Back-End Development Back-End Security and Authentication 2

Question 1

What is a CSRF attack and how is it typically prevented?

Accepted Answer

Cross-Site Request Forgery — prevented by using CSRF tokens in forms and state-changing requests

Answer

A database attack prevented by encryption

Answer

A code injection attack prevented by input sanitization

Answer

A session hijacking attack prevented by HTTPS

Question 2

What is the purpose of HTTPS in back-end web development?

Accepted Answer

To encrypt data transmitted between the client and server using TLS

Answer

To speed up server response times

Answer

To authenticate users automatically

Answer

To prevent SQL injection attacks

Question 3

What is session fixation and how can it be mitigated?

Accepted Answer

An attack where an attacker sets a known session ID before login — mitigated by regenerating session IDs after authentication

Answer

Storing sessions in cookies — mitigated by using local storage

Answer

Expired sessions causing logout — mitigated by extending timeout

Answer

Hard-coded sessions — mitigated by using environment variables

Question 4

What hashing algorithm is recommended for storing passwords and why?

Accepted Answer

bcrypt or Argon2 — they are slow by design and include salting

Answer

MD5 — it is fast and widely supported

Answer

SHA-256 — it is a government standard

Answer

Base64 — it is reversible for password recovery

Question 5

What is the principle of least privilege in back-end security?

Accepted Answer

Granting users and services only the minimum permissions needed to perform their tasks

Answer

Giving all users admin rights to improve productivity

Answer

Encrypting all user data regardless of sensitivity

Answer

Using a single shared database account for all services

Question 6

What is a refresh token and how does it work alongside an access token?

Accepted Answer

A long-lived token used to obtain new short-lived access tokens without re-authentication

Answer

A token that refreshes the UI automatically when data changes

Answer

A token that refreshes database connections

Answer

A token that replaces the session cookie