Security

Question 1

What is XSS?

Answer 1

XSS is an attack where malicious scripts are injected into web pages, potentially allowing attackers to steal cookies, session tokens, or other sensitive data.

Question 2

How can XSS attacks be mitigated?

Answer 2

By escaping user inputs, implementing a Content Security Policy (CSP), and sanitizing inputs to prevent malicious scripts.

Question 3

What is CSRF?

Answer 3

CSRF occurs when a malicious website tricks a user into performing an action (e.g., submitting a form) on a trusted website where the user is authenticated.

Question 4

How can CSRF attacks be prevented?

Answer 4

By using CSRF tokens, SameSite cookies, and validating the source of requests.

Question 5

What is SQL injection?

Answer 5

SQL injection is an attack where malicious SQL code is inserted into a query, potentially allowing attackers to access or manipulate a database.

Question 6

How can SQL injection attacks be mitigated?

Answer 6

By using parameterized queries, prepared statements, and sanitizing inputs.

Question 7

What is a Content Security Policy (CSP)?

Answer 7

CSP is a security feature that restricts the sources of scripts, styles, and other content, helping to prevent XSS attacks.

Question 8

What is HTTPS?

Answer 8

HTTPS is an encrypted version of HTTP that uses TLS/SSL to secure communication, ensuring data confidentiality and integrity during transit.

Question 9

What is TLS/SSL?

Answer 9

TLS (Transport Layer Security) and SSL (Secure Sockets Layer) are cryptographic protocols that secure data in transit by encrypting it and authenticating servers with certificates.

Question 10

What is rate limiting?

Answer 10

Rate limiting controls the number of requests a client can make to a server in a specified time to prevent abuse, such as brute force attacks or denial of service (DoS).

Question 11

What is password hashing?

Answer 11

Password hashing transforms passwords into irreversible hashes using cryptographic algorithms like bcrypt or Argon2 to securely store passwords.

Question 12

What is security misconfiguration?

Answer 12

Security Misconfiguration involves improper setup or insecure defaults. XML External Entities (XXE) vulnerabilities are now part of this category.

Question 13

What is OWASP?

Answer 13

The Open Web Application Security Project (OWASP) is a nonprofit foundation focused on improving software security and providing resources like the OWASP Top 10 list of vulnerabilities.

Question 14

What is the Zero Trust security model?

Answer 14

The Zero Trust model assumes no implicit trust, requiring continuous verification of users and devices, enforcing least privilege, and ensuring secure access to resources.

Question 15

What is the Principle of Least Privilege?

Answer 15

It is a security practice where users and systems are granted only the minimum permissions necessary to perform their tasks.

Question 16

What is MFA?

Answer 16

Multi-Factor Authentication requires users to verify their identity using two or more factors: something they know (password), have (device), or are (biometric).

Question 17

Why is token expiry important in authentication?

Answer 17

Token expiry limits the time a token can be used, reducing the risk of unauthorized access if a token is compromised.

Question 18

What is Security in Depth?

Answer 18

Security in Depth involves implementing multiple layers of security (e.g., firewalls, encryption, access controls) to protect systems and data.

Question 19

What is encryption?

Answer 19

Encryption is the process of converting plaintext into ciphertext using cryptographic algorithms to ensure data confidentiality.

Question 20

What is Broken Access Control?

Answer 20

Broken Access Control occurs when restrictions on authenticated users’ actions are improperly enforced, allowing unauthorized actions like data access or modification.

Question 21

What are Cryptographic Failures?

Answer 21

Failures in cryptography include weak or missing encryption, improper key management, or insecure algorithms, leading to sensitive data exposure or compromise.

Question 22

How has the Injection category changed in 2021?

Answer 22

Injection now includes Cross-Site Scripting (XSS) and focuses on flaws where untrusted input is executed as commands or queries.

Question 23

What is Insecure Design?

Answer 23

Insecure Design refers to flaws in architecture or design that increase security risks, often due to inadequate threat modeling or missing secure design patterns.

Question 24

What are Vulnerable and Outdated Components?

Answer 24

Using unpatched or unsupported components can lead to exploitation. This category, previously “Using Components with Known Vulnerabilities,” highlights the importance of updates.

Question 25

What does Identification and Authentication Failures include?

Answer 25

This category covers flaws in user identification and authentication, such as weak password policies or mismanaged session tokens, previously labeled “Broken Authentication.”

Question 26

What are Software and Data Integrity Failures?

Answer 26

This category includes failures to verify software updates, critical data, or CI/CD pipeline integrity, increasing risks like malicious updates or data tampering.

Question 27

What are Security Logging and Monitoring Failures?

Answer 27

This refers to inadequate logging and alerting, which hampers detection and response to incidents. It includes expanded failure types compared to “Insufficient Logging & Monitoring.”

Question 28

What is SSRF?

Answer 28

SSRF occurs when a server makes unauthorized requests to external or internal resources due to inadequate input validation.

Question 29

What is Cross-Domain Access Control?

Answer 29

Cross-Domain Access Control is enforced by the Same-Origin Policy, which requires the domain, scheme (protocol), and port to match. Controlled via CORS (Cross-Origin Resource Sharing) headers.