Node.js Risk Assessment & Management 2

Question 1

Which Node.js built-in module provides cryptographically strong random values for security-sensitive operations?

Accepted Answer

crypto.randomBytes()

Answer

crypto.randomBytes() uses the OS CSPRNG and is safe for tokens, keys, and nonces, unlike Math.random() which is not cryptographically secure.

Question 2

A Node.js API endpoint deserializes user-supplied JSON and passes it directly to a database query. What is the primary risk?

Accepted Answer

NoSQL/SQL injection via unsanitized input

Answer

Passing unsanitized deserialized data directly to queries enables injection attacks that can expose or corrupt data.

Question 3

What risk does setting --max-old-space-size too low in production introduce?

Accepted Answer

Process crashes under normal load due to OOM

Answer

An undersized heap causes the V8 garbage collector to fail to reclaim enough memory, triggering fatal OOM process exits under typical traffic.

Question 4

Which technique mitigates the risk of prototype pollution attacks in a Node.js application?

Accepted Answer

Freezing Object.prototype with Object.freeze()

Answer

Object.freeze(Object.prototype) prevents attackers from injecting properties into the shared prototype chain.

Question 5

A Node.js worker spawns a child process using exec() with user-supplied arguments. What is the primary risk?

Accepted Answer

Command injection allowing arbitrary OS execution

Answer

exec() passes the command to a shell, so unescaped user input can inject additional shell commands.

Node.js Practice Test