React Native Risk Assessment & Management 5 — Questions and Answers
Question 1: Which risk is introduced by using `KeyboardAvoidingView` without testing on both iOS and Android physical devices?
- The behavior prop value differs between platforms, causing overlapping or displaced UI on one platform (Correct answer)
- KeyboardAvoidingView causes memory leaks on Android 11+
- The component prevents ScrollView from scrolling on iOS
- Metro will emit a warning and skip the component in the production bundle
Correct answer: The behavior prop value differs between platforms, causing overlapping or displaced UI on one platform
`behavior='padding'` works on iOS while `behavior='height'` is often needed on Android, and failure to test both leads to broken layouts.
Question 2: What threat does certificate pinning in a React Native app protect against?
- Man-in-the-middle attacks that use a trusted CA-signed certificate to intercept HTTPS traffic (Correct answer)
- Expired SSL certificates causing app crashes
- Unauthorized OTA updates pushed to the JS bundle
- DNS hijacking of the app's crash reporting endpoint
Correct answer: Man-in-the-middle attacks that use a trusted CA-signed certificate to intercept HTTPS traffic
Certificate pinning validates the server's certificate against a hardcoded fingerprint, blocking MITM attacks even with rogue trusted CAs.
Question 3: A React Native app's crash rate spikes after a Play Store update but not on the iOS App Store. What should be assessed first?
- Android-specific native module incompatibility or a new Android OS behavioral change affecting only the Android build (Correct answer)
- A JavaScript syntax error introduced that only Hermes on Android parses differently
- A React Navigation version that only runs on iOS
- A missing CocoaPods dependency that affects Android Gradle
Correct answer: Android-specific native module incompatibility or a new Android OS behavioral change affecting only the Android build
Platform-specific crash spikes point to Android-only native module issues, Gradle build differences, or new Android OS restrictions as the first investigation priority.
Question 4: What risk does relying solely on `try/catch` for error handling in async React Native code introduce?
- Unhandled promise rejections in event handlers and callbacks silently fail without triggering the catch block (Correct answer)
- The JavaScript engine will stop executing after the first caught error
- Native module errors cannot be caught in JavaScript
- Hermes disables the call stack for caught errors in production
Correct answer: Unhandled promise rejections in event handlers and callbacks silently fail without triggering the catch block
Not all async errors propagate to a try/catch — unhandled rejections in fire-and-forget promises and event callbacks require a global rejection handler.
Question 5: Which risk assessment consideration is specific to React Native apps using the New Architecture (Fabric + TurboModules)?
- Third-party libraries using the legacy bridge may be incompatible and require a JSI-native rewrite (Correct answer)
- Hermes engine is disabled automatically when Fabric is enabled
- Metro bundler cannot generate source maps for New Architecture builds
- TypeScript type checking is bypassed for all JSI native modules
Correct answer: Third-party libraries using the legacy bridge may be incompatible and require a JSI-native rewrite
The New Architecture deprecates the asynchronous bridge; libraries using the old NativeModules API must be migrated to JSI/TurboModules to remain compatible.
Question 6: What is the risk of using `InteractionManager.runAfterInteractions` incorrectly when navigating between heavy screens?
- If not properly queued, expensive operations can still run during the navigation animation, causing jank (Correct answer)
- InteractionManager blocks the native UI thread on Android
- The callback is never executed if the component unmounts before navigation completes
- Metro hot reload is disabled while InteractionManager has pending callbacks
Correct answer: If not properly queued, expensive operations can still run during the navigation animation, causing jank
Work queued before the current interaction (animation) completes still runs during it; ensure you register the task after the interaction start event.
Question 7: A React Native team skips end-to-end testing and relies only on manual QA before releases. Which risk management framework concept does this violate?
- Risk mitigation through automated controls — manual-only QA is a detective control with high human error probability (Correct answer)
- The principle of least privilege for app permissions
- Continuous integration gate requirements for native builds
- OWASP Mobile Top 10 requirement for automated scanning
Correct answer: Risk mitigation through automated controls — manual-only QA is a detective control with high human error probability
Automated E2E tests are a preventive control that catches regressions consistently; manual QA alone is a weak detective control prone to human error and coverage gaps.
React Native Risk Assessment & Management 5
Which risk is introduced by using `KeyboardAvoidingView` without testing on both iOS and Android physical devices?