AuthN vs AuthZ: Sessions, Tokens, and OAuth2 Essentials Quiz Quiz

Test your understanding of authentication vs authorization, session management, token basics, and OAuth2 concepts with this easy-level quiz. Strengthen your knowledge on core security terminology and practices essential for secure systems.

1. Difference Between Authentication and Authorization

   Which statement best describes the difference between authentication (AuthN) and authorization (AuthZ)?

   1. Authentication confirms identity, while authorization determines access rights.
   2. Authorization confirms identity, while authentication provides access.
   3. Authentication gives permissions, and authorization sets passwords.
   4. Authentication and authorization mean the same thing.

   Explanation: Authentication is the process of verifying who a user is, while authorization defines what resources a user can access after their identity is confirmed. The second option incorrectly reverses the definitions of the terms. The third option is wrong because authentication and authorization are distinct concepts. The fourth option confuses the processes involved and incorrectly assigns tasks to each.

2. Real-Life Example of Authorization

   If an employee logs into a system and tries to view payroll data but is denied because of insufficient privileges, what process is being enforced?

   1. Password Reset
   2. Audit Logging
   3. Authentication
   4. Authorization

   Explanation: Authorization involves controlling access to resources, such as determining who can view payroll data. Authentication occurs prior when the employee logs in. Audit logging records actions, not permissions. Password reset changes the authentication credential rather than controlling access.

3. Purpose of a Session in Web Security

   Why does a web application create a user session after successful login?

   1. To bypass login for all users
   2. To exchange large files between users
   3. To permanently save user preferences
   4. To store user authentication state across multiple requests

   Explanation: Sessions keep track of authenticated users so they do not need to re-authenticate with every request. Sessions are not meant for saving permanent user preferences or for file exchange. The last option is incorrect; security best practices do not support bypassing login for all users.

4. Function of Access Tokens

   What is the primary role of an access token in modern web applications?

   1. To encrypt user passwords
   2. To grant access to specific resources after authentication
   3. To store all personal user data
   4. To serve as web page content

   Explanation: Access tokens are used to authorize users to access particular resources once they have authenticated. They are not used for encrypting passwords, storing personal data, or as content for web pages. Their main function is controlling resource access.

5. Meaning of OAuth2 'Resource Owner'

   In OAuth2 terminology, who is the 'resource owner'?

   1. The application requesting access
   2. The server storing the files
   3. The database administrator
   4. The user granting access to their data

   Explanation: The resource owner in OAuth2 is the user who controls the data or resources and can grant access. The server storing files is called the resource server, not the owner. The requesting application is known as the client, and the database administrator manages the database rather than owning user resources.

6. Access Control Example

   After authenticating successfully, a student cannot access faculty-only documents. This is an example of what security concept?

   1. Authorization
   2. Authentication
   3. Malware Prevention
   4. Session Hijacking

   Explanation: Authorization restricts actions or data based on user roles, such as denying students access to faculty documents. Authentication only verifies the student's identity. Malware prevention and session hijacking are unrelated to access control.

7. Authentication Factor Example

   Which of the following is an example of an authentication factor?

   1. A network firewall rule
   2. A user’s reading history
   3. A list of allowed IP addresses
   4. A password entered during login

   Explanation: A password is a widely used authentication factor proving a user's identity. Firewall rules and IP address lists are methods of controlling access but do not authenticate identity. Reading history is a user data record, not an authentication factor.

8. Token Expiry Benefit

   Why do access tokens usually have an expiration time set?

   1. To allow tokens to be shared indefinitely
   2. To speed up application performance
   3. To limit potential misuse if the token is compromised
   4. To avoid storing user roles

   Explanation: Setting an expiration for tokens reduces risk if they are stolen or misused. Short-lived tokens restrict the window for unauthorized access. Expiry does not boost speed, nor is it related to the storage of user roles. Tokens should never be shared indefinitely; that's poor security.

9. Session vs. Token Storage

   Where is a session identifier typically stored in a traditional web application?

   1. In a PNG image
   2. In a browser cookie
   3. On a physical USB device
   4. Inside a spreadsheet

   Explanation: Session identifiers are usually kept in cookies so the browser can send them with each request. Storing IDs in images, on USB devices, or spreadsheets is not standard practice for session management.

10. OAuth2 'Client' Role

    Within the OAuth2 framework, what is the primary responsibility of the 'client'?

    1. Managing the user’s passwords directly
    2. Acting as the resource owner
    3. Requesting access to resources on behalf of the user
    4. Issuing tokens to users

    Explanation: The client in OAuth2 is the application asking for permission to access resources. It does not manage passwords, issue tokens, or act as the resource owner. Each of those other functions belongs to a different OAuth2 role.

11. Authorization Example

    A system checks if a logged-in user is part of the 'admin' group before allowing access to settings. What is this checking process called?

    1. Encryption
    2. Authorization
    3. Rate Limiting
    4. Authentication

    Explanation: Checking group membership before permitting access aligns with authorization, where role-based access is enforced. Authentication would confirm identity, while encryption and rate limiting are unrelated to group access.

12. Bearer Token Use

    When a web client sends a 'Bearer token' in the Authorization header, what is it trying to do?

    1. Register a new user
    2. Encrypt the communication channel
    3. Request a password reset
    4. Prove it is authorized to access a protected resource

    Explanation: Including a Bearer token shows the client is authorized for a resource. It is not used for password resets, encryption, or user registration tasks. Bearer tokens are evidence of access rights rather than authentication or transmission security.

13. Refresh Token Function

    What is the main purpose of a refresh token in OAuth2?

    1. To obtain a new access token without re-authenticating the user
    2. To delete user accounts
    3. To validate a user's email address
    4. To store user roles

    Explanation: A refresh token allows the application to get a new access token after the previous one expires, avoiding repeated user logins. It is not used for account deletion, email validation, or storing user roles.

14. Token vs. Password Usage

    Which statement compares access tokens to passwords correctly?

    1. Access tokens are short-lived and provide resource access, while passwords prove identity at login.
    2. Passwords are used for authorization, and tokens for authentication.
    3. Access tokens and passwords are both permanent credentials.
    4. Passwords are embedded in access tokens for security.

    Explanation: Tokens usually have a short lifetime and are used for accessing resources, whereas passwords authenticate users during login. Passwords are for authentication, and tokens for authorization, not the other way around. Embedding passwords in tokens is insecure and not practiced.

15. Session Timeout Purpose

    Why does a secure website log a user out after a period of inactivity?

    1. To increase page loading speed
    2. To clear browser cache automatically
    3. To avoid using HTTPS
    4. To protect the account if the user steps away

    Explanation: A timeout after inactivity helps prevent unauthorized actions when the user is absent. It is not aimed at performance, does not replace the need for secure connections, and is unrelated to clearing cache.

16. OAuth2 User Consent

    During OAuth2 authorization, why is the user asked for consent when an app requests access to certain resources?

    1. To lower application fees
    2. To change the user's password
    3. To ensure the user agrees to share specific data
    4. To encrypt the entire database

    Explanation: User consent is core to OAuth2, letting users actively permit access to chosen data. Changing passwords, lowering fees, and encrypting databases are not objectives of the consent process during OAuth2.