CyberCertPrepWeb App FundamentalsWeb Servers & DeploymentEASYFree question
A developer deploys a Node.js application as root (uid=0) on a Linux server. Why is this a critical security mistake?
- A.Node.js requires a non-root user to bind to port 3000
- B.Running as root prevents the application from writing log files
- C.root processes consume more memory than regular user processes
- D.Running as root means that if the application is compromised (e.g., via RCE vulnerability), the attacker gains root access to the entire server - they can read all files, install backdoors, escalate to other systems, and perform any OS operation. Applications should run with a dedicated low-privilege user account
Why D is correct
Principle of least privilege applied to processes: applications should run as dedicated service accounts with only the permissions they need. A compromised root process gives attackers complete server control. Best practice: create a dedicated user (e.g., 'nodejs'), run the application as that user, restrict file system access to only what the application needs, and use capabilities (e.g., CAP_NET_BIND_SERVICE to bind privileged ports) instead of running as root.
Know someone studying for Web App Fundamentals? Send them this one.