AuthN vs AuthZ for APIs (sessions vs tokens, scopes/roles, testing protected endpoints) Quiz

Test your knowledge on authentication (AuthN) and authorization (AuthZ) for APIs, including differences between sessions and tokens, using scopes and roles, and methods for testing protected endpoints. Ideal for learners wanting to grasp key concepts in securing API access.

1. Authentication Purpose

   Which process verifies the identity of a user trying to access an API?

   1. Automatization
   2. Attrubution
   3. Authentication
   4. Authorization

2. Authorization Role

   If a user is recognized but needs their access level determined before using an endpoint, which process handles this scenario?

   1. Authentication
   2. Authorization
   3. Assertion
   4. Autherization

3. Sessions vs Tokens

   Which mechanism often uses a server-side record to keep track of a user's login state, known as a session?

   1. Sessions
   2. Scopes
   3. Tokens
   4. Roles

4. Token Functionality

   In an API context, which item is commonly used to represent the user's identity and permissions in a stateless way?

   1. Tocken
   2. Token
   3. Session
   4. Secession

5. Scopes and Roles

   What is generally used within tokens to define what actions a user can perform, such as 'read' or 'write'?

   1. Scripts
   2. Scopes
   3. Tracks
   4. Scones

6. Testing Protected Endpoints

   Which step is necessary when testing an API endpoint that requires authentication?

   1. Remove request headers
   2. Skip security checks
   3. Modify the API endpoint URL
   4. Provide valid credentials or tokens

7. Example Scenario

   If Alice logs in and then tries to access admin data, which process checks if she has the right permissions?

   1. Authentication
   2. Authorization
   3. Automation
   4. Authenication

8. Incorrect Authorization

   Which issue occurs if an API endpoint does not verify user roles before granting access to protected data?

   1. Broken authentication
   2. Unauthorized access
   3. Token expiration
   4. Session timeout

9. Session Expiry

   If a user's session expires, what must typically happen before they continue accessing protected API endpoints?

   1. Tokens become unlimited
   2. They must re-authenticate
   3. They can keep using the API
   4. Scopes get updated automatically

10. Testing Without AuthN

    When sending a request to a protected API without authentication, what is the expected response?

    1. User is automatically registered
    2. Successful data response
    3. Roles are assigned automatically
    4. Access denied or unauthorized error