18 Questions
Match the following security practices with their descriptions:
Input Validation = A mechanism that regulates access to data or functionality Attack Surface Reduction = Verifying the identity of a user through a username and password Access Control = Preventing malicious data from entering a system Authentication = Limiting the number of potential vulnerabilities in a system
Match the following access control concepts with their definitions:
Subject = Something or person that is receiving the action Target Object = Something or person that is doing the action Authentication = The process of determining whether the validated identity has the rights to do what they want to do Authorization = A mechanism that regulates access to data or functionality
Match the following authentication steps with their descriptions:
Identification = The process of verifying the identity of a user Authentication = The process of claiming an identity Authorization = The process of determining whether the validated identity has the rights to do what they want to do Access Control = The process of regulating access to data or functionality
Match the following security concepts with their primary goals:
Authentication = To prevent unauthorized access to resources Authorization = To validate the identity of a user Access Control = To manage permissions and access to resources Input Validation = To prevent malicious data from entering a system
Match the following security terms with their definitions:
Authentication Factor = A piece of information used to verify an identity, such as a password Permission = A right or privilege granted to a user or role Access Control System = A mechanism that regulates access to data or functionality Authorization Check = A process of verifying the identity of a user
Match the following security processes with their primary functions:
Authentication = To grant access to resources based on a user's identity Authorization = To verify the identity of a user Access Control = To manage and enforce permissions and access to resources Input Validation = To prevent unauthorized access to resources
Match the following password complexity requirements with their descriptions:
At least one uppercase = Enforce minimum password complexity Rotate passwords = Disable accounts after a certain number of incorrect attempts Password cannot equal username = Ensure password uniqueness Properly store passwords = Store passwords in plaintext
Match the following authentication steps with their locations:
Providing a username and password = Initial login Authenticating with cookies = Subsequent HTTP requests Session ID validation = With every request in your code Authorization = After initial login
Match the following authentication concepts with their definitions:
Access Control = Restricting access to resources based on user identity Authorization = Granting permissions to access resources Authentication = Verifying user identity Permissions Management = Managing user roles and privileges
Match the following authentication factors with their types:
Username = Something you know Password = Something you have Biometric data = Something you are Session ID = Somewhere you are
Match the following authentication best practices with their descriptions:
When and where to perform authentication = Determining the optimal authentication points Securing web authentication mechanisms = Protecting against authentication attacks Session ID validation = Verifying the authenticity of session IDs Disable accounts = Temporarily or permanently disabling user accounts
Match the following input validation concepts with their descriptions:
Input validation = Verifying user input against expected formats Output encoding = Encoding output to prevent injection attacks Error handling = Handling errors securely to prevent information disclosure Output validation = Verifying output against expected formats
Match the following authentication techniques with their purpose:
Re-authentication = To verify the user's identity before performing a sensitive action Account lockout = To prevent brute-force attacks Increasing time out values = To slow down brute-force attacks SSL/TLS = To secure the transmission of authentication data
Match the following security measures with their effect:
Allowing account lockout = Preventing administrators from being locked out Using CAPTCHA = Slowing down brute-force attacks Disabling default accounts = Reducing the attack surface Implementing remember me = Improving user experience
Match the following authentication factors with their characteristics:
Username and password = Can be generated by the system Two-factor authentication = Uses a combination of two authentication methods Biometric authentication = Uses unique physical characteristics Single-factor authentication = Uses a single authentication method
Match the following authorization checks with their triggers:
When a user's access level or rights change = Re-authentication When accessing an outside or third-party resource = Authentication When a request is made to access a protected resource = Access control After a certain number of failed attempts = Account lockout
Match the following access control systems with their characteristics:
Discretionary access control = Allows users to set access permissions Mandatory access control = Uses a set of rules to determine access Role-based access control = Assigns access based on user roles Attribute-based access control = Evaluates a user's attributes to determine access
Match the following permissions management techniques with their goals:
Least privilege = To grant users only the necessary permissions Separation of duties = To divide responsibilities among multiple users Privilege escalation = To grant temporary elevated privileges Privilege reduction = To reduce privileges for a specific task
Learn about the importance of access control and authentication in web applications to protect resources and data from unauthorized access.
Make Your Own Quizzes and Flashcards
Convert your notes into interactive study material.
Get started for free
