POC Security & Access Management 2 — Questions and Answers
Question 1: Which Python module provides the `getpass()` function to securely prompt for a password without echoing input?
- secrets
- getpass (Correct answer)
- hashlib
- keyring
Correct answer: getpass
The `getpass` module provides `getpass()` which prompts for a password without displaying characters on the terminal.
Question 2: What does the `secrets` module's `token_urlsafe(32)` generate?
- A 32-character hex string
- A URL-safe base64-encoded random token of 32 bytes (Correct answer)
- A 32-bit integer token
- A UUID4 string of length 32
Correct answer: A URL-safe base64-encoded random token of 32 bytes
`token_urlsafe(n)` generates a URL-safe base64-encoded string from `n` random bytes, suitable for session tokens and CSRF protection.
Question 3: When using Python's `ssl` module, what does `ssl.CERT_REQUIRED` enforce?
- The server must present a certificate signed by a trusted CA (Correct answer)
- The client must generate a self-signed certificate
- SSL is optional but preferred
- Only RSA certificates are accepted
Correct answer: The server must present a certificate signed by a trusted CA
`ssl.CERT_REQUIRED` causes the SSL handshake to fail unless the peer presents a valid certificate signed by a trusted certificate authority.
Question 4: Which attack does parameterized SQL queries in Python's `sqlite3` module primarily prevent?
- Cross-site scripting (XSS)
- SQL injection (Correct answer)
- Buffer overflow
- Man-in-the-middle
Correct answer: SQL injection
Parameterized queries separate SQL code from user-supplied data, preventing SQL injection by treating input as literal values rather than executable code.
Question 5: What is the purpose of `os.chmod(path, 0o600)` from a security standpoint?
- Makes the file executable by all users
- Restricts file read/write to the owner only (Correct answer)
- Grants read access to all users
- Sets the file as immutable
Correct answer: Restricts file read/write to the owner only
Octal `0o600` sets read and write permissions for the owner only, ensuring sensitive files like private keys are not accessible to other users.
Question 6: Which function in the `hmac` module verifies that two HMAC digests are equal in a timing-safe manner?
- hmac.compare()
- hmac.verify()
- hmac.compare_digest() (Correct answer)
- hmac.safe_equal()
Correct answer: hmac.compare_digest()
`hmac.compare_digest()` performs a constant-time comparison to prevent timing attacks that could leak information about the secret.
Question 7: In Python's `cryptography` library, what is a Fernet token?
- A JWT signed with HMAC-SHA256
- An AES-128-CBC encrypted and HMAC-authenticated message (Correct answer)
- A raw RSA-encrypted bytes object
- A base64-encoded SHA-512 hash
Correct answer: An AES-128-CBC encrypted and HMAC-authenticated message
Fernet uses AES-128-CBC for encryption and HMAC-SHA256 for authentication, then base64url-encodes the result into a single token.
POC Security & Access Management 2
Which Python module provides the `getpass()` function to securely prompt for a password without echoing input?