Authentication and Authorization Defensive Techniques in Java CASEJAVA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A Java application uses a permission-based authorization model where users have permissions like 'read:report' and 'write:report'. A user has the 'write:report' permission but not 'read:report'. What can the user do?

   • ANeither read nor write because permissions are only assigned as a set.
   • BRead and write reports because write implies read.
   • CRead reports but not write them.
   • DWrite reports but not read them.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A Java servlet application uses URL rewriting for session tracking because cookies are disabled in some browsers. After a successful login, the application generates a new session ID. What additional control is essential to prevent session fixation?

   • ASet the session timeout to 30 minutes.
   • BUse HTTPS for all pages.
   • CEnsure the new session ID is not exposed in the URL after login.
   • DValidate the session ID against the user's IP address.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A Java servlet application uses a filter to perform authentication. The filter checks the session for a logged-in user attribute. If the attribute is missing, the filter redirects to a login page. The application also needs to prevent session fixation. What should the filter do after a successful login?

   • ASet the session cookie to HttpOnly
   • BStore the user attribute in the session and continue
   • CKeep the same session but change the session timeout
   • DInvalidate the current session and create a new one
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A Java application uses RBAC with roles ADMIN, MANAGER, and USER. A new requirement allows users to be temporarily granted a permission without changing their role. What is the best approach?

   • AUse a database flag to bypass authorization for that user.
   • BAdd a permission-based authorization model alongside RBAC, where users can be assigned specific permissions in addition to roles.
   • CCreate a new role for each temporary permission.
   • DTemporarily change the user's role to a higher role.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A Java web application is deployed behind a load balancer that terminates TLS. The application uses session cookies. The security team notices that the session cookie is not marked as Secure, even though the application is accessed over HTTPS. What is the most likely cause and the best fix?

   • AThe session timeout is too short; increase it
   • BThe application uses HTTP Basic authentication; switch to form-based
   • CThe session cookie is set by JavaScript; use HttpOnly instead
   • DThe application does not know the request is secure because the load balancer does not forward the X-Forwarded-Proto header; configure the load balancer to forward it and set the cookie Secure flag
   Reveal Solution Discussion Select an answer first