Authentication and Authorization Quiz

To pass the quiz, you must correctly answer at least 18 of the 20 questions below. # --quizzes-- ## --quiz-- ### --question-- #### --text-- What are the three parts of a JSON Web Token? #### --distractors-- Header, Body, and Footer --- Token, Payload, and Hash --- ID, Claims, and Certificate #### --answer-- Header, Payload, and Signature ### --question-- #### --text-- Which of the following is an example of "something you have" as an authentication factor? #### --distractors-- A fingerprint scan. --- A password you memorized. --- A security question answer. #### --answer-- A one-time code sent to your smartphone. ### --question-- #### --text-- Which of the following best describes authorization? #### --distractors-- Verifying that a user's credentials match the stored records. --- Generating a session token after a user successfully logs in. --- Encrypting a user's password before saving it to the database. #### --answer-- Deciding what actions an authenticated user is allowed to take. ### --question-- #### --text-- What is a Passport.js Strategy? #### --distractors-- A config file that maps application routes to authentication rules. --- A built-in function that hashes and stores user passwords securely. --- A token generated after a user successfully completes the login flow. #### --answer-- A plugin that defines how to authenticate users with a specific method or provider. ### --question-- #### --text-- What does Helmet.js do to the X-Powered-By header by default? #### --distractors-- It replaces the header with a generic placeholder value. --- It encrypts the header value before sending it to the client. --- It moves the header information into an HTTP-only cookie. #### --answer-- It removes the X-Powered-By header entirely. ### --question-- #### --text-- What does setting a cookie `SameSite` attribute to `Strict` do? #### --distractors-- It encrypts the cookie before storing it in the browser. --- It ensures the cookie is only sent over HTTPS connections. --- It blocks the server from setting more than one cookie per response. #### --answer-- It prevents the browser from sending the cookie on any cross-site request. ### --question-- #### --text-- In a JWT, where is the user's claim data such as user ID or role stored? #### --distractors-- In the Signature section. --- In the Header section. --- In an encrypted container outside the token. #### --answer-- In the Payload section. ### --question-- #### --text-- Which HTTP header set by Helmet prevents your site from being embedded inside an iframe on another domain? #### --distractors-- Content-Security-Policy --- X-Powered-By --- Strict-Transport-Security #### --answer-- X-Frame-Options ### --question-- #### --text-- How does a CSRF attack exploit the browser? #### --distractors-- It injects JavaScript into the victim's browser to directly steal cookies. --- It intercepts traffic between the victim's browser and the trusted server. --- It sends a phishing link that redirects the victim to a fake login page. #### --answer-- It tricks the browser into sending a request that includes the victim's session cookie automatically. ### --question-- #### --text-- What does `app.use(passport.initialize())` do in an Express app? #### --distractors-- It registers a new authentication Strategy with the application. --- It creates a session cookie for every user who visits the app. --- It automatically installs all available Passport strategies. #### --answer-- It sets up Passport as middleware to handle authentication on each incoming request. ### --question-- #### --text-- Which role in a role-based authorization system typically has full access to system settings and user management? #### --distractors-- Editor --- Moderator --- Standard User #### --answer-- Admin ### --question-- #### --text-- Which command installs the Passport.js core package and the local strategy? #### --distractors-- `npm install passport.js passport-local` --- `npm install passport passport-auth` --- `npm install passportjs local-strategy` #### --answer-- `npm install passport passport-local` ### --question-- #### --text-- Why should you never store a password in a JWT payload? #### --distractors-- The payload has a size limit that makes storing password-length strings impossible. --- Storing a password in the payload automatically invalidates the token's signature. --- JWT tokens expire too quickly to make passwords stored inside them useful. #### --answer-- The payload is Base64 encoded, not encrypted, so anyone with the token can decode it. ### --question-- #### --text-- What is the purpose of a CSRF token? #### --distractors-- To encrypt the user's session cookie before it is stored in the browser. --- To verify the user's identity on every API request sent to the server. --- To replace the session cookie with a short-lived authentication credential. #### --answer-- To confirm that a request came from the legitimate frontend, which a malicious site cannot read. ### --question-- #### --text-- Which HTTP response header does Helmet set to defend against Cross-Site Scripting (XSS)? #### --distractors-- X-Frame-Options --- X-Powered-By --- Strict-Transport-Security #### --answer-- Content-Security-Policy ### --question-- #### --text-- When a user tries to access a protected resource, which process should happen first? #### --distractors-- Authorization --- Role assignment --- Session creation #### --answer-- Authentication ### --question-- #### --text-- What does Passport.js attach to the request object after a user successfully authenticates? #### --distractors-- The active session token as `req.sessionToken`. --- The strategy name used for login as `req.strategy`. --- The user's hashed password as `req.credentials`. #### --answer-- The authenticated user object as `req.user`. ### --question-- #### --text-- What happens when a server receives a JWT whose payload has been tampered with? #### --distractors-- The server decodes the payload and updates the user record with the new data. --- The server silently ignores the tampered data and uses the original token claims. --- The server deletes the token and sends the user back to the registration page. #### --answer-- The signature will not match and the server rejects the request. ### --question-- #### --text-- Compared to `SameSite=Strict`, what does `SameSite=Lax` allow? #### --distractors-- It allows the cookie on all cross-site requests, including form submissions. --- It blocks the cookie on all requests that originate from outside the same domain. --- It requires the user to log in again on any cross-site navigation. #### --answer-- It allows the cookie on top-level navigation but still blocks it on cross-site form submissions and API requests. ### --question-- #### --text-- What does the Strict-Transport-Security header enforce when set by Helmet? #### --distractors-- It forces the server to reject all non-HTTPS requests with an error response. --- It encrypts the entire HTTP response body before sending it to the browser. --- It requires all cookies to have the Secure and HttpOnly flags set. #### --answer-- It forces the browser to communicate with the server over HTTPS only.