Junior Auth & Security Interview Questions (50 MCQs)

Question 1

What is the difference between authentication and authorization?

Accepted Answer

Authentication verifies who the user is; authorization decides what they may access

Answer

Authentication decides access rights; authorization verifies identity

Answer

They are the same concept with different names across frameworks

Answer

Authentication happens only on the client and authorization only on the server

Question 2

A logged-in user requests a resource they lack permission for. Which status code should the server return?

Accepted Answer

`403 Forbidden`

Answer

`401 Unauthorized`

Answer

`400 Bad Request`

Answer

`407 Proxy Authentication Required`

Question 3

Per the HTTP spec, which header should a `401 Unauthorized` response include?

Accepted Answer

`WWW-Authenticate`

Answer

`Authorization`

Answer

`Set-Cookie`

Answer

`Access-Control-Allow-Credentials`

Question 4

Why is storing passwords with `SHA-256` (even salted) not recommended?

Accepted Answer

It is very fast, making GPU brute-force attacks cheap

Answer

SHA-256 is reversible, so passwords can be decrypted

Answer

Its output is too long to store in a database

Answer

SHA-256 gives a different random output for the same input

Question 5

What is the main purpose of a salt in password hashing?

Accepted Answer

Make each hash unique so rainbow tables and cracking many hashes at once fail

Answer

Encrypt the hash so it can't be read without a key

Answer

Shorten the hash for efficient storage

Answer

Hide the hashing algorithm from attackers

Question 6

Does a salt need to be kept secret?

Accepted Answer

No, it is usually stored with the hash; it only needs to be random and unique

Answer

Yes, if the salt leaks all passwords become instantly readable

Answer

Yes, it must be kept on a separate server

Answer

No, because the salt is the same for all users

Question 7

Which statement correctly distinguishes hashing, encryption, and encoding?

Accepted Answer

Hashing is one-way, encryption is reversible with a key, encoding is reversible without a key

Answer

All three are one-way and differ only in speed

Answer

Encoding is the most secure way to protect data

Answer

Hashing is reversible with a private key while encryption is not

Question 8

A developer stores passwords as Base64 and calls them 'encrypted'. What's wrong?

Accepted Answer

Base64 is just encoding; anyone can decode it without a key

Answer

Base64 is secure but its output is too large for databases

Answer

Base64 only works on binary files, not text

Answer

Nothing is wrong if Base64url is used instead

Question 9

What does the cost (work factor) parameter in bcrypt do?

Accepted Answer

Exponentially increases the number of rounds to make hashing slower

Answer

Sets the length of the hash output

Answer

Sets the number of characters in the salt

Answer

Sets the number of allowed failed login attempts

Question 10

Per OWASP guidance, which is the preferred default algorithm for password hashing in a new project?

Accepted Answer

`Argon2id`

Answer

Salted `MD5`

Answer

Single-iteration `SHA-512`

Answer

`AES-256` with a fixed key

Question 11

In session-based authentication, what is typically stored in the browser cookie?

Accepted Answer

A random session ID the server uses to look up session data

Answer

The user's username and password, encoded

Answer

The full user profile and roles in plaintext

Answer

The user's password hash for comparison on each request

Question 12

What does the `HttpOnly` cookie flag do?

Accepted Answer

Prevents JavaScript from reading the cookie via `document.cookie`

Answer

Sends the cookie only over HTTP, not HTTPS

Answer

Encrypts the cookie so even the server can't read it

Answer

Blocks the cookie on cross-site requests

Question 13

What does the `Secure` cookie flag guarantee?

Accepted Answer

The cookie is only sent over HTTPS connections

Answer

The cookie is stored encrypted on disk

Answer

The cookie's contents can't be tampered with by the user

Answer

The cookie is only sent for the same path

Question 14

With `SameSite=Strict`, what happens to the cookie when a user clicks a link to your site from another site?

Accepted Answer

The cookie is not sent on that initial navigation

Answer

The cookie is sent because it's a GET navigation

Answer

The cookie is permanently deleted from the browser

Answer

The cookie is sent only if `Secure` is also set

Question 15

What is required to set `SameSite=None` in modern browsers?

Accepted Answer

The cookie must also have the `Secure` flag

Answer

The cookie must be `HttpOnly`

Answer

The cookie must have an explicit `Domain`

Answer

The cookie must expire within 1 hour

Question 16

What parts make up a JWT?

Accepted Answer

Header, payload, and signature separated by dots

Answer

Username, password, and expiry separated by commas

Answer

Public key, private key, and payload

Answer

Only an AES-encrypted payload

Question 17

Is it safe to put sensitive data like a card number in the payload of a signed JWT?

Accepted Answer

No, the payload is only base64url-encoded and readable by anyone

Answer

Yes, the signature encrypts the payload

Answer

Yes, if RS256 is used instead of HS256

Answer

Yes, because only the server can decode a JWT

Question 18

What does the `exp` claim in a JWT represent?

Accepted Answer

The token's expiration time as a Unix timestamp

Answer

The time the token was issued

Answer

The service that issued the token

Answer

The remaining lifetime in seconds

Question 19

A server reads the JWT with `jwt.decode()` only and trusts its `userId`. What's the problem?

Accepted Answer

The signature isn't verified, so anyone can forge a token

Answer

`decode` is slower than `verify`

Answer

`decode` only works in the browser

Answer

Nothing, JWTs are always encrypted

Question 20

What is the common way to send an access token to a REST API?

Accepted Answer

The header `Authorization: Bearer <token>`

Answer

A query string like `?token=<token>` on every request

Answer

In the body of every request, even GET

Answer

The header `X-Password: <token>`

Question 21

What was OAuth 2.0 primarily designed for?

Accepted Answer

Delegated authorization: granting an app limited access without sharing the password

Answer

Encrypting traffic between browser and server

Answer

Securely hashing user passwords

Answer

Fully replacing HTTPS

Question 22

In OAuth 2.0, which role issues access tokens?

Accepted Answer

Authorization Server

Answer

Resource Server

Answer

Client

Answer

Resource Owner

Question 23

What does OpenID Connect add on top of OAuth 2.0?

Accepted Answer

An authentication layer with an ID token describing the user's identity

Answer

End-to-end encryption for all APIs

Answer

Replacing access tokens with session cookies

Answer

Argon2 password hashing support

Question 24

What does a scope define in OAuth 2.0?

Accepted Answer

The extent of access the client requests, e.g. `read:email`

Answer

The access token's lifetime

Answer

The token's signing algorithm

Answer

The redirect URL after login

Question 25

Which combination truly counts as multi-factor authentication (MFA)?

Accepted Answer

Password + a TOTP code from an authenticator app on the phone

Answer

Password + a security question answer

Answer

Two different passwords

Answer

Password + PIN

Question 26

How is a TOTP code in apps like Google Authenticator generated?

Accepted Answer

From an HMAC of a shared secret and the current time (usually 30-second steps)

Answer

The server pushes the code to the app via SMS every 30 seconds

Answer

Purely at random with no relation to the server

Answer

From the user's password hash and phone number

Question 27

What does an API key typically identify?

Accepted Answer

The calling application or project, not necessarily an end user

Answer

The end user with all their roles and permissions

Answer

The user's browser

Answer

The destination server's IP address

Question 28

What does the principle of least privilege mean?

Accepted Answer

Each user or service gets only the minimum access needed for its job

Answer

As few users as possible should access the system

Answer

Admins get all permissions to reduce errors

Answer

Permissions are restricted only in production

Question 29

In RBAC, what are permissions assigned to?

Accepted Answer

To roles, and users are assigned to roles

Answer

Directly to user IP addresses

Answer

To each database row individually

Answer

To the user's session ID

Question 30

What is the best way to prevent SQL injection?

Accepted Answer

Using parameterized queries or prepared statements

Answer

Stripping the `'` character from user input

Answer

Limiting input length to 20 characters

Answer

Base64-encoding input before putting it in the query

Question 31

In `"SELECT * FROM users WHERE name = '" + name + "'"`, what does the input `' OR '1'='1` do?

Accepted Answer

The condition becomes always true and all users are returned

Answer

It causes a syntax error with no effect

Answer

It finds only a user named `OR`

Answer

It drops the users table

Question 32

What is an XSS (Cross-Site Scripting) attack?

Accepted Answer

Injecting malicious script that runs in other users' browsers in the site's context

Answer

Sending forged requests from another site with the user's cookie

Answer

Injecting SQL into form inputs

Answer

Forcing the server to request internal addresses

Question 33

What's the difference between stored and reflected XSS?

Accepted Answer

Stored is saved in the DB and shown to everyone; reflected echoes from the current request (e.g. URL)

Answer

Stored lives only in cookies, reflected only in localStorage

Answer

Reflected is more dangerous because no click is needed

Answer

Stored runs only on the server, reflected only on the client

Question 34

To safely display a user's name inside HTML, what should you do?

Accepted Answer

HTML-escape characters like `<`, `>`, `&`, and `"` on output

Answer

Insert it directly with `innerHTML`

Answer

Base64-encode the name before storing it

Answer

Only validate the name's length in the frontend

Question 35

What browser behavior does a CSRF attack exploit?

Accepted Answer

Automatically attaching cookies to cross-site requests to the target site

Answer

Executing injected scripts in the page

Answer

Saving passwords in browser autofill

Answer

Caching of HTTP responses

Question 36

Why does a CSRF token prevent CSRF attacks?

Accepted Answer

The attacker's site can't read the random token value to include it in the request

Answer

The token stops the cookie from being sent

Answer

The token encrypts the user's password

Answer

The token blocks GET requests only

Question 37

A user changes `/api/orders/1001` to `/api/orders/1002` and sees someone else's order. What vulnerability is this?

Accepted Answer

IDOR / Broken Object Level Authorization

Answer

SQL injection

Answer

Cross-Site Request Forgery

Answer

Open redirect

Question 38

What does HTTPS (TLS) provide?

Accepted Answer

Confidentiality, integrity in transit, and server authentication

Answer

Protection against XSS and SQL injection

Answer

Encryption of data in the server's database

Answer

A guarantee that the server has no security bugs

Question 39

What does the `Strict-Transport-Security` header do?

Accepted Answer

Tells the browser to use only HTTPS for the site for a set period

Answer

Makes all cookies `HttpOnly`

Answer

Prevents the site from loading in an iframe

Answer

Blocks inline scripts

Question 40

Why should a login endpoint be rate limited?

Accepted Answer

To slow down brute-force and credential stuffing attacks

Answer

To reduce database size

Answer

To prevent XSS in the login form

Answer

Because HTTPS doesn't work without rate limits

Question 41

What is credential stuffing?

Accepted Answer

Trying username/password pairs leaked from other sites

Answer

Guessing every possible password combination for one user

Answer

Injecting credentials into a database query

Answer

Storing passwords in cookies

Question 42

Which login error message prevents account enumeration?

Accepted Answer

'Invalid username or password'

Answer

'No user exists with this email'

Answer

'Wrong password for this user'

Answer

'This account is locked'

Question 43

Where should you NOT keep API keys and database passwords?

Accepted Answer

In source code committed to Git

Answer

In server environment variables

Answer

In a secrets manager like Vault

Answer

In the CI/CD service's secret store

Question 44

What's the difference between symmetric and asymmetric encryption?

Accepted Answer

Symmetric uses one shared key; asymmetric uses a public/private key pair

Answer

Symmetric is only for hashing, asymmetric for encoding

Answer

Asymmetric is always faster than symmetric

Answer

Symmetric is irreversible, asymmetric is reversible

Question 45

What does encryption at rest protect against, compared to encryption in transit?

Accepted Answer

Stored data on disks or backups if the media is stolen

Answer

Eavesdropping on client-server traffic

Answer

XSS attacks in the browser

Answer

SQL injection in queries

Question 46

What vulnerability does `exec('ping ' + req.query.host)` in Node.js have?

Accepted Answer

Command injection; input like `8.8.8.8; rm -rf /` runs extra commands

Answer

XSS because ping output is shown on the page

Answer

CSRF because it uses a query string

Answer

None, since ping is a harmless command

Question 47

The request `/download?file=../../etc/passwd` is an example of which attack?

Accepted Answer

Path traversal

Answer

SSRF

Answer

Open redirect

Answer

Clickjacking

Question 48

`/login?next=https://evil.com` redirects users anywhere after login. What's the main risk?

Accepted Answer

Phishing that abuses your domain's trust, and token leakage in OAuth flows

Answer

SQL injection via the `next` parameter

Answer

Increased server CPU usage

Answer

Breaking `HttpOnly` cookies

Question 49

Why isn't frontend-only validation enough?

Accepted Answer

Attackers can call the API directly with curl or Postman

Answer

Browsers randomly ignore validation

Answer

Frontend validation causes XSS

Answer

Because HTTPS modifies form data

Question 50

What does `npm audit` do?

Accepted Answer

Checks dependencies against a database of known vulnerabilities

Answer

Scans your code for logic bugs

Answer

Upgrades all packages to the latest major version

Answer

Optimizes package install speed