App Security Recap

Which package is used to hash passwords and other sensitive information before sending them to the database to protect against breaches?

• jsonwebtoken

• dotenv

• bcrypt

• mongoose

Answer explanation

bcrypt is used to hash passwords and sensitive data before storing them in a database.

It provides security by converting passwords into irreversible strings, protecting against breaches by ensuring that even if the database is compromised, the original passwords remain unknown.

What is the purpose of Access Tokens?

• To allow a new access to be requested

• To grant access based on the user's role

• To authenticate a user

• To track who does what, when, where and how

Answer explanation

Access tokens are used to grant access to specific resources or functionalities based on the user's role or permissions, ensuring that users only have access to what they are authorized to use.

What is the purpose of the jsonwebtoken package in app security?

• To manage environmental variables and sensitive information.

• To provide a means of representing claims transferred between two parties securely.

• To hash passwords and sensitive information.

• To build APIs and server-side applications with Node.js.

Answer explanation

JWT enables the creation, verification, and decoding of JSON Web Tokens (JWTs), which are used to authenticate and authorize users in web applications.

What is the value of access control?

• To grant access based on the user's role

• To provide case-by-case control over resources

• To regulate access rights and organize them into tiers

• To keep sensitive information from falling into the hands of bad actors

What does Authentication help in achieving?

• To report on what was done

• To track who does what, when, where and how

• To be able to prove who we are

• To get permission to do something

What is the purpose of Identity Concept?

• To get permission to do something

• To track who does what, when, where and how

• To be able to prove what we are

• To report on what was done

Answer explanation

The purpose of the Identity Concept is to track who does what, when, where, and how, primarily focusing on managing and securing digital identities within an organization or across digital platforms.

How are authorizations handled?

• By managing policy control

• By granting access to resources and defining actions

• By tracking who does what, when, where and how

• By simplifying enforcement through a common approach

Which npm command is used to install a specific package and save it as a dependency in the package.json file?

• npm init

• npm save

• npm start

• npm install

What is the main goal of Access Control?

• To keep sensitive information from falling into the hands of bad actors

• To grant access based on one or more attributes of the user's current environment and identity

• To provide users only with the data they need to perform their jobs

• To regulate access rights and organize them into tiers

What npm command is used to initialize a new or existing npm package in a directory?

• npm init

• npm run

• npm start

• npm install