nosql 1 Quiz

Which guarantee is often associated with relational databases but is not automatically provided by many document stores?

• Always linear horizontal scaling

• Built-in schemaless flexibility

• Guaranteed fastest read latency

• ACID transactional properties

When a web API blindly uses req.body as a query filter, what kind of user-supplied element most directly changes query semantics?

• Trailing whitespace in string values

• Extra JSON comments inserted by the client

• Boolean flags encoded as strings

• JSON query operators like $ne, $or, $gt

What developer habit most commonly opens an application to classic SQL injection (textual SQL manipulation)?

• Using strict type definitions in DTOs

• Sending all queries through a single DB access layer

• Avoiding dynamic SQL entirely

• Concatenating user input into SQL statement strings

What is the most important immediate code change when replacing db.collection.find(req.body) to stop operator injection?

• Return raw DB documents to the client for debugging

• Allow only XML input instead of JSON

• Wrap the whole request body in a string and store it

• Construct a new filter: extract expected fields, validate types, and only include those keys

Which API-layer control most directly prevents clients from sending operator keys like $where?

• Relying on client-side JavaScript to clean inputs

• Using transport-layer encryption (TLS) only

• Logging incoming requests but not rejecting them

• Rejecting or stripping keys that start with $ and whitelisting allowed fields

What role does a JSON schema library (e.g., Joi) play alongside parameterized routes?

• It replaces the DB user permission model

• It makes client-side validation unnecessary

• It converts find() into raw SQL internally

• It validates input shape/types before building queries

Which Mongoose-related benefit most helps prevent NoSQL operator injection?

• Automatically running DB backups

• Implicitly granting admin roles to the model

• Automatically converting all objects to strings

• Enforcing a schema so unexpected operator objects are rejected or cast

Which action most reduces blast radius if an attacker succeeds in injecting queries?

• Give the app a single all-powerful DB user for simplicity

• Open DB ports to the app server without firewall rules

• Disable audit logging to avoid information disclosure

• Use least-privilege DB roles so the app account only accesses necessary collections

Which logging/monitoring setup best helps you detect operator-injection attempts without blocking legitimate users?

• Never store any request bodies to preserve privacy

• Only log server start/stop messages

• Log everything to a single local file and never rotate it

• Send structured request logs to a centralized SIEM and alert on $-prefixed keys or unusual query shapes

Even with parameterized queries, which pattern can reintroduce injection-like risks?

• Using DB drivers that support placeholders

• Validating user-supplied numeric IDs server-side

• Applying schema validation on inputs

• Dynamically building identifiers or raw query fragments by concatenating derived strings