CS Security & Authentication 3 — Questions and Answers
Question 1: A website includes a hidden, unpredictable token in every form that the server validates on submission. Which attack does this primarily defend against?
- Cross-site request forgery (CSRF) (Correct answer)
- SQL injection
- Session hijacking via packet sniffing
- Brute-force login attempts
Correct answer: Cross-site request forgery (CSRF)
Anti-CSRF tokens ensure requests originate from the site's own forms, blocking forged cross-site requests.
Question 2: In the TLS handshake, what is the role of the server's certificate?
- It binds the server's public key to its identity, verified by a trusted certificate authority (Correct answer)
- It contains the symmetric session key used for encryption
- It stores the user's login credentials securely
- It lists all ciphers the client is allowed to use
Correct answer: It binds the server's public key to its identity, verified by a trusted certificate authority
The certificate lets the client verify the server's identity because a trusted CA has signed the server's public key.
Question 3: Which statement best describes the principle of least privilege?
- Users and processes should be granted only the permissions necessary to perform their tasks (Correct answer)
- All users should have identical permission levels to simplify auditing
- Administrators should never have access to user data
- Passwords should be as short as possible to reduce typing errors
Correct answer: Users and processes should be granted only the permissions necessary to perform their tasks
Least privilege limits each subject to the minimum access required, reducing the damage from compromise or error.
Question 4: An attacker captures a valid session cookie over an unencrypted Wi-Fi network and uses it to impersonate the victim. What is this attack called?
- Session hijacking (Correct answer)
- Cross-site scripting
- SQL injection
- Clickjacking
Correct answer: Session hijacking
Stealing and reusing a valid session identifier to take over an authenticated session is session hijacking.
Question 5: Why is HMAC preferred over a simple hash of message-plus-secret (hash(key || message)) for message authentication?
- HMAC's nested construction resists length-extension attacks that affect naive concatenation with Merkle-Damgard hashes (Correct answer)
- HMAC encrypts the message as well as authenticating it
- HMAC is significantly faster to compute than a single hash
- HMAC does not require a secret key
Correct answer: HMAC's nested construction resists length-extension attacks that affect naive concatenation with Merkle-Damgard hashes
HMAC's double-hash structure prevents length-extension attacks possible against plain hash(key || message) with hashes like SHA-256.
Question 6: In OAuth 2.0, what does an access token allow a client application to do?
- Access specific protected resources on behalf of the user, within granted scopes (Correct answer)
- Log in to any website using the user's password
- Permanently store the user's credentials
- Decrypt all traffic between the user and the resource server
Correct answer: Access specific protected resources on behalf of the user, within granted scopes
An access token grants the client limited, scoped access to protected resources without exposing the user's credentials.
Question 7: Which technique mitigates brute-force attacks against a login endpoint?
- Rate limiting and account lockout after repeated failed attempts (Correct answer)
- Storing passwords in plaintext for faster comparison
- Using shorter session timeouts
- Disabling HTTPS to reduce server load
Correct answer: Rate limiting and account lockout after repeated failed attempts
Throttling attempts and locking accounts after failures drastically slow automated password guessing.
CS Security & Authentication 3
A website includes a hidden, unpredictable token in every form that the server validates on submission.
Which attack does this primarily defend against?