Web Development Security 3

Question 1

What is the key difference between authentication and authorization in web security?

Accepted Answer

Authentication verifies who you are; authorization determines what you can do

Answer

Authentication (authn) confirms identity while authorization (authz) enforces permissions — both are required for secure access control.

Question 2

Which attack allows an adversary to read memory from adjacent process space by exploiting a buffer length field without validating it?

Accepted Answer

Heartbleed (buffer over-read)

Answer

Heartbleed exploited OpenSSL's failure to validate the 'length' field in TLS heartbeat requests, leaking up to 64KB of server memory per request.

Question 3

When using JWTs for session management, what is the safest place to store the token in a browser?

Accepted Answer

An httpOnly, Secure, SameSite=Strict cookie

Answer

Storing JWTs in httpOnly cookies protects them from XSS attacks since JavaScript cannot access httpOnly cookies.

Question 4

What is clickjacking, and which HTTP header primarily defends against it?

Accepted Answer

Embedding a target site in an invisible iframe to trick users into clicking; X-Frame-Options or frame-ancestors CSP

Answer

Clickjacking tricks users into clicking hidden UI elements by overlaying an iframe; X-Frame-Options: DENY or CSP frame-ancestors blocks iframe embedding.

Question 5

In a SQL injection attack, what does a UNION-based injection attempt to achieve?

Accepted Answer

Append an additional SELECT query to extract data from other database tables

Answer

UNION-based SQLi appends a second SELECT statement to the original query, returning data from tables the attacker chooses.

Web Development Practice Test

Web Development Practice Test

Web Development Security 3