Authentication and Authorization Defensive Techniques in Java CASEJAVA Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   When an authentication failure occurs, what is the recommended approach for logging the error details?

   • ALog the full stack trace and exception details to the server log, but return a generic error to the user
   • BReturn a detailed error message to the user and log nothing
   • CDisplay the full stack trace to the user in the browser
   • DLog only the username and password in the server log
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A Java application uses BCrypt for password hashing. The team wants to increase the work factor from 10 to 12. What is the best way to handle existing hashes?

   • ARehash passwords on successful login using the new work factor.
   • BImmediately rehash all stored hashes with the new work factor.
   • CRequire all users to reset their passwords immediately.
   • DStore the work factor in a separate column and use it during verification.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which Java authentication mechanism transmits credentials as Base64-encoded text in the HTTP Authorization header and is considered weak unless used over TLS?

   • AOAuth 2.0 bearer token authentication
   • BCertificate-based authentication
   • CHTTP Basic authentication
   • DForm-based authentication
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A Java application uses Spring Security with a custom PermissionEvaluator to check permissions on domain objects. The evaluator uses the authenticated user's roles and a permission table. A user with role 'EDITOR' can edit articles, but the requirement is that only the article's author can edit. What is the best way to enforce this?

   • AUse a servlet filter to check the article's author.
   • BUse @PreAuthorize("hasRole('EDITOR')") on the edit method.
   • CUse @PreAuthorize with a custom permission evaluator that checks if the current user is the author of the article.
   • DUse @PostAuthorize to check ownership after the method executes.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A Java web application uses Spring Security with method-level security enabled. The requirement is that only users with the 'ADMIN' role can call the deleteUser method, but the application also needs to allow users with the 'SUPERVISOR' role to delete users they manage. The current code uses @PreAuthorize("hasRole('ADMIN')"). What is the most appropriate change to meet the requirement?

   • AUse @PreAuthorize("hasAnyRole('ADMIN','SUPERVISOR') and @userService.manages(principal, #userId)")
   • BKeep the annotation and add a check inside the method to verify the supervisor manages the target user
   • CChange the annotation to @PreAuthorize("hasAnyRole('ADMIN','SUPERVISOR')")
   • DChange the annotation to @PreAuthorize("hasRole('ADMIN') or hasRole('SUPERVISOR')")
   Reveal Solution Discussion Select an answer first