Ruby on Rails Risk Assessment & Management 5

Question 1

What is the primary risk of storing sensitive user data (e.g., SSNs, credit card numbers) in plain text in a Rails PostgreSQL database?

Accepted Answer

A database breach directly exposes all sensitive data with no further attack steps needed

Answer

Plain-text sensitive data means a single database read or backup theft yields immediately usable information with no decryption required.

Question 2

Which risk does an unvalidated file upload feature in Rails introduce if uploaded files are served from the same origin as the app?

Accepted Answer

Stored XSS or web shell execution if the server processes uploaded HTML, SVG, or script files

Answer

Serving attacker-uploaded HTML or SVG files from your origin allows JavaScript execution in victim browsers under your domain's trust context.

Question 3

What risk does a Gem with an unpatched CVE in your Gemfile.lock represent beyond the vulnerability itself?

Accepted Answer

The vulnerable code is deployed into production until the Gemfile.lock is updated and redeployed, extending the exposure window

Answer

Gemfile.lock pins exact versions, so the vulnerable gem persists in all environments until a developer explicitly updates and redeploys.

Question 4

Which risk does inadequate input validation on a Rails Active Job argument introduce?

Accepted Answer

Attackers who can enqueue jobs may inject malicious payloads that execute with background worker privileges

Answer

Background workers often run with elevated permissions and less request-cycle security context, making unvalidated job arguments a high-impact injection vector.

Question 5

In Rails, what security risk does using `render inline:` with user-supplied content introduce?

Accepted Answer

Server-Side Template Injection (SSTI), allowing arbitrary Ruby code execution via ERB tags in the input

Answer

render inline: evaluates the string as an ERB template; user-supplied <%= %> tags execute arbitrary Ruby on the server.

Ruby on Rails Practice Test

Ruby on Rails Practice Test

Ruby on Rails Risk Assessment & Management 5