Authentication and Authorization Defensive Techniques in Java CASEJAVA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A Java application stores user passwords. The team wants to migrate from SHA-256 with a static salt to a more secure scheme. They need to verify existing hashes during login and gradually rehash passwords. Which approach should they implement?

   • AUse PBKDF2 with a static salt for all new passwords and require all users to reset their passwords immediately.
   • BImmediately replace all stored SHA-256 hashes with BCrypt hashes of the same hash values.
   • CUse BCrypt for new passwords, and on successful login with an old SHA-256 hash, rehash the password with BCrypt and update the stored hash.
   • DKeep SHA-256 but increase the static salt length to 64 bytes.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A Java application needs to support both certificate-based authentication for internal users and form-based authentication for external users. The application is deployed on a Tomcat server. The security team wants to use a single authentication mechanism that can handle both. What is the most appropriate approach?

   • AUse a custom authentication filter that first checks for a client certificate and then falls back to form-based login
   • BUse HTTP Basic authentication for both
   • CUse only certificate-based authentication and issue certificates to external users
   • DUse only form-based authentication and ignore certificates
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A Java web application uses a servlet filter to check authentication. The filter allows requests to /login and /public, but requires a valid session for all other paths. A developer notices that a request to /admin/deleteUser with a valid session but no authorization check succeeds. What is the missing control?

   • AA stronger session timeout.
   • BAn authorization check to ensure the user has the appropriate role or permission.
   • CHTTPS for the admin path.
   • DA CAPTCHA on the admin page.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A Java web application returns a 401 Unauthorized status with a detailed error page that includes the exception stack trace when authentication fails. What is the primary security risk?

   • AThe error page may cause a denial of service if many users fail authentication.
   • BThe 401 status code is incorrect; it should be 403.
   • CInformation leakage that can help an attacker understand the application's internals.
   • DThe error page may be cached by the browser and shown to other users.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which Java authentication mechanism relies on the client presenting an X.509 certificate during the TLS handshake to establish identity?

   • ACertificate-based authentication
   • BHTTP Basic authentication
   • CForm-based authentication
   • DDigest authentication
   Reveal Solution Discussion Select an answer first