Sample questions
Security Authn AuthzDifficulty 3
Which statement correctly compares session-based and token-based identity management?
- aSession-based approaches are inherently insecure and token-based approaches are inherently secure
- bToken-based approaches never expire, session-based approaches always expire
- cSession-based approaches cannot work across multiple servers under any circumstance
- dEach has different trade-offs around scaling and revocation; neither is universally superior✓
Explanation:Neither model is categorically 'more secure' — the choice is an engineering trade-off between server-side state (easy revocation, needs shared session storage to scale) and self-contained tokens (easy scaling, harder immediate revocation). Security depends on correct implementation in either case.
Security Authn AuthzDifficulty 3
A developer computes stored_value = fast_generic_hash(password) with no salt, reasoning 'it's hashed, so it's safe.' What is the strongest objection?
- aHashing is never appropriate for passwords under any configuration
- bWithout salt, identical passwords hash identically and crack fast✓
- cThe objection is invalid — any hash function makes passwords fully safe
- dThe only fix needed is to hash the value twice with the same function
Explanation:Password hashing needs both a unique salt (to defeat precomputed/rainbow tables and cross-user comparison) and a deliberately slow, memory-hard algorithm (to make brute-forcing expensive) — a fast generic hash with no salt provides little real protection.
Security Authn AuthzDifficulty 3
A token has a fixed 30-day expiration and the system has no way to invalidate a token before that. A support agent's laptop with an active token is stolen on day 2. What is the practical consequence?
- aNone, because tokens automatically detect the change of device
- bThe token becomes invalid the moment it is used from a new IP address
- cThe system will silently re-authenticate the thief with MFA
- dThe stolen token remains usable for up to 28 more days unless another control exists✓
Explanation:Without a revocation mechanism, a stateless token's only invalidation path is its expiration timestamp — if that is 30 days out and nothing else checks a denylist or forces re-authentication, a stolen token stays valid for the remainder of its lifetime, which is exactly why long-lived unrevocable tokens are risky.
Security Authn AuthzDifficulty 3
A low-privilege service account is found to have write access to a configuration file that a high-privilege process reads and executes logic from. Why is this a privilege escalation risk even without any password being stolen?
- aIt is not a risk, since no credentials were involved
- bIt only matters if the file is stored unencrypted on disk
- cIt can influence high-privilege process behavior✓
- dConfiguration files are never a security concern
Explanation:Escalation does not require stealing credentials directly; if a lower-privileged identity can influence data or configuration that a higher-privileged process trusts and acts on, that write access becomes an indirect path to higher-privilege behavior — a common real-world escalation pattern.
Security Authn AuthzDifficulty 3
An application integrates SSO but keeps its own separate is_admin flag in its local database, set manually and never synced with the identity provider's group membership. What risk does this create?
- aNone — local flags are always safer than identity-provider-managed groups
- bThe local flag can drift out of sync with the real identity elsewhere✓
- cThis guarantees the application is immune to SSO-related compromises
- dSSO cannot be combined with local authorization data under any design
Explanation:When an application layers its own authorization state on top of SSO-provided identity without keeping it synchronized, the two can diverge: someone deprovisioned or demoted at the identity-provider level may still hold stale elevated rights locally, undermining the trust boundary SSO was meant to centralize.
Security Cloud Infra SecurityDifficulty 3
An infrastructure template defines a rule allowing inbound access from 0.0.0.0/0 on the management port used for administration. What does a security scan most likely flag here?
- aThe management port is reachable from any address on the internet.✓
- bThe rule syntax is invalid and the template will fail to deploy.
- cThe rule only affects internal network traffic and poses no external risk.
- dThe rule is flagged only because of formatting, not because of the access it grants.
Explanation:Leaving a management port fully open to the internet lets attackers reach it directly to brute-force authentication or try known weaknesses; access should be restricted to only the resources that actually need it.