Free Security Web Programming Question and Answers — Questions and Answers
Question 1: Select the TCP port that SSL/TLS for HTTPS communication uses.
- TCP 563
- TCP 443 (Correct answer)
- TCP 626
- TCP 80
Correct answer: TCP 443
HTTPS (Hypertext Transfer Protocol Secure) is the secure version of HTTP, which encrypts communication between a web browser and a server using SSL/TLS protocols. By convention and standard, HTTPS traffic uses TCP port 443 for secure data transmission. In contrast, unencrypted HTTP traffic typically uses TCP port 80.
Question 2: Recent data loss occurred on a web server that was set up to use TLS with AES-GCM-256, SHA-384, and ECDSA. Select the factor that is MOST likely to be the cause.
- Weak cipher suite
- Poor implementation (Correct answer)
- Insufficient key bit length
- Unauthenticated encryption method
Correct answer: Poor implementation
Even when strong cryptographic primitives like AES-GCM-256, SHA-384, and ECDSA are specified, data loss or security breaches can still occur due to poor implementation. This could involve vulnerabilities in the application logic, improper key management, misconfigurations, or human error in setting up and maintaining the system. A robust security posture requires not only strong algorithms but also flawless execution and operational practices.
Question 3: Which hashing algorithm among the following is the LEAST secure?
- SHA1
- DES
- MD5 (Correct answer)
- RIPEMD
Correct answer: MD5
MD5 (Message-Digest Algorithm 5) is a cryptographic hash function that has been found to be vulnerable to collision attacks, meaning it's possible to find two different inputs that produce the same hash output. This weakness makes it unsuitable for security-critical applications like password storage or digital signatures, as it can be exploited. While SHA1 also has known weaknesses, MD5 is generally considered the least secure among the listed hashing algorithms for modern security applications.
Question 4: Which of the following would satisfy the multifactor authentication requirements?
- Voice recognition and retina scan
- Fingerprint and Password (Correct answer)
- Username, PIN and employee ID number
- Smart card and hardware token
Correct answer: Fingerprint and Password
Multifactor authentication (MFA) requires a user to provide two or more distinct types of credentials from different categories to verify their identity. These categories typically include 'something you know' (like a password or PIN), 'something you have' (like a smart card or token), and 'something you are' (like a fingerprint or retina scan). Combining a fingerprint ('something you are') with a password ('something you know') satisfies the requirements for multifactor authentication.
Question 5: Select the statement about system vulnerabilities that is TRUE from the following. i. A system threat is a vulnerability. ii. An exploitable flaw in a system's design is referred to as a vulnerability. iii. Protocols, operating systems, applications, hardware, and system design all have vulnerabilities. iv. Exploits known as vulnerabilities are found in software and hardware products every day.
- Ii & iv
- I & ii
- Iii & iv
- Ii & iii (Correct answer)
Correct answer: Ii & iii
A system vulnerability is defined as an exploitable flaw or weakness in a system's design, implementation, or configuration. These vulnerabilities can indeed exist across all layers of a system, including protocols, operating systems, applications, hardware, and the overall system architecture. A system threat, however, refers to an action or event that could exploit such a vulnerability, not the vulnerability itself.
Question 6: Determine the cause of the difficulty in monitoring security caused by HTTPS traffic.
- Large packet header (Correct answer)
- Encryption
- Signature detection takes longer
- SSL interception
Correct answer: Large packet header
While encryption is the primary reason HTTPS traffic is difficult to monitor for security, the additional overhead introduced by TLS/SSL protocols can also contribute to monitoring challenges. The increased size of each packet due to a larger header means more data needs to be processed and analyzed by security monitoring tools. This can slow down intrusion detection systems and complicate efficient real-time analysis, especially in high-volume network environments.
Question 7: Which THREE (3) threats are based on email? spam and assaults using attachments Email address forgery (iii) and insufficient user authentication (iv)
- I, iii & iv
- Ii, iii & iv
- I, ii & iii (Correct answer)
- I, ii & iv
Correct answer: I, ii & iii
Email-based threats are common vectors for cyberattacks and include spam (unsolicited bulk emails), assaults using malicious attachments (which can contain malware or lead to phishing sites), and email address forgery (spoofing sender identities to deceive recipients). Insufficient user authentication is a general security vulnerability, not a threat specifically based on email itself, although it can be exploited by email-based attacks.
Free Security Web Programming Question and Answers
Select the TCP port that SSL/TLS for HTTPS communication uses.