1. What is Authentication ? Junior A. verifying who a user or system is (proving identity) B. requiring additional verification before a sensitive action despite an existing session C. Time-based One-Time Password, a short-lived code derived from a shared secret and current time D. trusting identities asserted by an external identity provider via standards like SAML or OIDC
2. Which term means: "verifying who a user or system is (proving identity)"? Junior A. TOTP B. Credential stuffing C. SAML D. Authentication
3. Which statement is correct? Junior A. Authentication — verifying who a user or system is (proving identity) B. Authentication — trusting identities asserted by an external identity provider via standards like SAML or OIDC C. Authentication — storing a slow one-way hash of a password rather than the plaintext D. Authentication — FIDO2-based passwordless authentication using public-key credentials bound to a device and origin
4. What is Authorization ? Junior A. storing a slow one-way hash of a password rather than the plaintext B. determining what an authenticated identity is allowed to do C. requiring additional verification before a sensitive action despite an existing session D. verifying who a user or system is (proving identity)
5. Which term means: "determining what an authenticated identity is allowed to do"? Junior A. Step-up authentication B. TOTP C. Authorization D. Multi-factor authentication (MFA)
6. Which statement is correct? Junior A. Authorization — temporarily blocking logins after repeated failures to slow brute-force attacks B. Authorization — determining what an authenticated identity is allowed to do C. Authorization — requiring additional verification before a sensitive action despite an existing session D. Authorization — authenticating once to gain access to multiple independent systems
7. What is Multi-factor authentication (MFA) ? Junior A. temporarily blocking logins after repeated failures to slow brute-force attacks B. requiring two or more independent factors: something you know, have, or are C. Time-based One-Time Password, a short-lived code derived from a shared secret and current time D. trusting identities asserted by an external identity provider via standards like SAML or OIDC
8. Which term means: "requiring two or more independent factors: something you know, have, or are"? Junior A. Federation B. Session fixation C. Multi-factor authentication (MFA) D. Token binding
9. Which statement is correct? Junior A. Multi-factor authentication (MFA) — FIDO2-based passwordless authentication using public-key credentials bound to a device and origin B. Multi-factor authentication (MFA) — trusting identities asserted by an external identity provider via standards like SAML or OIDC C. Multi-factor authentication (MFA) — requiring additional verification before a sensitive action despite an existing session D. Multi-factor authentication (MFA) — requiring two or more independent factors: something you know, have, or are
10. What is Single Sign-On (SSO) ? Junior A. XML-based standard for exchanging authentication and authorization assertions between IdP and SP B. verifying who a user or system is (proving identity) C. server-issued identifier that maintains a user's authenticated state across requests D. authenticating once to gain access to multiple independent systems
11. Which term means: "authenticating once to gain access to multiple independent systems"? Junior A. Multi-factor authentication (MFA) B. Authentication C. Single Sign-On (SSO) D. Session fixation
12. Which statement is correct? Junior A. Single Sign-On (SSO) — authenticating once to gain access to multiple independent systems B. Single Sign-On (SSO) — server-issued identifier that maintains a user's authenticated state across requests C. Single Sign-On (SSO) — determining what an authenticated identity is allowed to do D. Single Sign-On (SSO) — Time-based One-Time Password, a short-lived code derived from a shared secret and current time
13. What is Session token ? Junior A. authenticating once to gain access to multiple independent systems B. server-issued identifier that maintains a user's authenticated state across requests C. FIDO2-based passwordless authentication using public-key credentials bound to a device and origin D. storing a slow one-way hash of a password rather than the plaintext
14. Which term means: "server-issued identifier that maintains a user's authenticated state across requests"? Junior A. Session token B. Credential stuffing C. Password hashing D. Single Sign-On (SSO)
15. Which statement is correct? Junior A. Session token — server-issued identifier that maintains a user's authenticated state across requests B. Session token — determining what an authenticated identity is allowed to do C. Session token — cryptographically tying a token to a client (e.g. TLS channel) so a stolen token cannot be replayed elsewhere D. Session token — trusting identities asserted by an external identity provider via standards like SAML or OIDC
16. What is Password hashing ? Junior A. forcing a victim to use a known session ID so the attacker can hijack the session after login B. requiring additional verification before a sensitive action despite an existing session C. authenticating once to gain access to multiple independent systems D. storing a slow one-way hash of a password rather than the plaintext
17. Which term means: "storing a slow one-way hash of a password rather than the plaintext"? Junior A. Federation B. Password hashing C. Credential stuffing D. Session token
18. Which statement is correct? Junior A. Password hashing — storing a slow one-way hash of a password rather than the plaintext B. Password hashing — server-issued identifier that maintains a user's authenticated state across requests C. Password hashing — requiring two or more independent factors: something you know, have, or are D. Password hashing — FIDO2-based passwordless authentication using public-key credentials bound to a device and origin
19. What is TOTP ? Mid A. forcing a victim to use a known session ID so the attacker can hijack the session after login B. XML-based standard for exchanging authentication and authorization assertions between IdP and SP C. using leaked username/password pairs from one breach to log into other services D. Time-based One-Time Password, a short-lived code derived from a shared secret and current time
20. Which term means: "Time-based One-Time Password, a short-lived code derived from a shared secret and current time"? Mid A. Authentication B. Step-up authentication C. TOTP D. Session token
21. Which statement is correct? Mid A. TOTP — Time-based One-Time Password, a short-lived code derived from a shared secret and current time B. TOTP — server-issued identifier that maintains a user's authenticated state across requests C. TOTP — using leaked username/password pairs from one breach to log into other services D. TOTP — XML-based standard for exchanging authentication and authorization assertions between IdP and SP
22. What is Credential stuffing ? Mid A. requiring two or more independent factors: something you know, have, or are B. authenticating once to gain access to multiple independent systems C. using leaked username/password pairs from one breach to log into other services D. server-issued identifier that maintains a user's authenticated state across requests
23. Which term means: "using leaked username/password pairs from one breach to log into other services"? Mid A. Multi-factor authentication (MFA) B. Credential stuffing C. Step-up authentication D. Session fixation
24. Which statement is correct? Mid A. Credential stuffing — using leaked username/password pairs from one breach to log into other services B. Credential stuffing — authenticating once to gain access to multiple independent systems C. Credential stuffing — cryptographically tying a token to a client (e.g. TLS channel) so a stolen token cannot be replayed elsewhere D. Credential stuffing — requiring two or more independent factors: something you know, have, or are
25. What is Session fixation ? Mid A. verifying who a user or system is (proving identity) B. server-issued identifier that maintains a user's authenticated state across requests C. forcing a victim to use a known session ID so the attacker can hijack the session after login D. cryptographically tying a token to a client (e.g. TLS channel) so a stolen token cannot be replayed elsewhere
26. Which term means: "forcing a victim to use a known session ID so the attacker can hijack the session after login"? Mid A. Session fixation B. Multi-factor authentication (MFA) C. Session token D. Federation
27. Which statement is correct? Mid A. Session fixation — FIDO2-based passwordless authentication using public-key credentials bound to a device and origin B. Session fixation — server-issued identifier that maintains a user's authenticated state across requests C. Session fixation — cryptographically tying a token to a client (e.g. TLS channel) so a stolen token cannot be replayed elsewhere D. Session fixation — forcing a victim to use a known session ID so the attacker can hijack the session after login
28. What is Account lockout ? Mid A. Time-based One-Time Password, a short-lived code derived from a shared secret and current time B. XML-based standard for exchanging authentication and authorization assertions between IdP and SP C. temporarily blocking logins after repeated failures to slow brute-force attacks D. verifying who a user or system is (proving identity)
29. Which term means: "temporarily blocking logins after repeated failures to slow brute-force attacks"? Mid A. TOTP B. Credential stuffing C. Multi-factor authentication (MFA) D. Account lockout
30. Which statement is correct? Mid A. Account lockout — verifying who a user or system is (proving identity) B. Account lockout — determining what an authenticated identity is allowed to do C. Account lockout — temporarily blocking logins after repeated failures to slow brute-force attacks D. Account lockout — authenticating once to gain access to multiple independent systems Showing 30 of 45 AuthN & AuthZ questions — the full set, with answers, explanations and an AI tutor on every question, is inside.