from injecting properties into the shared prototype chain.
Question 5: A Node.js worker spawns a child process using exec() with user-supplied arguments. What is the primary risk?
- Race condition in the event loop
- Command injection allowing arbitrary OS execution (Correct answer)
- Memory leak in the child process
- Deadlock between parent and child
Correct answer: Command injection allowing arbitrary OS execution
exec() passes the command to a shell, so unescaped user input can inject additional shell commands.
Question 6: What risk does enabling the Node.js --inspect flag on a production server without binding restrictions introduce?
- Increased memory usage
- Remote code execution via unauthenticated debugger access (Correct answer)
- Slower event loop throughput
- Disabled TLS verification
Correct answer: Remote code execution via unauthenticated debugger access
The debugger protocol allows full JS execution context access; an attacker with network access can run arbitrary code.
Question 7: Which HTTP response header helps mitigate the risk of MIME-type sniffing attacks in a Node.js web application?
- Content-Encoding
- X-Content-Type-Options: nosniff (Correct answer)
- Cache-Control: no-store
- X-Frame-Options: DENY
Correct answer: X-Content-Type-Options: nosniff
X-Content-Type-Options: nosniff instructs browsers not to override the declared Content-Type, preventing script execution from mis-typed responses.
Node.js Risk Assessment & Management 2
Which Node.js built-in module provides cryptographically strong random values for security-sensitive operations?