Skip to content

Latest commit

 

History

History
167 lines (105 loc) · 6.61 KB

security.md

File metadata and controls

167 lines (105 loc) · 6.61 KB
Raw

Web Security

What is the difference between authentication and authorization?

  • Authentication is the process of verifying that a user has access to a resource. Authorization is the process of verifying the identity of a user.
  • Authentication is the process of verifying the identity of a user. Authorization is the process of verifying that a user has access to a resource.
  • Authentication is the process of verifying that a user has access to a resource. Authorization is the process of verifying the identity of a user.

What is the purpose of a nonce?

  • To prevent cross-site scripting attacks
  • To prevent replay attacks
  • To prevent cross-site request forgery attacks
  • To prevent hijacking attacks

A nonce is a number that is only used once. It is often a random or pseudo-random number issued in an authentication protocol to ensure that old communications cannot be reused in replay attacks.

What is the purpose of a CSRF token?

  • To prevent cross-site scripting attacks
  • To prevent cross-site request forgery attacks
  • To prevent replay attacks
  • To prevent hijacking attacks

CSRF token is a unique, secret, unpredictable value that is generated by the server-side application and transmitted to the client in such a way that it is included in a subsequent HTTP request made by the client.

What is the purpose of a CORS policy?

  • To prevent cross-site scripting attacks
  • To prevent cross-site request forgery attacks
  • To prevent replay attacks
  • To prevent hijacking attacks

CORs is a mechanism that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served.

What is the purpose of a Content Security Policy?

  • To prevent cross-site request forgery attacks
  • To prevent cross-site scripting attacks
  • To prevent replay attacks
  • To prevent hijacking attacks

CSP is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks.

What is the purpose of a SameSite cookie?

  • To prevent cross-site scripting attacks
  • To prevent cross-site request forgery attacks
  • To prevent replay attacks

Why use HTTPS?

  • To prevent cross-site scripting attacks
  • To prevent cross-site request forgery attacks
  • To prevent replay attacks
  • To prevent hijacking attacks

How would you prevent a cross-site scripting attack?

  • Use HTTPS
  • Sanitize user input
  • Use a CSRF token
  • Use a nonce

How would you prevent a cross-site request forgery attack?

  • Use a CSRF token
  • Sanitize user input
  • Use HTTPS
  • Use a nonce

CSRF token is a unique, secret, unpredictable value that is generated by the server-side application and transmitted to the client in such a way that it is included in a subsequent HTTP request made by the client.

How would you prevent a replay attack?

  • Sanitize user input
  • Use HTTPS
  • Use a nonce
  • Use a CSRF token

A nonce is a number that is only used once. It is often a random or pseudo-random number issued in an authentication protocol to ensure that old communications cannot be reused in replay attacks.

Describe the difference between symmetric and asymmetric encryption.

  • Symmetric encryption uses the same key for encryption and decryption. Asymmetric encryption uses different keys for encryption and decryption.
  • Symmetric encryption uses different keys for encryption and decryption. Asymmetric encryption uses the same key for encryption and decryption.

Describe the difference between a hash and a cipher.

  • A hash is used for encryption. A cipher is used for decryption.
  • A hash is used for decryption. A cipher is used for encryption.
  • A hash is used for encryption. A cipher is used for encryption.
  • A hash is used for decryption. A cipher is used for decryption.

A cipher is an algorithm for performing encryption or decryption. A hash is a function that maps data of arbitrary size to a fixed-size output. A hash is used for encryption. A cipher is used for encryption. see Hash Function for more information.

Describe the difference between a hash and a checksum.

  • A hash is used for encryption. A checksum is used for decryption.
  • A hash is used for encryption. A checksum is used for encryption.
  • A hash is used for decryption. A checksum is used for encryption.
  • A hash is used for decryption. A checksum is used for decryption.

A checksum is a small-sized datum derived from a block of digital data for the purpose of detecting errors that may have been introduced during its transmission or storage. It is usually applied to an installation file after it is received from the download server. By themselves, checksums are often used to verify data integrity but are not relied upon to verify data authenticity.

Describe the difference between a hash and a digital signature.

  • A hash is used for encryption. A digital signature is used for decryption.
  • A hash is used for decryption. A digital signature is used for encryption.
  • A hash is used for encryption. A digital signature is used for encryption.
  • A hash is used for decryption. A digital signature is used for decryption.

A digital signature is a mathematical scheme for verifying the authenticity of digital messages or documents. A valid digital signature gives a recipient reason to believe that the message was created by a known sender, and that it was not altered in transit. Digital signatures are commonly used for software distribution, financial transactions, and in other cases where it is important to detect forgery or tampering.

Describe the difference between a public key and a private key.

  • A public key is used for encryption. A private key is used for decryption.
  • A public key is used for decryption. A private key is used for encryption.
  • A public key is used for decryption. A private key is used for encryption.

A public key is used for encryption. A private key is used for decryption. A public key is used for encryption. A private key is used for decryption. see Public Key Cryptography for more information.

What is a self-signed certificate?

  • A certificate generated by a certificate authority.
  • A certificate generated by a server.
  • A certificate generated by a user that can not be validated by a certificate authority.