Application & Web Security Interview Questions & Answers
Application & Web Security Interview Questions
✔ What is the meaning of 256-bit encryption?
To transmit electronic documents or data over the internet, we use encryption algorithms and when encryption uses a key of 256-bit length, that is called 246-bit encryption.
✔ What is the Cipher suite?
Cipher Suite is a set of algorithms that are used to secure a network connection. That connection uses TLS (Transport Layer Security) or SSL (Secure Socket Layer). Cipher suites usually include a bulk encryption algorithm, a key exchange algorithm, or a message authentication code (MAC) algorithm.
✔What is MAC?
Message authentication code is a code or is a small piece of information that is used to authenticate a message and it also ensures that message sent from the sender has not been changed.
✔ What is PKI?
PKI is called Public Key infrastructure. PKI is a set of roles, policies, hardware, software, and procedures.
PKI is used to create, manage, distribute, store, use and revoke digital certificates and public-key encryption.
✔ What is TCP?
Transmission control protocol (TCP) is an important protocol of the Internet protocol suite. It provides reliable, ordered, and error-checked delivery of a bytes stream between applications running on different hosts which are communicating via an IP network.
✔ What is public-key cryptography?
Asymmetric cryptography is also known as public-key cryptography and uses a public and private key to encrypt and decrypt data. Keys are large numbers that are paired together but are not identical (asymmetric).
✔ What is SSL?
First thing, when SSL is implemented on the website then we can see https:// in the address bar, a padlock, green address bar, or a combination of the three.
SSL secures your connection to a web server and encrypts any transferred data.
An SSL certificate (or TLS certificate) is a digital certificate that binds a cryptographic key to your organization’s details. Secure Sockets Layer (SSL) are cryptographic protocols designed to encrypt communication between a server and a web browser.
✔ What is the role of SSL Certificates?
SSL certificates add an extra level of security between your website and visitors by creating an encrypted link between you and them.
This provides two layers of protection:
Encryption: Sharing information online can be risky, many people prefer to only transact with businesses they know and trust. With an SSL certificate, customers know their sensitive data is encrypted and secure. SSL certificates can have different levels of encryption but the standard SSL certificate can be sufficient to get started.
Verifying identity: SSL certificates identify the website owner and create an additional level of trust for online businesses.
✔ Who developed SSL?
The Secure Sockets Layer (SSL) protocol was developed by Netscape Communications Corporation. SSL ensures the data that is transferred between a client and a server remains private. This protocol enables the client to authenticate the identity of the server.
✔ What are all types of SSL Certificates?
Domain validated certificate (DV) –
Prove ownership over a domain name. The identity of the organization isn’t checked, only that the person who has the SSL certificate also controls the domain name. This is the most basic level of SSL certificate and often comes free with hosting.
Organization validated certificate (OV) –
Prove ownership of domain name and provide a registered company name. Individuals running a website won’t be issued this level of certification.
Extended Validation certificate (EV) –
Highest level of SSL certificate. To obtain an EV, you need to be able to validate your business, domain name and go through additional verification steps.
✔ What is Transport Layer Security (TLS)?
Transport Layer Security (TLS) is a more secure version of SSL and it is also known as the successor to Secure Sockets Layer (SSL).
Same as SSL, TLS also provides privacy and data integrity between two or more communicating applications. When a communication channel is secured by TLS, connections between your browser and a server must have one or more of the following properties:
- The connection is secured by symmetric cryptography.
- The identity of communicating parties (e.g. you and server) can be authenticated using public-key cryptography.
- The connection is reliable because each transmitted message has integrity checked using a message authentication code (MAC), preventing undetected loss or manipulation of data.
✔ What is Hypertext Transfer Protocol Secure (HTTPS)?
Hypertext Transfer Protocol Secure (HTTPS) is an extension of Hypertext Transfer Protocol (HTTP). It is used to securely transfer data over a network. In HTTPS, the communication is encrypted using TLS.
HTTPS provides authentication of the accessed website, protecting the privacy and integrity of exchanged data. It also protects against man-in-the-middle attacks.
✔ Can you explain VPN?
A Virtual Private Network (VPN) is a technology that allows user devices to securely connect to a corporate network from remote locations with an Internet connection.
This technology is usually restricted to laptops (PC or Mac) and provides access to network resources such as shared folders and printers remotely, via a secured connection.
✔ What is threat modeling?
Threat modeling is a procedure for optimizing the application, system, infrastructure, or business process security by identifying obstacles and vulnerabilities and then defining actions to prevent or mitigate the effects of threats to the system.
Threat modeling helps to identify the security requirements of a system or process.
Application & Web Security Interview Questions
✔ What is the Safe Harbour Agreement?
The Safe Harbour Agreement was a set of principles that governed the exchange of data between the United States of America and the European Union (and Switzerland).
✔ What are HTTP headers?
HTTP headers let the client and the server pass additional information with an HTTP request or response. An HTTP header consists of its case-insensitive name followed by a colon (:), then by its value.
HTTP Headers are four types.
- Request Headers
- Response Headers
- Representation Headers
- Payload Headers
✔ What are Request Headers?
Accept-* and Authorization
https://developer.mozilla.org/en-US/docs/Glossary/Request_header
✔ What are Response Headers?
Response headers, like Age, Location, or Server are used to give a more detailed context of the response.
https://developer.mozilla.org/en-US/docs/Glossary/Response_header
✔ What are Representation Headers?
Representation headers include Content-Type, Content-Encoding, Content-Language, and Content-Location.
https://developer.mozilla.org/en-US/docs/Glossary/Representation_header
✔ What are Payload headers?
The payload headers include Content-Length, Content-Range, Trailer, and Transfer-Encoding.
https://developer.mozilla.org/en-US/docs/Glossary/Payload_header
✔ What are diff types of attacks?
Read here: https://blog.netwrix.com/2018/05/15/top-10-most-common-types-of-cyber-attacks/
A cyber attack is a malicious attempt and action that can breach computer information systems, networks, and personal information. It can harm and destroy important documents, data and can steal user accounts by using various methods.
- Man-in-the-middle (MitM) attack
> Session hijacking
> IP Spoofing
> Replay Attack - Denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks
> TCP SYN flood attack
> Teardrop attack
> Smurf attack
> Ping of death attack
> Botnets - Password attack
> Brute-force Attack
> Dictionary attack - Phishing and spear-phishing attacks
- Drive-by attack
- SQL injection attack
- Cross-site scripting (XSS) attack
- Eavesdropping attack
> Passive eavesdropping
> Active eavesdropping - Birthday attack
- Malware attack
✔ What is HIPAA?
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that required the creation of national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge.
How long keys 40, 56, 128, and 256 can be decrypted with brute force attack?
40-bit will be broken in about 9 minutes.
56-bit will be broken in about a year.
128-bit will be broken in about 5,783,128,169,837,158,197,871 years.
256-bit will never be broken, for all practical purposes.
Application & Web Security Interview Questions
✔ What is DMZ?
In computer networks, a DMZ, or demilitarized zone, is a physical or logical subnet that separates a local area network (LAN) from other untrusted networks — usually, the public internet.
✔ What does POODLE stand for?
Padding Oracle on Downgraded Legacy Encryption.
The POODLE vulnerability allows the attacker to eavesdrop on encrypted communication. This means that the attacker can steal confidential data that is transmitted, for example, passwords or session cookies, and then impersonate the user. This can have very serious consequences or effects, including losing control over the web application (for example, if the attacker impersonates an admin).
The vulnerability is no longer present in the Transport Layer Security protocol (TLS), which is the successor to SSL (Secure Socket Layer).
✔ What is common hashing control in cyber security?
A common use of hashes is to store password authentication data. Rather than store the plaintext of user passwords, a controlled access system stores the hash of each user’s password in a file or database.
There are multiple types of hashing algorithms, but the most common are Message Digest 5 (MD5) and Secure Hashing Algorithm (SHA) 1 and 2.
✔ What is Symmetric Key Encryption?
In Symmetric-key encryption the message is encrypted by using a key and the same key is used to decrypt the message which makes it easy to use but less secure. It also requires a safe method to transfer the key from one party to another.
The size of ciphertext is the same or smaller than the original plain text.
It only provides confidentiality.
✔ What is Asymmetric Key Encryption?
Asymmetric Key Encryption is based on public and private key encryption techniques. It uses two different keys to encrypt and decrypt the message. It is more secure than the symmetric key encryption technique but is much slower.
The size of ciphertext is the same or larger than the original plain text.
It provides confidentiality, authenticity, and non-repudiation.
✔ What methodology is used in threat modeling for risk analysis?
There are six main methodologies you can use while threat modeling—STRIDE, PASTA, CVSS, attack trees, Security Cards, and HTMM. Each of these methodologies provides a different way to assess the threats facing your IT assets.
✔ What are the differences between active and passive scanning?
Active scanning for system inventory information and vulnerability, data is a powerful tool that can return great benefits. Active scanning on your network also can return great headaches, however. It can have a high political cost and far-reaching effects on system uptime and reliability. If not done carefully, it can be an ineffective, inefficient way to gather information.Passive scanning, by its nature, is politically less sensitive and technically a dramatically lighter touch on the network. It provides accurate, up-to-date information as soon as a system appears and starts “talking.”
✔ What is a worm attack?
A computer worm is a standalone malware computer program that replicates itself in order to spread to other computers. It often uses a computer network to spread itself, relying on security failures on the target computer to access it.
✔ What is penetration testing in cyber security?
Penetration testing, also known as pen testing, security pen testing, and security testing is a form of ethical hacking. The pen test attempts to pierce the armor of an organization’s cyber defenses, checking for exploitable vulnerabilities in networks, web apps, and user security.
Penetration testing is typically performed using manual or automated technologies to systematically compromise servers, endpoints, web applications, wireless networks, network devices, mobile devices, and other potential points of exposure.
Application & Web Security Interview Questions
