CS Security & Authentication 2

Question 1

A web application stores user passwords using bcrypt. What is the primary security benefit of bcrypt over a plain SHA-256 hash?

Accepted Answer

It is deliberately slow and includes a salt, making brute-force and rainbow table attacks harder

Answer

Bcrypt is an adaptive, salted hashing function designed to be computationally expensive, which slows brute-force and defeats precomputed rainbow tables.

Question 2

An attacker submits the input ' OR '1'='1 into a login form and gains access. Which vulnerability does this exploit?

Accepted Answer

SQL injection

Answer

Injecting SQL syntax into unparameterized queries to alter their logic is a classic SQL injection attack.

Question 3

In asymmetric cryptography, if Alice wants to send Bob a confidential message, which key should she use to encrypt it?

Accepted Answer

Bob's public key

Answer

Encrypting with Bob's public key ensures only Bob, holding the matching private key, can decrypt the message.

Question 4

Which combination is an example of two-factor authentication (2FA)?

Accepted Answer

A password plus a one-time code from a phone app

Answer

True 2FA combines two different factor categories, here something you know (password) and something you have (phone).

Question 5

What is the main purpose of a salt when hashing passwords?

Accepted Answer

To ensure identical passwords produce different hashes, defeating precomputed lookup tables

Answer

A unique random salt per password makes each hash unique, so rainbow tables and cross-user comparisons are useless.

(CS) Computer Science Practice Test

(CS) Computer Science Practice Test

CS Security & Authentication 2