CS Security & Databases 2 — Questions and Answers
Question 1: A web application concatenates user input directly into an SQL query string. Which attack is it most vulnerable to?
- SQL injection (Correct answer)
- Cross-site scripting
- Buffer overflow
- ARP spoofing
Correct answer: SQL injection
Concatenating unsanitized input into SQL queries allows attackers to inject malicious SQL code.
Question 2: Which database property ensures that a transaction is either fully completed or fully rolled back?
- Atomicity (Correct answer)
- Consistency
- Isolation
- Durability
Correct answer: Atomicity
Atomicity guarantees all-or-nothing execution of a transaction.
Question 3: What is the primary purpose of salting passwords before hashing them?
- To defeat precomputed rainbow table attacks (Correct answer)
- To make passwords shorter
- To encrypt passwords reversibly
- To speed up authentication
Correct answer: To defeat precomputed rainbow table attacks
A unique salt per password makes precomputed hash tables useless against the stored hashes.
Question 4: In a relational database, a foreign key constraint primarily enforces which property?
- Referential integrity (Correct answer)
- Entity uniqueness
- Data encryption
- Query optimization
Correct answer: Referential integrity
Foreign keys ensure that a referenced row exists in the parent table, maintaining referential integrity.
Question 5: Which security principle states that users should be granted only the permissions necessary to perform their job?
- Least privilege (Correct answer)
- Defense in depth
- Fail-safe defaults
- Separation of duties
Correct answer: Least privilege
The principle of least privilege limits each user to the minimum access needed.
Question 6: A table is in second normal form (2NF) but has a non-key attribute that depends on another non-key attribute. Which normal form does it violate?
- Third normal form (3NF) (Correct answer)
- First normal form (1NF)
- Boyce-Codd normal form only
- Fourth normal form only
Correct answer: Third normal form (3NF)
Transitive dependencies between non-key attributes violate third normal form.
Question 7: Which of the following is an example of asymmetric encryption?
- RSA (Correct answer)
- AES
- DES
- RC4
Correct answer: RSA
RSA uses a public/private key pair, making it asymmetric, while AES, DES, and RC4 are symmetric ciphers.
CS Security & Databases 2
A web application concatenates user input directly into an SQL query string.
Which attack is it most vulnerable to?