AuthN vs AuthZ: Essentials of Authentication, Authorization, and Access Control Quiz

Test your understanding of authentication (AuthN), authorization (AuthZ), access tokens, roles, permissions, least privilege principles, and OAuth2 basics. This quiz is designed for anyone seeking to strengthen their foundational knowledge of secure access and user permission management.

1. Authentication Purpose

   Which concept is primarily concerned with verifying a user’s identity before allowing access to a system?

   1. Accountization
   2. Authentication
   3. Authorization
   4. Augmentation

   Explanation: Authentication is the process of proving who someone is, often through passwords or biometric checks. Authorization, on the other hand, decides what an authenticated user can do. Accountization is not a technical term in this context, and augmentation generally refers to enhancement, not identity verification.

2. Authorization Focus

   What process determines which resources an authenticated user is allowed to access or actions they can perform within a system?

   1. Authorization
   2. Automation
   3. Audition
   4. Authentication

   Explanation: Authorization deals with granting permissions once the user’s identity is confirmed. Authentication occurs before this step, while automation and audition do not relate to permissions for specific actions or resources in access control.

3. Token Usage in Security

   In access control, what is a token typically used for?

   1. Proving identity or granted permissions
   2. Translating languages
   3. Compressing data
   4. Reducing network traffic

   Explanation: Tokens are digital objects that represent the identity of a user or describe the permissions they have. They are not designed to reduce network traffic or compress data, nor are they translation tools.

4. Roles vs Permissions

   Which statement best describes the difference between a role and a permission in access control?

   1. A permission is a collection of roles assigned to users.
   2. A role is a collection of permissions, while a permission is a specific allowed action.
   3. Roles and permissions are identical and interchangeable.
   4. A permission grants all actions, while a role restricts access.

   Explanation: Roles group together multiple permissions for easier management. Conversely, a permission defines a particular action or resource access. The other options are incorrect as they misrepresent the relationship or interchangeability between roles and permissions.

5. Least Privilege Principle

   What does the principle of least privilege recommend in the context of user permissions?

   1. Users should share their permissions with others
   2. Users should have all permissions by default
   3. Permissions should be ignored to speed up access
   4. Users should receive only the permissions necessary to perform their job

   Explanation: The principle aims to limit unnecessary access, reducing risk and potential misuse. Assigning all permissions by default, ignoring permissions, or sharing them conflicts with security best practices.

6. Authentication Example

   Entering your username and password to log into a website is an example of which process?

   1. Automation
   2. Allocation
   3. Authentication
   4. Authorization

   Explanation: This action proves your identity to the system, matching the definition of authentication. Authorization would determine what you can do after login, while automation and allocation do not fit this scenario.

7. Authorization Scenario

   After logging in, being allowed to view your emails but not others’ is an example of which process?

   1. Authorization
   2. Authentication
   3. Alignment
   4. Aviation

   Explanation: Authorization defines which data or actions are permitted for a user. Authentication only verifies your identity, and alignment and aviation are unrelated concepts in this context.

8. OAuth2 Token Type

   With OAuth2, what is an access token primarily used for?

   1. Verifying internet connectivity
   2. Resetting a user’s password
   3. Granting access to specific resources on behalf of a user
   4. Encrypting files locally

   Explanation: An access token allows access to resources according to the permissions granted. It does not handle password resets, local encryption, or network checks, which are separate from OAuth2 token purposes.

9. Authorization Data

   Which data is typically checked during authorization to determine a user's allowed actions?

   1. Browser color theme
   2. Device manufacturer
   3. Roles or permissions
   4. IP address

   Explanation: A user's roles or permissions are central to authorization decisions. IP address might sometimes be used for additional security but is not standard for authorization. Device manufacturer and browser color theme hold no relevance.

10. Re-authentication Need

    If a user tries to access a restricted page and is prompted to log in again, which process is occurring?

    1. Authentication
    2. Application
    3. Allocation
    4. Authorization

    Explanation: Being asked to log in is a classic example of authentication. Authorization is about what you can access after logging in. Application and allocation carry different meanings unrelated to access verification.

11. Role-based Access Control Example

    If a group of employees can all edit documents because they share the 'Editor' role, what access control model does this illustrate?

    1. Token-based encryption
    2. Mandatory access control
    3. Discretionary access control
    4. Role-based access control

    Explanation: This scenario reflects role-based access by granting permissions via group roles. Discretionary or mandatory models follow other logic, and token-based encryption concerns secure data transmission rather than access assignment.

12. OAuth2 Consent Flow

    When using OAuth2, what typical step must a user complete to grant a third-party application access to their resources?

    1. Change their account username
    2. Review and consent to requested permissions
    3. Deactivate their account temporarily
    4. Install extra security hardware

    Explanation: OAuth2 workflows require users to approve or deny permission requests. Hardware installation, username changes, or account deactivation are not part of standard OAuth2 authorization.

13. Access Token Expiry

    Why do access tokens typically have an expiration time in secure systems?

    1. To increase internet speed
    2. To limit how long authorizations remain valid
    3. To slow down user logins
    4. To save storage space

    Explanation: Tokens expire to reduce the security risk if they are compromised. Slowing logins, saving space, or increasing internet speed are not the purposes of token expiry.

14. Implicit Permissions Danger

    Why is it risky to assign users more permissions than they need in a system?

    1. It guarantees higher internet bandwidth
    2. It significantly speeds up the application
    3. It automatically encrypts all their data
    4. It increases the chances of accidental or malicious misuse

    Explanation: Excessive permissions can be exploited unintentionally or intentionally, violating least privilege. It does not affect performance, bandwidth, or automatically provide encryption.

15. Username Verification

    Which process is responsible for verifying that a username belongs to a real user before checking their access rights?

    1. Authorization
    2. Autographication
    3. Augmentation
    4. Authentication

    Explanation: Authentication establishes user identity before rights can be checked. Authorization follows authentication, while autographication is a typo and augmentation is unrelated.