React Native Risk Assessment & Management 2

Question 1

Which tool is commonly used to audit React Native project dependencies for known security vulnerabilities?

Accepted Answer

npm audit

Answer

`npm audit` scans the dependency tree against the npm advisory database and reports known CVEs.

Question 2

A React Native app stores JWT tokens in AsyncStorage. What is the primary security risk?

Accepted Answer

Tokens are readable by other apps on jailbroken/rooted devices

Answer

AsyncStorage is unencrypted and accessible on compromised devices, making it unsuitable for sensitive credentials.

Question 3

Which React Native risk is introduced when upgrading to a new major version without a migration guide?

Accepted Answer

Breaking API changes can silently fail at runtime

Answer

Major version upgrades often include breaking changes that may not surface until runtime if native modules are not updated in sync.

Question 4

What risk does the `react-native-upgrade-helper` tool specifically help mitigate?

Accepted Answer

Missing or incorrect native file changes during an RN version upgrade

Answer

The Upgrade Helper diffs the RN template between versions so developers can manually apply the correct native file changes.

Question 5

A third-party React Native library has not been updated in 18 months. Which risk assessment concern is MOST relevant?

Accepted Answer

The library may not support new Android/iOS API levels or new RN architecture

Answer

Unmaintained libraries risk incompatibility with newer OS API levels, new RN architecture (Fabric/JSI), and security patches.

React Native Practice Test