[NEW] Angular Security Best Practices

Preventing Common Web Vulnerabilities (40%)

Secure Development and Best Practices (30%)

B) Angular HttpInterceptor

C) Angular DomSanitizer

D) Angular Route Guards

E) Angular ngModel

F) Angular Content Security Policy (CSP) configurations

Correct Answer: C) Angular DomSanitizer

Explanation:

B is incorrect because HttpInterceptors intercept and modify HTTP requests and responses, not HTML bindings.

C is correct because Angular's DomSanitizer automatically inspects untrusted values and strips out malicious scripts or styles before they are injected into the DOM, effectively mitigating XSS attacks.

D is incorrect because Route Guards prevent unauthorized navigation, not malicious code execution in templates.

E is incorrect because ngModel is used for two-way data binding, not security sanitization.

F is incorrect because while a CSP is an important security layer, it is a server-delivered HTTP header, not an internal Angular mechanism.

Question 2: When implementing Cross-Site Request Forgery (CSRF) protection in an Angular application, how does the HttpClient module handle the XSRF token by default?

B) It automatically reads a cookie named XSRF-TOKEN and sends it as an HTTP header named X-XSRF-TOKEN on mutating requests.

C) It generates a new secure token on every request and appends it to the URL parameters.

D) It relies entirely on the backend to enforce and validate origin headers without client-side intervention.

E) It creates a hidden form field with the CSRF token for every POST request submitted.

F) It intercepts all requests and encrypts the payload using AES-256 before transmission.

Correct Answer: B) It automatically reads a cookie named XSRF-TOKEN and sends it as an HTTP header named X-XSRF-TOKEN on mutating requests.

Explanation:

B is correct because Angular's HttpClient includes built-in XSRF protection. If the server sets a cookie named XSRF-TOKEN, Angular automatically reads it and attaches it as the X-XSRF-TOKEN header for all mutating requests like POST and PUT.

C is incorrect because appending tokens to URLs is insecure and exposes them in browser history.

D is incorrect because Angular actively participates in the defense-in-depth strategy by attaching the header automatically.

E is incorrect because hidden form fields are an older technique used in traditional server-rendered apps, not modern SPAs like Angular.

F is incorrect because Angular does not automatically encrypt payloads; HTTPS handles transport-layer encryption.

Question 3: You are building an Angular application and need to bypass security to trust a known safe HTML snippet that includes inline styles. Which of the following approaches represents a Secure Development best practice for this scenario?

B) Using the bypassSecurityTrustHtml method from DomSanitizer, but only after carefully vetting the source of the HTML.

C) Disabling Angular's built-in sanitization globally in the AppModule.

D) Writing a custom pipe that removes all script tags using a simple regular expression.

E) Using the bypassSecurityTrustResourceUrl method to bind the HTML string.

F) Storing the HTML snippet in a standard variable and rendering it using string interpolation.

Correct Answer: B) Using the bypassSecurityTrustHtml method from DomSanitizer, but only after carefully vetting the source of the HTML.

Explanation:

B is correct because when you absolutely must render trusted HTML that Angular would otherwise strip, bypassSecurityTrustHtml tells Angular to trust the value. However, the best practice dictates this must only be done for strictly vetted, safe sources.

C is incorrect because disabling global sanitization removes core protections across the entire app, which is highly dangerous.

D is incorrect because custom regex sanitization is notoriously flawed and easily bypassed by sophisticated XSS payloads.

E is incorrect because bypassSecurityTrustResourceUrl is used for trusting executable resources like iframe sources, not HTML strings.

F is incorrect because string interpolation will render the HTML as raw text, not parsed HTML.

You can retake the exams as many times as you want.

This is a huge original question bank.

You get support from instructors if you have questions.

Each question has a detailed explanation.

Mobile-compatible with the Udemy app.