Timing attack on comparison

A server verifies a received tag by comparing it to the expected tag byte by byte, stopping at the first differing byte.

1. Explain how an attacker can exploit this comparison to reconstruct a valid tag without knowing the key.
2. What is the countermeasure?