Ruby on Rails Risk Assessment & Management 2

Question 1

Which Rails mechanism helps mitigate mass assignment vulnerabilities introduced before Strong Parameters?

Accepted Answer

attr_accessible / attr_protected in the model

Answer

attr_accessible and attr_protected were the Rails 3 approach to whitelisting/blacklisting mass-assignable attributes before Strong Parameters replaced them in Rails 4.

Question 2

A Rails app stores session data in cookies. Which risk does this introduce that server-side sessions avoid?

Accepted Answer

Client-side tampering if the secret_key_base is compromised

Answer

Cookie-based sessions are signed with secret_key_base; if that key leaks, attackers can forge arbitrary session data.

Question 3

Which Rails logger setting should be applied in production to reduce the risk of leaking sensitive request parameters in log files?

Accepted Answer

config.filter_parameters with sensitive key names

Answer

config.filter_parameters causes Rails to replace matching parameter values with [FILTERED] in logs, preventing credential leakage.

Question 4

What is the primary risk of using Rails' default development error page (`consider_all_requests_local = true`) in a production environment?

Accepted Answer

It exposes full stack traces, source code snippets, and environment variables to end users

Answer

The detailed exception page reveals internal file paths, gem versions, and sometimes environment variables that attackers can exploit.

Question 5

Which Rake/Rails command helps identify outdated gems with known security vulnerabilities in a Rails project?

Accepted Answer

bundle audit

Answer

The bundler-audit gem's `bundle audit` command cross-references your Gemfile.lock against the Ruby Advisory Database for known CVEs.

Ruby on Rails Practice Test

Ruby on Rails Practice Test

Ruby on Rails Risk Assessment & Management 2