Back-End Development Back-End Security and Authentication 2

Question 1

What is a CSRF attack and how is it typically prevented?

Accepted Answer

Cross-Site Request Forgery — prevented by using CSRF tokens in forms and state-changing requests

Answer

CSRF tricks authenticated users into unknowingly submitting malicious requests; CSRF tokens ensure only forms served by the legitimate site can submit state-changing requests.

Question 2

What is the purpose of HTTPS in back-end web development?

Accepted Answer

To encrypt data transmitted between the client and server using TLS

Answer

HTTPS uses TLS (Transport Layer Security) to encrypt all data in transit, preventing eavesdropping and man-in-the-middle attacks.

Question 3

What is session fixation and how can it be mitigated?

Accepted Answer

An attack where an attacker sets a known session ID before login — mitigated by regenerating session IDs after authentication

Answer

Session fixation lets an attacker pre-set a session ID; regenerating a new session ID after successful login prevents the attacker from using the known ID.

Question 4

What hashing algorithm is recommended for storing passwords and why?

Accepted Answer

bcrypt or Argon2 — they are slow by design and include salting

Answer

bcrypt and Argon2 are specifically designed for password hashing with configurable work factors and automatic salting, making brute-force attacks impractical.

Question 5

What is the principle of least privilege in back-end security?

Accepted Answer

Granting users and services only the minimum permissions needed to perform their tasks

Answer

The principle of least privilege limits damage from breaches or bugs by ensuring each user and service has only the access rights required for their specific function.

Back-End Development Practice Test

Back-End Development Practice Test

Back-End Development Back-End Security and Authentication 2