What is the key difference between authentication and authorisation?

Authentication verifies identity; authorisation controls what you may do

Which is the correct way to store user passwords?

Hash them with a slow salted function such as bcrypt or Argon2

Why is validation performed only in the browser insufficient as a security control?

It can be bypassed by disabling JavaScript or sending requests directly, so the server must validate too

During the TLS handshake, what is asymmetric encryption mainly used for in HTTPS?

Authenticating the server and securely agreeing on a shared symmetric session key

Which practice best fits the secure development lifecycle principle of building security in early?

Threat modelling during design and code review during development

§-Quiz

← back to the guide

Secure Software Architecture: HSC Software Engineering Module 1 quiz quiz

7 questions. Pick an answer and you'll see why right away. Options are shuffled each attempt, and the review at the end links each missed question to the dot point to revise.

Which component of the CIA triad is directly protected by encrypting data so only authorised parties can read it?
What is the key difference between authentication and authorisation?
Which is the correct way to store user passwords?
An attacker reads another user's record by changing the id in the URL /api/orders/123 to /api/orders/124. Which OWASP Top 10 (2021) category is this?
Why is validation performed only in the browser insufficient as a security control?
During the TLS handshake, what is asymmetric encryption mainly used for in HTTPS?
Which practice best fits the secure development lifecycle principle of building security in early?