Ruby on Rails Professional Standards & Competencies 5 — Questions and Answers
Question 1: A Rails developer is building a multi-tenant SaaS app. Which competency is critical to prevent data leakage between tenants?
- Using separate databases per tenant always
- Scoping every query to the current tenant using a default scope or explicit where clause, with test coverage verifying isolation (Correct answer)
- Relying on UI-level filtering to hide other tenants' data
- Using `find` instead of `find_by` for all lookups
Correct answer: Scoping every query to the current tenant using a default scope or explicit where clause, with test coverage verifying isolation
Tenant scoping at the query level with dedicated tests is the professional standard; relying solely on UI filtering leaves a critical security gap.
Question 2: What professional practice should Rails developers follow when deprecating an internal API used by multiple teams?
- Remove it immediately and notify teams after the fact
- Add deprecation warnings, communicate a sunset timeline, and provide a migration guide before removing (Correct answer)
- Keep it indefinitely to avoid breaking changes
- Only remove it when the last caller is manually removed
Correct answer: Add deprecation warnings, communicate a sunset timeline, and provide a migration guide before removing
Professional API lifecycle management requires advance notice with deprecation warnings, a sunset date, and a migration path so consuming teams can adapt without surprise breakages.
Question 3: A Rails developer notices that `rails stats` shows an extremely high lines-of-code-to-test ratio. What professional concern does this raise?
- The app is too large and should be split immediately
- Insufficient test coverage relative to application code, indicating technical debt and increased regression risk (Correct answer)
- The app is well-optimized and has minimal redundancy
- rails stats is not a meaningful metric
Correct answer: Insufficient test coverage relative to application code, indicating technical debt and increased regression risk
`rails stats` code-to-test ratio is a quick proxy for test coverage; a very high ratio suggests the codebase is under-tested and carries significant regression risk.
Question 4: What does using `strong_parameters` with explicit `permit` calls in Rails controllers demonstrate?
- A workaround for a Rails bug
- Competency in mass-assignment protection, a security standard that prevents attackers from injecting unauthorized attributes (Correct answer)
- An alternative to ActiveRecord validations
- Legacy Rails 3 compatibility code
Correct answer: Competency in mass-assignment protection, a security standard that prevents attackers from injecting unauthorized attributes
Strong Parameters enforce a whitelist of allowed attributes per action, preventing mass-assignment attacks where attackers submit extra fields like `admin: true`.
Question 5: Which Rails practice best demonstrates a competency in application observability?
- Only checking error logs when users report bugs
- Integrating structured logging, exception tracking (e.g., Sentry), and performance monitoring (e.g., Skylight) from day one (Correct answer)
- Using `puts` statements for debugging in production
- Relying solely on server uptime checks
Correct answer: Integrating structured logging, exception tracking (e.g., Sentry), and performance monitoring (e.g., Skylight) from day one
Proactive observability with structured logs, exception tracking, and APM tooling from the start is a professional standard that enables rapid diagnosis before users are impacted.
Question 6: A Rails project has zero documentation and a new developer joins the team. What professional artifact should the team create first?
- A comprehensive UML diagram of all models
- A README with setup instructions, architecture overview, and links to key conventions, followed by inline documentation for complex logic (Correct answer)
- Detailed comments on every line of code
- A Confluence wiki with the full business requirements
Correct answer: A README with setup instructions, architecture overview, and links to key conventions, followed by inline documentation for complex logic
A well-structured README with setup and architecture context is the highest-ROI first documentation investment, enabling new developers to become productive quickly.
Question 7: What professional standard does a Rails developer follow when storing user passwords?
- Encrypting passwords with AES-256 and storing the cipher text
- Using `has_secure_password` which automatically hashes with bcrypt, never storing plaintext or reversible forms (Correct answer)
- Storing a salted MD5 hash of the password
- Using base64 encoding for storage efficiency
Correct answer: Using `has_secure_password` which automatically hashes with bcrypt, never storing plaintext or reversible forms
`has_secure_password` uses bcrypt (via the `bcrypt` gem) for secure one-way hashing — the Rails-standard and industry-standard approach for credential storage.
Ruby on Rails Professional Standards & Competencies 5
A Rails developer is building a multi-tenant SaaS app.
Which competency is critical to prevent data leakage between tenants?