CS Security & Authentication 3

Question 1

A website includes a hidden, unpredictable token in every form that the server validates on submission. Which attack does this primarily defend against?

Accepted Answer

Cross-site request forgery (CSRF)

Answer

Anti-CSRF tokens ensure requests originate from the site's own forms, blocking forged cross-site requests.

Question 2

In the TLS handshake, what is the role of the server's certificate?

Accepted Answer

It binds the server's public key to its identity, verified by a trusted certificate authority

Answer

The certificate lets the client verify the server's identity because a trusted CA has signed the server's public key.

Question 3

Which statement best describes the principle of least privilege?

Accepted Answer

Users and processes should be granted only the permissions necessary to perform their tasks

Answer

Least privilege limits each subject to the minimum access required, reducing the damage from compromise or error.

Question 4

An attacker captures a valid session cookie over an unencrypted Wi-Fi network and uses it to impersonate the victim. What is this attack called?

Accepted Answer

Session hijacking

Answer

Stealing and reusing a valid session identifier to take over an authenticated session is session hijacking.

Question 5

Why is HMAC preferred over a simple hash of message-plus-secret (hash(key || message)) for message authentication?

Accepted Answer

HMAC's nested construction resists length-extension attacks that affect naive concatenation with Merkle-Damgard hashes

Answer

HMAC's double-hash structure prevents length-extension attacks possible against plain hash(key || message) with hashes like SHA-256.

(CS) Computer Science Practice Test

(CS) Computer Science Practice Test

CS Security & Authentication 3