Back-End Development Back-End Security and Authentication 3

Question 1

What is the purpose of environment variables in back-end application security?

Accepted Answer

To store sensitive configuration like API keys and passwords outside of source code

Answer

Environment variables keep sensitive data like credentials and API keys out of the codebase, preventing accidental exposure in version control.

Question 2

What is input validation and why is it important on the server side?

Accepted Answer

Checking and sanitizing data on the server to ensure it meets expected formats and prevent malicious input

Answer

Server-side validation is essential because client-side validation can be bypassed; the server must always verify and sanitize all incoming data independently.

Question 3

What does XSS (Cross-Site Scripting) mean in the context of web security?

Accepted Answer

An attack where malicious scripts are injected into web pages viewed by other users

Answer

XSS allows attackers to inject malicious client-side scripts into pages served to other users, potentially stealing session cookies or performing actions on behalf of victims.

Question 4

Which HTTP header helps prevent clickjacking attacks?

Accepted Answer

X-Frame-Options

Answer

The X-Frame-Options header (or Content-Security-Policy frame-ancestors directive) tells the browser whether a page can be embedded in an iframe, preventing clickjacking.

Question 5

What is the purpose of HTTPS Strict Transport Security (HSTS)?

Accepted Answer

To force browsers to always connect to the site using HTTPS, even if HTTP is requested

Answer

HSTS instructs browsers to always use HTTPS for a domain for a specified duration, preventing protocol downgrade attacks and cookie hijacking over HTTP.

Back-End Development Practice Test

Back-End Development Practice Test

Back-End Development Back-End Security and Authentication 3