Back-End Development Back-End Security and Authentication 1 — Questions and Answers
Question 1: What is JWT and what is it commonly used for in back-end applications?
- JavaScript Web Template — used for front-end rendering
- JSON Web Token — used for stateless authentication and authorization (Correct answer)
- Java Web Transfer — used for file uploads
- JavaScript Worker Thread — used for background processing
Correct answer: JSON Web Token — used for stateless authentication and authorization
A JSON Web Token is a compact, self-contained token that encodes claims and is widely used for stateless authentication between clients and servers.
Question 2: What is the purpose of bcrypt when handling passwords in a back-end application?
- To encrypt passwords for transmission over the network
- To hash passwords with a salt before storing them in the database (Correct answer)
- To generate one-time passwords for two-factor authentication
- To validate password complexity rules
Correct answer: To hash passwords with a salt before storing them in the database
Bcrypt hashes passwords with a random salt and a configurable cost factor, making brute-force attacks computationally expensive.
Question 3: What does SQL injection attack involve?
- Injecting malicious JavaScript into web pages
- Inserting malicious SQL code into input fields to manipulate database queries (Correct answer)
- Overloading the server with SQL queries
- Stealing SQL credentials from server configuration files
Correct answer: Inserting malicious SQL code into input fields to manipulate database queries
SQL injection occurs when an attacker inserts malicious SQL into user input that gets executed by the database, potentially exposing or corrupting data.
Question 4: What is the best way to prevent SQL injection in a back-end application?
- Encrypting all database connections
- Using parameterized queries or prepared statements (Correct answer)
- Validating input length only
- Storing queries in environment variables
Correct answer: Using parameterized queries or prepared statements
Parameterized queries separate SQL code from user data, so the database treats user input as data, not executable code.
Question 5: What is the difference between authentication and authorization?
- Authentication checks what you can do; authorization checks who you are
- Authentication verifies identity; authorization determines permissions (Correct answer)
- They are the same concept with different names
- Authorization happens before authentication
Correct answer: Authentication verifies identity; authorization determines permissions
Authentication is the process of verifying who a user is, while authorization determines what resources and actions that authenticated user is permitted to access.
Question 6: What is OAuth 2.0 used for in back-end development?
- Encrypting database connections
- Delegated authorization allowing third-party apps to access resources without sharing passwords (Correct answer)
- Generating cryptographic keys for JWT
- Two-factor authentication via SMS
Correct answer: Delegated authorization allowing third-party apps to access resources without sharing passwords
OAuth 2.0 is an authorization framework that lets users grant third-party applications limited access to their resources without exposing their credentials.
Back-End Development Back-End Security and Authentication 1
What is JWT and what is it commonly used for in back-end applications?