12 real Auth questions from the REST API bank, as asked in Indian campus drives and tech interviews. Every question has a verified answer and an AI-tutor explanation on placd — free to start.
1. What is Bearer Token?
Junior
A.a compact, self-contained signed token of three base64url parts (header, payload, signature) that carries claims the server can verify without a lookup
B.an authorization framework that lets an application obtain limited access to a user's resources via delegated access tokens, without sharing the password
C.a credential sent in the Authorization header that grants access to whoever possesses it, without proving identity separately
D.a long-lived credential exchanged for a new short-lived access token without forcing the user to log in again
A.Bearer Token — a compact, self-contained signed token of three base64url parts (header, payload, signature) that carries claims the server can verify without a lookup
B.Bearer Token — an authorization framework that lets an application obtain limited access to a user's resources via delegated access tokens, without sharing the password
C.Bearer Token — a long-lived credential exchanged for a new short-lived access token without forcing the user to log in again
D.Bearer Token — a credential sent in the Authorization header that grants access to whoever possesses it, without proving identity separately
A.an authorization framework that lets an application obtain limited access to a user's resources via delegated access tokens, without sharing the password
B.a compact, self-contained signed token of three base64url parts (header, payload, signature) that carries claims the server can verify without a lookup
C.a long-lived credential exchanged for a new short-lived access token without forcing the user to log in again
D.a credential sent in the Authorization header that grants access to whoever possesses it, without proving identity separately
5. Which term means: "a compact, self-contained signed token of three base64url parts (header, payload, signature) that carries claims the server can verify without a lookup"?
A.JWT — an authorization framework that lets an application obtain limited access to a user's resources via delegated access tokens, without sharing the password
B.JWT — a credential sent in the Authorization header that grants access to whoever possesses it, without proving identity separately
C.JWT — a compact, self-contained signed token of three base64url parts (header, payload, signature) that carries claims the server can verify without a lookup
D.JWT — a long-lived credential exchanged for a new short-lived access token without forcing the user to log in again
A.a credential sent in the Authorization header that grants access to whoever possesses it, without proving identity separately
B.an authorization framework that lets an application obtain limited access to a user's resources via delegated access tokens, without sharing the password
C.a compact, self-contained signed token of three base64url parts (header, payload, signature) that carries claims the server can verify without a lookup
D.a long-lived credential exchanged for a new short-lived access token without forcing the user to log in again
8. Which term means: "an authorization framework that lets an application obtain limited access to a user's resources via delegated access tokens, without sharing the password"?
A.OAuth 2.0 — a compact, self-contained signed token of three base64url parts (header, payload, signature) that carries claims the server can verify without a lookup
B.OAuth 2.0 — a credential sent in the Authorization header that grants access to whoever possesses it, without proving identity separately
C.OAuth 2.0 — an authorization framework that lets an application obtain limited access to a user's resources via delegated access tokens, without sharing the password
D.OAuth 2.0 — a long-lived credential exchanged for a new short-lived access token without forcing the user to log in again
A.a compact, self-contained signed token of three base64url parts (header, payload, signature) that carries claims the server can verify without a lookup
B.an authorization framework that lets an application obtain limited access to a user's resources via delegated access tokens, without sharing the password
C.a long-lived credential exchanged for a new short-lived access token without forcing the user to log in again
D.a credential sent in the Authorization header that grants access to whoever possesses it, without proving identity separately
A.Refresh Token — a compact, self-contained signed token of three base64url parts (header, payload, signature) that carries claims the server can verify without a lookup
B.Refresh Token — a long-lived credential exchanged for a new short-lived access token without forcing the user to log in again
C.Refresh Token — an authorization framework that lets an application obtain limited access to a user's resources via delegated access tokens, without sharing the password
D.Refresh Token — a credential sent in the Authorization header that grants access to whoever possesses it, without proving identity separately
Answers, AI explanations, and a scored voice mock interview
Sign up free to check your answers with explanations, ask the AI tutor anything on any question, and take one full AI mock interview — scored like a real panel.