Security and Privacy Quiz

To pass the quiz, you must correctly answer at least 18 of the 20 questions below. # --quizzes-- ## --quiz-- ### --question-- #### --text-- What cryptographic protocol does HTTPS use to encrypt the communication channel between a browser and a server? #### --distractors-- SSL (Secure Sockets Layer) --- HTTP/1 --- HTTP/2 #### --answer-- TLS (Transport Layer Security) ### --question-- #### --text-- How do data minimization and purpose limitation work together to protect user privacy? #### --distractors-- Data minimization restricts how data is used, while purpose limitation limits how much is collected. --- Both principles allow unlimited data collection as long as it is encrypted. --- Both principles require companies to share data with advertising networks. #### --answer-- Data minimization limits how much data is collected, while purpose limitation restricts how that data can be used. ### --question-- #### --text-- What does the `HttpOnly` flag do when set on a cookie? #### --distractors-- It ensures the cookie is only sent over HTTPS connections. --- It prevents the browser from sending the cookie on cross-site requests. --- It encrypts the cookie value before storing it in the browser. #### --answer-- It blocks JavaScript from reading the cookie. ### --question-- #### --text-- What specific requirement does COPPA impose on websites that collect data from children under 13? #### --distractors-- Display a "Do Not Sell My Personal Information" link on the homepage. --- Allow users to opt out of data sharing with a single click. --- Delete all user data within 30 days of account closure. #### --answer-- Obtain verifiable parental consent before collecting personal information. ### --question-- #### --text-- Which of the following correctly describes the relationship between security and privacy? #### --distractors-- Privacy can exist without security, but security cannot exist without privacy. --- Security and privacy are identical concepts with the same goals. --- Neither security nor privacy can exist without the other. #### --answer-- Security can exist without privacy, but privacy cannot exist without security. ### --question-- #### --text-- What type of attack does a Content Security Policy primarily defend against? #### --distractors-- Distributed Denial of Service (DDoS) attacks. --- Credential stuffing attacks. --- Man-in-the-Middle (MITM) attacks. #### --answer-- Cross-Site Scripting (XSS) attacks. ### --question-- #### --text-- What supply chain risk is introduced when applications rely heavily on external libraries, third-party APIs, and microservices? #### --distractors-- The application becomes slower due to excessive network calls. --- External tools automatically update and introduce breaking changes. --- The codebase becomes harder to read and maintain over time. #### --answer-- Vulnerabilities from external sources can spread into the main application. ### --question-- #### --text-- Which three parts must all match exactly for two URLs to share the same origin? #### --distractors-- Username, password, and domain name. --- IP address, port number, and file path. --- Browser version, operating system, and domain name. #### --answer-- Protocol, domain name, and port number. ### --question-- #### --text-- Why should developers add `.env` to `.gitignore`? #### --distractors-- To speed up the build process by skipping configuration files. --- To automatically load environment variables without using the dotenv package. --- To share configuration settings with other developers on the team. #### --answer-- To prevent sensitive credentials from being committed to version control. ### --question-- #### --text-- What mitigation strategy is most effective against credential stuffing attacks? #### --distractors-- Requiring users to change their passwords every 30 days. --- Blocking all login attempts from foreign IP addresses. --- Storing passwords in a separate encrypted database. #### --answer-- Enforcing multi-factor authentication. ### --question-- #### --text-- What is the primary purpose of the digital certificate required for HTTPS? #### --distractors-- To speed up the loading time of web pages. --- To encrypt all files stored on the server. --- To store the user's login session securely. #### --answer-- To prove the true identity of the website owner. ### --question-- #### --text-- What is the key difference between how the GDPR and the CCPA handle user consent for data tracking? #### --distractors-- The GDPR focuses on opt-out rights, while the CCPA requires strict opt-in consent. --- Both laws require strict opt-in consent before any data collection occurs. --- Both laws allow companies to use pre-ticked boxes for user consent. #### --answer-- The GDPR requires strict opt-in consent, while the CCPA focuses on opt-out rights. ### --question-- #### --text-- Which of the following is an example of an indirect identifier under PII? #### --distractors-- A person's full legal name. --- A national identification number. --- A home street address. #### --answer-- A device serial number or IP address. ### --question-- #### --text-- What is the key difference between first-party and third-party cookies? #### --distractors-- First-party cookies are encrypted; third-party cookies are not. --- First-party cookies are stored on the server; third-party cookies are stored in the browser. --- First-party cookies require consent; third-party cookies do not require any consent. #### --answer-- First-party cookies track you on the site you visit; third-party cookies track you across different websites. ### --question-- #### --text-- What is the primary focus of data privacy compared to data security? #### --distractors-- Building technical defenses like firewalls and encryption. --- Protecting systems from unauthorized access by hackers. --- Monitoring network traffic for malicious activity. #### --answer-- Controlling how organizations collect, store, and use personal data. ### --question-- #### --text-- What Permissions-Policy syntax completely disables a browser feature for all users on the page? #### --distractors-- `feature=(none)` --- `feature=(self)` --- `feature=(*)` #### --answer-- `feature=()` with an empty list. ### --question-- #### --text-- How does the `dotenv` library make `.env` variables accessible in a Node.js application? #### --distractors-- It stores variables in browser local storage for client-side access. --- It creates a new global `config` object containing all the values. --- It encrypts sensitive data and stores it in a remote database. #### --answer-- It reads the `.env` file and injects the keys into `process.env`. ### --question-- #### --text-- What does a server send to grant a browser permission to read a cross-origin response? #### --distractors-- A `Set-Cookie` header with the requesting domain. --- A `Content-Security-Policy` header. --- A `Strict-Transport-Security` header. #### --answer-- An `Access-Control-Allow-Origin` header. ### --question-- #### --text-- What type of security gap results from deploying servers using standard factory settings? #### --distractors-- Systems are automatically patched with the latest security updates. --- Factory settings enforce strong encryption by default. --- Default configurations require multi-factor authentication out of the box. #### --answer-- Default configurations often include blank admin passwords and open ports. ### --question-- #### --text-- What security principle do companies apply to reduce damage caused by insider threats? #### --distractors-- Granting all employees full system access for transparency. --- Monitoring employee social media for suspicious behavior. --- Requiring all employees to sign non-disclosure agreements annually. #### --answer-- Enforcing the principle of least privilege to restrict access to only necessary files.