MCQs on Security in Java | Secure Java Applications
Java offers robust features for creating secure applications through the Java Cryptography Architecture, SSL, and best practices in secure coding. These MCQs cover key concepts in Java security, including encryption, authentication, and authorization methods.
Java Cryptography Architecture (JCA)
What is the primary purpose of Java Cryptography Architecture (JCA)?
a) To manage memory efficiently
b) To handle cryptographic operations securely
c) To enhance Java’s file handling capabilities
d) To provide networking utilities
Which package in Java provides the core classes for cryptographic operations?
a) java.security
b) java.crypto
c) java.encryption
d) java.security.crypto
In JCA, what does the KeyGenerator class do?
a) Generates digital signatures
b) Manages cryptographic keys
c) Generates encryption keys
d) Encrypts data
Which JCA class is used for generating Message Digests?
a) KeyGenerator
b) MessageDigest
c) Cipher
d) Signature
What is the purpose of a digital signature in JCA?
a) To encrypt data
b) To authenticate data and verify integrity
c) To compress data
d) To store data securely
Which JCA class would you use to implement RSA encryption?
a) KeyPairGenerator
b) MessageDigest
c) Cipher
d) Signature
In Java, which algorithm is NOT used for symmetric encryption?
a) AES
b) RSA
c) DES
d) Blowfish
Which of the following provides a secure random number generator in Java?
a) Random
b) Math.random()
c) SecureRandom
d) CryptoRandom
Authentication and Authorization
What is the purpose of authentication in Java security?
a) To verify data integrity
b) To identify and verify a user or entity
c) To establish data encryption
d) To manage memory security
Which class in Java is commonly used for password-based authentication?
a) SecureRandom
b) KeyPair
c) PasswordAuthentication
d) Authenticator
Which Java API is used for role-based access control in Java applications?
a) Java Authorization Contract (JAC)
b) Java Access Control System (JACS)
c) Java Authentication and Authorization Service (JAAS)
d) Java Security Manager (JSM)
In JAAS, what is a principal?
a) A private key
b) An entity representing a user or role
c) A type of cryptographic algorithm
d) A session token
How can JAAS be configured in Java applications?
a) By creating a JAAS configuration file
b) By setting environment variables
c) By using the SecurityManager class
d) By hardcoding usernames and passwords
Which JAAS component is responsible for enforcing access control decisions?
a) Authentication Module
b) LoginModule
c) Principal Manager
d) Authorization Manager
In Java, what is the purpose of an Authenticator class?
a) To encrypt passwords
b) To manage secure socket connections
c) To handle authentication requests from HTTP connections
d) To verify digital signatures
What does Single Sign-On (SSO) mean in the context of Java security?
a) Authenticating users once to access multiple systems
b) Encrypting data with a single key
c) Synchronizing user data across systems
d) Verifying the source of encrypted data
Secure Socket Layer (SSL) in Java
What is the purpose of SSL in Java applications?
a) To ensure secure communication over a network
b) To manage secure file storage
c) To create secure class loading
d) To increase code readability
Which Java class is used to create SSL connections?
a) SSLSocket
b) SSLCertificate
c) SSLProvider
d) SSLConnection
What is the default port used by HTTPS for SSL connections?
a) 21
b) 80
c) 443
d) 8080
Which class is used to handle SSL certificates in Java?
a) X509Certificate
b) CertificateAuthority
c) SSLHandler
d) KeyCertificate
What is the purpose of a trust manager in SSL?
a) To authenticate users
b) To validate server certificates
c) To manage cryptographic keys
d) To manage session tokens
In SSL, what is the difference between a key store and a trust store?
a) Key store stores encryption keys; trust store stores trusted certificates
b) Both are the same
c) Trust store holds session data; key store stores passwords
d) Key store manages cryptographic algorithms
Which protocol is commonly used alongside SSL to provide secure data transfer in Java applications?
a) HTTP
b) TLS
c) FTP
d) UDP
Which method of SSLSocket is used to initiate an SSL handshake?
a) connect()
b) startHandshake()
c) beginHandshake()
d) secureConnect()
Secure Coding Practices in Java
Which of the following is a secure coding practice in Java?
a) Avoiding input validation
b) Hardcoding sensitive information
c) Validating all input data
d) Using plain-text storage for passwords
What is one way to prevent SQL injection attacks in Java?
a) Using Statement for SQL queries
b) Using PreparedStatement with parameterized queries
c) Using ResultSet for queries
d) Encrypting the SQL queries
Which of the following helps in preventing cross-site scripting (XSS) in Java-based web applications?
a) Input validation
b) SQL query parameterization
c) Using GET instead of POST
d) Encrypting URLs
What is the recommended practice for handling sensitive information in Java applications?
a) Storing in plain-text files
b) Storing in secure environment variables or encrypted formats
c) Hardcoding in the source code
d) Storing in local variables
Which technique can be used to protect Java applications from buffer overflow vulnerabilities?
a) Encrypting data
b) Using type-safe programming practices
c) Using only static variables
d) Avoiding method overloading
Which API in Java helps to restrict the actions of untrusted code?
a) Java Security Manager
b) Java Reflection API
c) Java Cryptography Extension
d) Java Random Library
Answer Key
Qno
Answer
1
b) To handle cryptographic operations securely
2
a) java.security
3
c) Generates encryption keys
4
b) MessageDigest
5
b) To authenticate data and verify integrity
6
c) Cipher
7
b) RSA
8
c) SecureRandom
9
b) To identify and verify a user or entity
10
c) PasswordAuthentication
11
c) Java Authentication and Authorization Service (JAAS)
12
b) An entity representing a user or role
13
a) By creating a JAAS configuration file
14
d) Authorization Manager
15
c) To handle authentication requests from HTTP connections
16
a) Authenticating users once to access multiple systems
17
a) To ensure secure communication over a network
18
a) SSLSocket
19
c) 443
20
a) X509Certificate
21
b) To validate server certificates
22
a) Key store stores encryption keys; trust store stores trusted certificates
23
b) TLS
24
b) startHandshake()
25
c) Validating all input data
26
b) Using PreparedStatement with parameterized queries
27
a) Input validation
28
b) Storing in secure environment variables or encrypted formats
