POC Security & Access Management 3

Question 1

What is the risk of using Python's `pickle` module to deserialize data received from an untrusted source?

Accepted Answer

It can execute arbitrary code during deserialization

Answer

`pickle` can execute arbitrary Python code embedded in a malicious payload during deserialization, making it dangerous with untrusted data.

Question 2

Which environment variable handling approach is most secure when storing API keys in a Python application?

Accepted Answer

Load them via `os.environ` from environment variables set outside the codebase

Answer

Loading secrets from environment variables keeps them out of source code and version control, reducing the risk of accidental exposure.

Question 3

What does `hashlib.pbkdf2_hmac('sha256', password, salt, 100000)` accomplish?

Accepted Answer

Derives a key from a password using 100,000 iterations to resist brute-force attacks

Answer

PBKDF2 applies HMAC-SHA256 many times (100,000 iterations here) to make password cracking computationally expensive.

Question 4

Which Python built-in can accidentally expose sensitive data if called on an object that implements `__repr__`?

Accepted Answer

repr()

Answer

`repr()` invokes `__repr__`, which may include sensitive fields like passwords or tokens if not deliberately excluded from the representation.

Question 5

When creating a temporary file with sensitive data in Python, which function is preferred to prevent race conditions?

Accepted Answer

tempfile.mkstemp()

Answer

`tempfile.mkstemp()` atomically creates and opens a uniquely named temp file, avoiding TOCTOU race conditions that plague manual temp file creation.

(POC) Python Online Certification Practice Test