Ruby on Rails Professional Standards & Competencies 4 — Questions and Answers
Question 1: A Rails API endpoint is returning sensitive user data in error messages in production. What is the immediate professional response?
- Document it as a known issue
- Disable detailed error responses in production via `config.consider_all_requests_local = false` and sanitize error output (Correct answer)
- Add a comment in the code explaining the exposure
- Only fix it in the next scheduled release cycle
Correct answer: Disable detailed error responses in production via `config.consider_all_requests_local = false` and sanitize error output
Exposing sensitive data in production error messages is a security incident requiring immediate remediation by disabling detailed errors and sanitizing all error responses.
Question 2: Which competency best describes a Rails developer who writes `before_action :authenticate_user!` only on actions that require authentication?
- Lazy programming
- Principle of Least Privilege applied to controller design (Correct answer)
- Over-engineering
- Violation of RESTful conventions
Correct answer: Principle of Least Privilege applied to controller design
Scoping authentication callbacks to only the actions that require them demonstrates the Principle of Least Privilege, minimizing both attack surface and unintended access restrictions.
Question 3: When should a Rails developer choose background jobs (Sidekiq/GoodJob) over inline processing in a request cycle?
- Always, for every database operation
- For operations that are slow, failure-tolerant, or don't require immediate user feedback (emails, reports, API calls) (Correct answer)
- Only for sending emails
- Only when the operation takes more than 10 seconds
Correct answer: For operations that are slow, failure-tolerant, or don't require immediate user feedback (emails, reports, API calls)
Background jobs are the professional standard for any work that is slow, can fail and be retried, or doesn't need to block the HTTP response.
Question 4: A client asks a Rails developer to implement a feature that would allow bulk-exporting all user PII without authentication. What is the professional response?
- Implement it exactly as requested
- Refuse to implement it and explain the legal and security risks, proposing a secure authenticated alternative (Correct answer)
- Implement it but add a comment warning about risks
- Delegate the decision to a junior developer
Correct answer: Refuse to implement it and explain the legal and security risks, proposing a secure authenticated alternative
Professionals have an ethical obligation to refuse requests that create serious security and legal risks, and to propose safer alternatives rather than simply complying.
Question 5: What does maintaining a well-structured CHANGELOG in a Rails project demonstrate about a developer?
- Excessive documentation habits
- Professional communication skills and commitment to transparent version history for team members and users (Correct answer)
- Git skills, since changelogs are auto-generated
- Only necessary for open source projects
Correct answer: Professional communication skills and commitment to transparent version history for team members and users
A maintained CHANGELOG demonstrates professionalism by giving team members and users a clear, human-readable history of changes, decisions, and breaking changes over time.
Question 6: How does a senior Rails developer demonstrate mentorship competency during code review?
- Rewriting the code themselves instead of reviewing
- Providing specific, actionable feedback with explanations and links to relevant documentation or Rails guides (Correct answer)
- Approving all PRs to avoid conflict
- Only leaving comments on style issues
Correct answer: Providing specific, actionable feedback with explanations and links to relevant documentation or Rails guides
Effective mentorship in code review involves specific, educational feedback that helps the author grow, not just identifying issues without explanation.
Question 7: Which Rails competency is demonstrated by writing service objects to encapsulate complex business workflows?
- Over-engineering simple CRUD apps
- Single Responsibility Principle applied to Rails architecture, keeping models and controllers focused (Correct answer)
- Avoiding ActiveRecord validations
- Replacing all ActiveRecord models with plain Ruby classes
Correct answer: Single Responsibility Principle applied to Rails architecture, keeping models and controllers focused
Service objects embody the Single Responsibility Principle by extracting multi-step business logic from models and controllers into dedicated, testable classes.
Ruby on Rails Professional Standards & Competencies 4
A Rails API endpoint is returning sensitive user data in error messages in production.
What is the immediate professional response?