Multiple Choice Questions on Authentication and Authorization

📚 Quick Study Guide on Authentication & Authorization

• ➡️ Authentication: The process of verifying the identity of a user, system, or entity. It answers the question, "Are you who you say you are?" Common methods include passwords, biometrics, and multi-factor authentication.
• 🛡️ Authorization: The process of determining what an authenticated user is permitted to do. It answers the question, "What are you allowed to do?" This involves granting or denying access to specific resources or functions.
• 🔗 Relationship: Authentication *always* precedes authorization. You must prove who you are before the system can decide what you can access.
• 🔑 Credentials: Information used to verify identity (e.g., username/password, token, certificate).
• ✅ Access Control: Mechanisms used to enforce authorization policies (e.g., Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC)).
• 🚨 Common Attacks: Brute-force, phishing (targeting authentication); privilege escalation, broken access control (targeting authorization).
• 💡 Key Difference: Think of authentication as showing your ID to enter a building, and authorization as showing your special pass to access specific rooms inside.

📝 Practice Quiz: Authentication & Authorization

1. Which of the following best describes Authentication?
   A) Deciding what resources a user can access.
   B) Verifying the identity of a user.
   C) Encrypting data during transmission.
   D) Logging user activity for auditing.
2. What is the primary purpose of Authorization?
   A) To confirm a user's login credentials.
   B) To grant or deny access to specific resources or actions.
   C) To secure network traffic from eavesdropping.
   D) To create unique user accounts.
3. In a typical security flow, which process happens first?
   A) Authorization
   B) Logging
   C) Authentication
   D) Auditing
4. Which of these is an example of an authentication factor?
   A) File permissions
   B) Role-Based Access Control (RBAC)
   C) Biometrics (e.g., fingerprint scan)
   D) User group membership
5. A user tries to access a restricted file, but the system denies access because their assigned role doesn't have the necessary permissions. This is an example of a failure in:
   A) Authentication
   B) Non-repudiation
   C) Authorization
   D) Data integrity
6. Multi-Factor Authentication (MFA) enhances security primarily by strengthening:
   A) Authorization
   B) Data encryption
   C) Authentication
   D) Audit trails
7. If a system correctly identifies you as 'Alice' but then allows you to modify 'Admin' settings, this indicates a potential issue with:
   A) Data integrity
   B) Authentication
   C) Availability
   D) Authorization