POC Security & Access Management 3 — Questions and Answers
Question 1: What is the risk of using Python's `pickle` module to deserialize data received from an untrusted source?
- It may corrupt the data silently
- It can execute arbitrary code during deserialization (Correct answer)
- It only supports Python 2 objects
- It raises a PickleError for complex objects
Correct answer: It can execute arbitrary code during deserialization
`pickle` can execute arbitrary Python code embedded in a malicious payload during deserialization, making it dangerous with untrusted data.
Question 2: Which environment variable handling approach is most secure when storing API keys in a Python application?
- Hardcode them as module-level constants
- Store them in a JSON config file committed to version control
- Load them via `os.environ` from environment variables set outside the codebase (Correct answer)
- Base64-encode them and embed in the source code
Correct answer: Load them via `os.environ` from environment variables set outside the codebase
Loading secrets from environment variables keeps them out of source code and version control, reducing the risk of accidental exposure.
Question 3: What does `hashlib.pbkdf2_hmac('sha256', password, salt, 100000)` accomplish?
- Encrypts a password with AES-256
- Derives a key from a password using 100,000 iterations to resist brute-force attacks (Correct answer)
- Generates a random 256-bit salt
- Computes a single-round SHA-256 hash of the password
Correct answer: Derives a key from a password using 100,000 iterations to resist brute-force attacks
PBKDF2 applies HMAC-SHA256 many times (100,000 iterations here) to make password cracking computationally expensive.
Question 4: Which Python built-in can accidentally expose sensitive data if called on an object that implements `__repr__`?
- repr() (Correct answer)
- hash()
- id()
- type()
Correct answer: repr()
`repr()` invokes `__repr__`, which may include sensitive fields like passwords or tokens if not deliberately excluded from the representation.
Question 5: When creating a temporary file with sensitive data in Python, which function is preferred to prevent race conditions?
- open('/tmp/tmpfile', 'w')
- tempfile.mkstemp() (Correct answer)
- os.open('/tmp/tmp', os.O_CREAT)
- pathlib.Path('/tmp/tmp').touch()
Correct answer: tempfile.mkstemp()
`tempfile.mkstemp()` atomically creates and opens a uniquely named temp file, avoiding TOCTOU race conditions that plague manual temp file creation.
Question 6: What does RBAC stand for in the context of Python access control frameworks?
- Remote Bytecode Access Control
- Role-Based Access Control (Correct answer)
- Resource Binding and Authentication Checks
- Recursive Block Access Caching
Correct answer: Role-Based Access Control
Role-Based Access Control assigns permissions to roles rather than individual users, simplifying management of who can perform which actions.
Question 7: Which Python decorator pattern is commonly used to enforce authentication on Flask or FastAPI route handlers?
- @classmethod
- @staticmethod
- @login_required or @Depends(get_current_user) (Correct answer)
- @property
Correct answer: @login_required or @Depends(get_current_user)
In Flask, `@login_required` wraps route handlers to check authentication; in FastAPI, `Depends(get_current_user)` injects and verifies the current user before the handler runs.
POC Security & Access Management 3
What is the risk of using Python's `pickle` module to deserialize data received from an untrusted source?