AuthN & AuthZ interview questions

1. A.verifying who a user or system is (proving identity)
2. B.requiring additional verification before a sensitive action despite an existing session
3. C.Time-based One-Time Password, a short-lived code derived from a shared secret and current time
4. D.trusting identities asserted by an external identity provider via standards like SAML or OIDC

Answer + AI explanation with Pro

1. A.TOTP
2. B.Credential stuffing
3. C.SAML
4. D.Authentication

Answer + AI explanation with Pro

1. A.Authentication — verifying who a user or system is (proving identity)
2. B.Authentication — trusting identities asserted by an external identity provider via standards like SAML or OIDC
3. C.Authentication — storing a slow one-way hash of a password rather than the plaintext
4. D.Authentication — FIDO2-based passwordless authentication using public-key credentials bound to a device and origin

Answer + AI explanation with Pro

1. A.storing a slow one-way hash of a password rather than the plaintext
2. B.determining what an authenticated identity is allowed to do
3. C.requiring additional verification before a sensitive action despite an existing session
4. D.verifying who a user or system is (proving identity)

Answer + AI explanation with Pro

1. A.Step-up authentication
2. B.TOTP
3. C.Authorization
4. D.Multi-factor authentication (MFA)

Answer + AI explanation with Pro

1. A.Authorization — temporarily blocking logins after repeated failures to slow brute-force attacks
2. B.Authorization — determining what an authenticated identity is allowed to do
3. C.Authorization — requiring additional verification before a sensitive action despite an existing session
4. D.Authorization — authenticating once to gain access to multiple independent systems

Answer + AI explanation with Pro

1. A.temporarily blocking logins after repeated failures to slow brute-force attacks
2. B.requiring two or more independent factors: something you know, have, or are
3. C.Time-based One-Time Password, a short-lived code derived from a shared secret and current time
4. D.trusting identities asserted by an external identity provider via standards like SAML or OIDC

Answer + AI explanation with Pro

1. A.Federation
2. B.Session fixation
3. C.Multi-factor authentication (MFA)
4. D.Token binding

Answer + AI explanation with Pro

1. A.Multi-factor authentication (MFA) — FIDO2-based passwordless authentication using public-key credentials bound to a device and origin
2. B.Multi-factor authentication (MFA) — trusting identities asserted by an external identity provider via standards like SAML or OIDC
3. C.Multi-factor authentication (MFA) — requiring additional verification before a sensitive action despite an existing session
4. D.Multi-factor authentication (MFA) — requiring two or more independent factors: something you know, have, or are

Answer + AI explanation with Pro

1. A.XML-based standard for exchanging authentication and authorization assertions between IdP and SP
2. B.verifying who a user or system is (proving identity)
3. C.server-issued identifier that maintains a user's authenticated state across requests
4. D.authenticating once to gain access to multiple independent systems

Answer + AI explanation with Pro

1. A.Multi-factor authentication (MFA)
2. B.Authentication
3. C.Single Sign-On (SSO)
4. D.Session fixation

Answer + AI explanation with Pro

1. A.Single Sign-On (SSO) — authenticating once to gain access to multiple independent systems
2. B.Single Sign-On (SSO) — server-issued identifier that maintains a user's authenticated state across requests
3. C.Single Sign-On (SSO) — determining what an authenticated identity is allowed to do
4. D.Single Sign-On (SSO) — Time-based One-Time Password, a short-lived code derived from a shared secret and current time

Answer + AI explanation with Pro

1. A.authenticating once to gain access to multiple independent systems
2. B.server-issued identifier that maintains a user's authenticated state across requests
3. C.FIDO2-based passwordless authentication using public-key credentials bound to a device and origin
4. D.storing a slow one-way hash of a password rather than the plaintext

Answer + AI explanation with Pro

1. A.Session token
2. B.Credential stuffing
3. C.Password hashing
4. D.Single Sign-On (SSO)

Answer + AI explanation with Pro

1. A.Session token — server-issued identifier that maintains a user's authenticated state across requests
2. B.Session token — determining what an authenticated identity is allowed to do
3. C.Session token — cryptographically tying a token to a client (e.g. TLS channel) so a stolen token cannot be replayed elsewhere
4. D.Session token — trusting identities asserted by an external identity provider via standards like SAML or OIDC

Answer + AI explanation with Pro

1. A.forcing a victim to use a known session ID so the attacker can hijack the session after login
2. B.requiring additional verification before a sensitive action despite an existing session
3. C.authenticating once to gain access to multiple independent systems
4. D.storing a slow one-way hash of a password rather than the plaintext

Answer + AI explanation with Pro

1. A.Federation
2. B.Password hashing
3. C.Credential stuffing
4. D.Session token

Answer + AI explanation with Pro

1. A.Password hashing — storing a slow one-way hash of a password rather than the plaintext
2. B.Password hashing — server-issued identifier that maintains a user's authenticated state across requests
3. C.Password hashing — requiring two or more independent factors: something you know, have, or are
4. D.Password hashing — FIDO2-based passwordless authentication using public-key credentials bound to a device and origin

Answer + AI explanation with Pro

1. A.forcing a victim to use a known session ID so the attacker can hijack the session after login
2. B.XML-based standard for exchanging authentication and authorization assertions between IdP and SP
3. C.using leaked username/password pairs from one breach to log into other services
4. D.Time-based One-Time Password, a short-lived code derived from a shared secret and current time

Answer + AI explanation with Pro

1. A.Authentication
2. B.Step-up authentication
3. C.TOTP
4. D.Session token

Answer + AI explanation with Pro

1. A.TOTP — Time-based One-Time Password, a short-lived code derived from a shared secret and current time
2. B.TOTP — server-issued identifier that maintains a user's authenticated state across requests
3. C.TOTP — using leaked username/password pairs from one breach to log into other services
4. D.TOTP — XML-based standard for exchanging authentication and authorization assertions between IdP and SP

Answer + AI explanation with Pro

1. A.requiring two or more independent factors: something you know, have, or are
2. B.authenticating once to gain access to multiple independent systems
3. C.using leaked username/password pairs from one breach to log into other services
4. D.server-issued identifier that maintains a user's authenticated state across requests

Answer + AI explanation with Pro

1. A.Multi-factor authentication (MFA)
2. B.Credential stuffing
3. C.Step-up authentication
4. D.Session fixation

Answer + AI explanation with Pro

1. A.Credential stuffing — using leaked username/password pairs from one breach to log into other services
2. B.Credential stuffing — authenticating once to gain access to multiple independent systems
3. C.Credential stuffing — cryptographically tying a token to a client (e.g. TLS channel) so a stolen token cannot be replayed elsewhere
4. D.Credential stuffing — requiring two or more independent factors: something you know, have, or are

Answer + AI explanation with Pro

1. A.verifying who a user or system is (proving identity)
2. B.server-issued identifier that maintains a user's authenticated state across requests
3. C.forcing a victim to use a known session ID so the attacker can hijack the session after login
4. D.cryptographically tying a token to a client (e.g. TLS channel) so a stolen token cannot be replayed elsewhere

Answer + AI explanation with Pro

1. A.Session fixation
2. B.Multi-factor authentication (MFA)
3. C.Session token
4. D.Federation

Answer + AI explanation with Pro

1. A.Session fixation — FIDO2-based passwordless authentication using public-key credentials bound to a device and origin
2. B.Session fixation — server-issued identifier that maintains a user's authenticated state across requests
3. C.Session fixation — cryptographically tying a token to a client (e.g. TLS channel) so a stolen token cannot be replayed elsewhere
4. D.Session fixation — forcing a victim to use a known session ID so the attacker can hijack the session after login

Answer + AI explanation with Pro

1. A.Time-based One-Time Password, a short-lived code derived from a shared secret and current time
2. B.XML-based standard for exchanging authentication and authorization assertions between IdP and SP
3. C.temporarily blocking logins after repeated failures to slow brute-force attacks
4. D.verifying who a user or system is (proving identity)

Answer + AI explanation with Pro

1. A.TOTP
2. B.Credential stuffing
3. C.Multi-factor authentication (MFA)
4. D.Account lockout

Answer + AI explanation with Pro

1. A.Account lockout — verifying who a user or system is (proving identity)
2. B.Account lockout — determining what an authenticated identity is allowed to do
3. C.Account lockout — temporarily blocking logins after repeated failures to slow brute-force attacks
4. D.Account lockout — authenticating once to gain access to multiple independent systems

Answer + AI explanation with Pro