Node.js Risk Assessment & Management 5

Question 1

What risk does calling child_process.exec() with shell interpolation of user data introduce compared to child_process.execFile()?

Accepted Answer

exec() passes input through a shell, enabling command injection; execFile() does not invoke a shell

Answer

exec() concatenates arguments into a shell command string, while execFile() passes arguments directly to the OS without shell interpretation, eliminating shell injection.

Question 2

Which package.json field should be audited regularly to reduce supply-chain risk from transitive dependencies?

Accepted Answer

scripts.postinstall hooks across all dependencies

Answer

Malicious packages often use postinstall scripts to execute arbitrary code at install time, making them a critical supply-chain attack vector.

Question 3

A Node.js microservice exposes an admin endpoint without authentication because it is 'internal only'. What risk does this create?

Accepted Answer

Server-side request forgery (SSRF) or lateral movement if any service is compromised

Answer

An attacker who compromises any service on the same network can call the unauthenticated admin endpoint, achieving lateral movement without additional credentials.

Question 4

What is the purpose of setting the httpOnly flag on session cookies in a Node.js application?

Accepted Answer

Prevents JavaScript from accessing the cookie, mitigating XSS-based session theft

Answer

httpOnly cookies are inaccessible to document.cookie and JS APIs, so even a successful XSS attack cannot exfiltrate the session token.

Question 5

Which risk management strategy is applied when a Node.js team decides to replace a vulnerable cryptographic library with a maintained alternative?

Accepted Answer

Risk remediation (mitigation)

Answer

Replacing a vulnerable component with a secure alternative directly reduces the likelihood and impact of the identified risk, which is remediation/mitigation.

Node.js Practice Test

Node.js Practice Test

Node.js Risk Assessment & Management 5