NEW
Font size
Worksheetsnosql 1 Quiz
Total questions: 15
Worksheet time: 8mins
Which guarantee is often associated with relational databases but is not automatically provided by many document stores?
Always linear horizontal scaling
Built-in schemaless flexibility
Guaranteed fastest read latency
ACID transactional properties
When a web API blindly uses req.body as a query filter, what kind of user-supplied element most directly changes query semantics?
Trailing whitespace in string values
Extra JSON comments inserted by the client
Boolean flags encoded as strings
JSON query operators like $ne, $or, $gt
What developer habit most commonly opens an application to classic SQL injection (textual SQL manipulation)?
Using strict type definitions in DTOs
Sending all queries through a single DB access layer
Avoiding dynamic SQL entirely
Concatenating user input into SQL statement strings
What is the most important immediate code change when replacing db.collection.find(req.body) to stop operator injection?
Return raw DB documents to the client for debugging
Allow only XML input instead of JSON
Wrap the whole request body in a string and store it
Construct a new filter: extract expected fields, validate types, and only include those keys
Which API-layer control most directly prevents clients from sending operator keys like $where?
Relying on client-side JavaScript to clean inputs
Using transport-layer encryption (TLS) only
Logging incoming requests but not rejecting them
Rejecting or stripping keys that start with $ and whitelisting allowed fields
What role does a JSON schema library (e.g., Joi) play alongside parameterized routes?
It replaces the DB user permission model
It makes client-side validation unnecessary
It converts find() into raw SQL internally
It validates input shape/types before building queries
Which Mongoose-related benefit most helps prevent NoSQL operator injection?
Automatically running DB backups
Implicitly granting admin roles to the model
Automatically converting all objects to strings
Enforcing a schema so unexpected operator objects are rejected or cast
Which action most reduces blast radius if an attacker succeeds in injecting queries?
Give the app a single all-powerful DB user for simplicity
Open DB ports to the app server without firewall rules
Disable audit logging to avoid information disclosure
Use least-privilege DB roles so the app account only accesses necessary collections
Which logging/monitoring setup best helps you detect operator-injection attempts without blocking legitimate users?
Never store any request bodies to preserve privacy
Only log server start/stop messages
Log everything to a single local file and never rotate it
Send structured request logs to a centralized SIEM and alert on $-prefixed keys or unusual query shapes
Even with parameterized queries, which pattern can reintroduce injection-like risks?
Using DB drivers that support placeholders
Validating user-supplied numeric IDs server-side
Applying schema validation on inputs
Dynamically building identifiers or raw query fragments by concatenating derived strings
Why are NoSQLi attempts often harder for signature-based WAF rules to catch than SQLi?
NoSQLi always uses the same fixed token that WAFs already block
NoSQLi payloads are always encrypted end-to-end
NoSQLi only happens on local dev machines, not production
Operator-based attacks are structured JSON objects that can look like benign payloads and vary widely
Which change is the safest quick patch if you discover public endpoints accepting arbitrary aggregation stages?
Allow arbitrary admin tokens for easier testing
Disable HTTPS to simplify debugging
Return DB error stacks verbatim to clients to speed triage
Refuse client-supplied pipeline stages; only allow server-built, validated pipeline templates
What defensive measure most directly prevents attackers from executing JavaScript inside MongoDB via user input?
Enabling $where by default for flexibility
Accepting client JS snippets and eval()ing them on demand
Putting DB credentials in client-side code for speed
Disabling server-side JS features like $where/$function and rejecting user-supplied code
Which pattern in logs would most clearly indicate repeated operator-injection probing?
Mostly GETs for static assets like /favicon.ico
Only legitimate admin console activity at business hours
A steady stream of identical benign search queries
Many requests whose bodies/params contain $ne, $or, $where, or similar tokens
When is whitelisting field names inadequate by itself to stop NoSQLi?
When you also validate types and lengths thoroughly
When you strip $-prefixed keys before validation
When you build queries only from whitelisted keys server-side
When whitelisted values are concatenated into identifiers or used to construct raw query fragments
