Skip to content
AI Security
Practice tests · 46 items

Identity, OAuth & Access Control practice test

Authentication and sessions, phishing-resistant MFA, RBAC, ABAC and relationship-based authorization, OAuth 2 and OpenID Connect with their pitfalls, JWT validation, workload identity, secrets, and delegating a user's authority to an AI agent without creating a confused deputy. The pool for this topic holds 10 easy, 25 medium and 11 hard items. Each answer comes with its reasoning and a link to the question or concept page it was drawn from.

Configure a test
Topic
Difficulty
Questions
10 in this pool · about 7 min
Reveal answers
Sign in to startFree account required · retakes favour new items

Sample items with answers

easy · sample
Which question does authorization answer?
Who is this caller, and which credential did they present when they connected?
✓May this principal perform this action on this specific resource?
Which device and network location is this request coming from right now?
How many requests has this user sent in the last minute, across all services?

Authentication establishes who the caller is. Authorization decides what that caller may do with a particular object, every time. Most access-control bugs are authorization failures on correctly authenticated users.

easy · sample
A mobile app hides the 'delete project' button from non-owners, but the API endpoint has no ownership check. What is the flaw?
✓Authorization enforced only in the client, which the attacker controls
Weak authentication, because the mobile app should require a second factor on every login
Missing encryption, because the delete request travels without TLS between app and server
Missing rate limiting, because deletes should be limited to a few requests each minute

Any authenticated user can call the API directly with a tool like curl. Hiding UI elements is cosmetic. The API must check that the caller owns the project before deleting it.

After the test

Choosing from options is easier than reasoning it out in front of a panel. These pages make you reason it out: