CS Security & Authentication 2 — Questions and Answers
Question 1: A web application stores user passwords using bcrypt. What is the primary security benefit of bcrypt over a plain SHA-256 hash?
- It is deliberately slow and includes a salt, making brute-force and rainbow table attacks harder (Correct answer)
- It produces a longer hash output that cannot be reversed
- It encrypts the password so it can be recovered if needed
- It compresses the password to save database space
Correct answer: It is deliberately slow and includes a salt, making brute-force and rainbow table attacks harder
Bcrypt is an adaptive, salted hashing function designed to be computationally expensive, which slows brute-force and defeats precomputed rainbow tables.
Question 2: An attacker submits the input ' OR '1'='1 into a login form and gains access. Which vulnerability does this exploit?
- SQL injection (Correct answer)
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
- Buffer overflow
Correct answer: SQL injection
Injecting SQL syntax into unparameterized queries to alter their logic is a classic SQL injection attack.
Question 3: In asymmetric cryptography, if Alice wants to send Bob a confidential message, which key should she use to encrypt it?
- Bob's public key (Correct answer)
- Bob's private key
- Alice's public key
- Alice's private key
Correct answer: Bob's public key
Encrypting with Bob's public key ensures only Bob, holding the matching private key, can decrypt the message.
Question 4: Which combination is an example of two-factor authentication (2FA)?
- A password plus a one-time code from a phone app (Correct answer)
- A password plus a security question answer
- A fingerprint plus a facial scan
- Two different passwords entered in sequence
Correct answer: A password plus a one-time code from a phone app
True 2FA combines two different factor categories, here something you know (password) and something you have (phone).
Question 5: What is the main purpose of a salt when hashing passwords?
- To ensure identical passwords produce different hashes, defeating precomputed lookup tables (Correct answer)
- To make the hash output shorter and faster to compare
- To encrypt the hash so it can be safely transmitted
- To allow the original password to be recovered by administrators
Correct answer: To ensure identical passwords produce different hashes, defeating precomputed lookup tables
A unique random salt per password makes each hash unique, so rainbow tables and cross-user comparisons are useless.
Question 6: A digital signature on a document primarily provides which security guarantees?
- Authenticity, integrity, and non-repudiation (Correct answer)
- Confidentiality and availability
- Anonymity and confidentiality
- Compression and error correction
Correct answer: Authenticity, integrity, and non-repudiation
A signature proves who signed the document, that it was not altered, and prevents the signer from denying it.
Question 7: Which attack involves an adversary secretly relaying and possibly altering communication between two parties who believe they are talking directly?
- Man-in-the-middle attack (Correct answer)
- Denial-of-service attack
- Phishing attack
- Dictionary attack
Correct answer: Man-in-the-middle attack
A man-in-the-middle attacker intercepts traffic between two parties, potentially reading or modifying it undetected.
CS Security & Authentication 2
A web application stores user passwords using bcrypt.
What is the primary security benefit of bcrypt over a plain SHA-256 hash?