React Native Risk Assessment & Management 3

Question 1

Which practice reduces the risk of supply-chain attacks when adding npm packages to a React Native project?

Accepted Answer

Pinning exact dependency versions and using a lockfile committed to source control

Answer

Pinned versions and a committed lockfile prevent unexpected package updates that could introduce malicious code.

Question 2

A React Native app crashes on Android 12+ but works on older versions. What risk factor should be assessed first?

Accepted Answer

New Android 12 behavioral changes (e.g., exact alarms, exported component flags) affecting native modules

Answer

Android 12 introduced strict enforcement of manifest flags like `android:exported`, causing crashes in apps with unupdated native modules.

Question 3

What is the primary risk of not enabling Hermes in a production React Native app?

Accepted Answer

Larger app startup time and increased memory usage compared to Hermes-optimized bytecode

Answer

Without Hermes, JSC must parse and JIT-compile JavaScript at startup, increasing time-to-interactive and memory footprint.

Question 4

Which risk does enabling `android:allowBackup="true"` in a React Native Android app's manifest introduce?

Accepted Answer

Sensitive app data including AsyncStorage can be extracted via ADB backup on non-rooted devices

Answer

ADB backup can extract the app's data directory, exposing unencrypted AsyncStorage and SQLite databases on debug-enabled devices.

Question 5

What is the risk of calling `setState` inside a `useEffect` without a cleanup function when the component unmounts?

Accepted Answer

Memory leak: React logs a warning and the state update targets an unmounted component

Answer

Updating state on an unmounted component causes a memory leak and React warning; the returned cleanup cancels async operations.

React Native Practice Test