Authentication & Authorization | Test-1
This section focuses on evaluating the security of user authentication and authorization mechanisms. Tests include assessing the strength of password policies, multi-factor authentication (MFA), session management, and protection against brute-force attacks. It also involves verifying proper access controls to ensure that users have appropriate permissions and cannot escalate privileges. Additionally, this section tests the robustness of token management (e.g., JWT, OAuth), secure login processes, and defenses against common threats such as authentication bypass, session hijacking, and privilege escalation.
1 / 22
1. In the context of authentication and authorization, ______ can be users, programs, processes, services, computers, or anything else that can access a resource. When authorized, they can also modify objects. It is also an active entity that accesses a passive object to receive information from, or data about, an object.
In the context of the question the term subject refers to a user, program/processes/services etc.
2 / 22
2. An_____ refers to any passive entity that provides information to active subjects. Examples of such entities include files, databases, computers, programs, processes, services, printers, and storage media
In the context of authentication, an object refers to a protected entity or resource that a user or service attempts to access. It’s the target of authorization decisions, determining who can do what with it.
3 / 22
3. _________ is a crucial part of information security that establishes who has privilege to certain information, applications, and resources—and under what conditions.
Access control is the security mechanism that governs who can access what, within a computer system or network. It acts as a digital gatekeeper, ensuring only authorized individuals or entities can access specific resources, while keeping everything else secure.
4 / 22
4. The process of confirming that a subject (user/system), in fact, who or what it claims to be is known as:
Authentication is the cornerstone of security in the digital world. It’s the process of verifying someone’s or something’s identity, ensuring they are who or what they claim to be. Think of it as proving your passport at the airport – before gaining access, you need to demonstrate your legitimacy.
5 / 22
5. Generally, the enterprise users and their credentials and privileges are stored/managed in:
Directory servers are the digital librarians of the enterprise assets (users and digital resources), tirelessly organizing and indexing information about network resources and users. They act as central repositories, enabling efficient access and management of crucial data in large networks.
6 / 22
6. What are the three different types of Authentication attributes?
Here’s a concise summary of the three primary authentication factors:
Combining two or more factors (multi-factor authentication) significantly strengthens security.
7 / 22
7. Providing access to a system based on a factor such as passwords is an example of?
Something you know refers to something you remember like passwords, PINs and security questions
8 / 22
8. The best mechanism to securely store passwords in an application database is by:
Hashing with salt includes
9 / 22
9. _________ is the process of granting a subject (user/services) permission to access specific resources or capabilities once their identity is verified.
Authorization is the process of granting or denying access to resources, systems, or information based on the permissions and privileges assigned to an individual or system entity. It defines what actions or operations an authenticated user or system is allowed to perform within a given environment.
10 / 22
10. Lightweight Directory Access Protocol (LDAP) is used to:
The Lightweight Directory Access Protocol (LDAP) is used to access and manage directory information, including user identities and attributes, within a centralized directory service. LDAP facilitates authentication, authorization, and directory searches in networked environments.
11 / 22
11. __________is something you have, may be any credential based on items that the user can own and carry with them, including hardware devices, like a security token or a mobile phone used to accept a text message or to run an authentication app that can generate a one-time password (OTP) or PIN.
In the case of possession factors, authentication relies on the user possessing a physical device or object. This can include hardware tokens, smart cards, mobile devices, or any item that the user physically possesses. The possession factor adds an extra layer of security by requiring the user to have a tangible item in addition to knowing a password or PIN.
12 / 22
12. What does OAuth stand for?
OAuth stands for Open Authorization. It is an open standard for access delegation commonly used to grant websites or applications limited access to user information without exposing passwords.
13 / 22
13. The standard port number used by LDAP protocol is:
The standard port number used by the LDAP (Lightweight Directory Access Protocol) protocol is 389 for non-encrypted communication. These port numbers are defined by the Internet Assigned Numbers Authority (IANA) for LDAP services.
14 / 22
14. What does PAM stand for in context of access management?
PAM refers to a set of technologies and practices that manage and secure privileged access within an organization’s IT environment.
15 / 22
15. What part does biometrics play in access control?
Biometrics in access control involves using unique physical or behavioral characteristics, such as fingerprints, facial features, or iris patterns, to verify and grant access to individuals. Biometrics enhances security by providing a more personalized and difficult-to-replicate method of authentication compared to traditional methods like passwords or access cards.
16 / 22
16. A table that includes both subjects and objects is known as _________. People who might need to access items are typically referred to as subjects. Typically, objects are documents, information, or other resources that subjects may need to access. They might also be a piece of hardware or a system process. The information in it specifies access levels and permissions for subjects and objects. They are created by organizations to guarantee authorized access and guard against malicious or accidental unauthorized access to sensitive data.
The phrase Access Control matrix matches the definition in the question.
17 / 22
17. How are credentials sent in HTTP Basic Authentication?
The client passes the authentication information to the server in an Authorization header. The authentication information is in base-64 encoding.
18 / 22
18. The standard port number used by LDAPS protocol is:
The standard port number used by LDAPS (LDAP over SSL/TLS) protocol is 636.
19 / 22
19. Which of the following is an advantage with passwords-based authentication?
Password-based authentication is considered affordable due to its simplicity, low overhead, and widespread compatibility. It is easy to implement and manage, requiring minimal infrastructure changes and benefiting from users’ familiarity with the concept. The cost-effectiveness and ease of integration into existing systems contribute to its widespread adoption.
20 / 22
20. What’s the main purpose of OIDC?
The main purpose of OpenID Connect (OIDC) is to provide a simple and secure way to verify the identity of users (authentication) and to obtain basic user profile information, building on the OAuth 2.0 framework.
21 / 22
21. What does OIDC stand for?
OpenID Connect (OIDC) is an authentication protocol that builds on OAuth 2.0. It allows clients to verify the identity of users based on the authentication performed by an authorization server, and to obtain basic profile information about the user in an interoperable and REST-like manner. OIDC is commonly used for single sign-on (SSO) solutions.
22 / 22
22. What does WebAuthn stand for?
In short, WebAuthn (Web Authentication) is a web standard that enables secure and passwordless authentication, allowing users to log in to websites and applications using biometrics, security keys, or other authenticators.
Your score is
The average score is 0%
Restart Test
Related challenges :
