Iam Fundamentals
What is the difference between authentication, authorization, and identification?
What are the core components of IAM?
What is the AAA (Authentication, Authorization, Accounting/Audit) framework in security?
What are the core objectives of Identity and Access Management (IAM)?
What is Identity and Access Management (IAM)?
Why is Identity and Access Management (IAM) essential in today's era?
What are the common authentication factors (something you know, something you have, something you are)?
What is a claim in the context of identity, and how does it relate to a principal or subject?
What is user provisioning and de-provisioning in Identity and Access Management?
What is the difference between authentication and identity management?
Security Principles
Explain the principle of least privilege. Why is it a foundational security concept?
Explain the deny by default principle in authorization.
Why should authorization logic never be enforced solely on the client side?
What is coarse-grained vs. fine-grained authorization? Provide examples.
What is separation of duties, and how does it complement the principle of least privilege?
What is defense in depth, and how does it apply to authentication and authorization?
What are the benefits and challenges of implementing the principle of least privilege in large organizations?
Can you explain the confused deputy problem in access control?
What does 'fail-secure' or 'fail-closed' mean for an access-control decision, and why is it preferred over failing open?
Access Control Models
Explain Role-Based Access Control (RBAC). What are its advantages and limitations, such as role explosion?
What is the difference between role-based access control (RBAC) and attribute-based access control (ABAC), and when would you use each?
How would you implement role-based access control (RBAC)?
What are the different types of access control models (RBAC, ABAC, ACLs, MAC, DAC)? Explain their core principles.
Explain the concept of claims-based authorization.
What is the difference between discretionary (DAC) and mandatory (MAC) access control?
Explain Attribute-Based Access Control (ABAC) and the roles of PDP, PEP, and PIP.
What is Relationship-Based Access Control (ReBAC), such as the Google Zanzibar model, and when is it useful?
What is externalized authorization with a policy engine (e.g., OPA/Rego), and what are its benefits?
How do you enforce object-level or row-level authorization and tenant isolation in a multi-tenant system?
Password Security
Why do we hash passwords instead of encrypting them for storage?
What is a password encoder and why is it mandatory?
Explain password hashing, salting, and peppering. Why are adaptive hashing algorithms like bcrypt, scrypt, and Argon2 preferred over fast hashes like MD5 or SHA-1 for passwords?
What is a work factor or cost factor in password hashing, and why is it important?
Which password encoder would you use and why?
What are the arguments for and against mandatory periodic password rotation policies?
What is password entropy, and how does it relate to password strength requirements?
What is breached-password (credential) checking, and why is it recommended over complex composition rules?
Why is a timing-safe comparison important when verifying secrets or tokens?
Jwt & Tokens
What is a JSON Web Token (JWT)? Describe its structure (header, payload, signature) and the purpose of each part.
What is the role of the payload in a JWT?
Why should you avoid putting sensitive data in a JWT payload?
How is JWT used for authentication and authorization?
Discuss the security implications and trade-offs of storing JWTs on the client side, such as in HTTP-only cookies vs. local storage.
What is the difference between an access token, refresh token, and ID token in the context of OAuth 2.0 and OpenID Connect?
What are the standard claims in a JWT (iss, sub, aud, exp, iat, nbf, jti) and what is the purpose of each?
Is a JWT encrypted or encoded? Explain the difference and its security implications.
Explain the concept of token introspection and when it would be used.
Explain the concept of token revocation and why it's important.
How do you handle token expiration in JWT?
How can you refresh a JWT token?
What are the challenges of JWT revocation, and what strategies are used to mitigate them?
What is the difference between symmetric and asymmetric signing algorithms in JWT?
What are the security implications of using JWT?
What is the difference between opaque tokens and self-contained (e.g., JWT) tokens, and when would you choose each?
What is token binding, and how does it help prevent token theft and replay?
What is the difference between JWS and JWE, and when would you need an encrypted JWT?
How does a JWKS endpoint and public-key rotation work for validating signed tokens?
Oauth & Openid Connect
What is the main difference between OAuth 2.0 (for authorization) and OpenID Connect (for authentication)?
What is user consent in OAuth, and what role does the consent screen play?
Explain OAuth 2.0. What problem does it solve, and what are its core roles (resource owner, client, authorization server, resource server)?
Explain OpenID Connect (OIDC). How does it build on OAuth 2.0, and what additional functionality does it provide (ID Token, UserInfo Endpoint)?
What are OAuth scopes, and how do they limit the permissions granted to applications?
What is the purpose of the state parameter in the OAuth authorization code flow?
Why is OAuth 2.0 often misused for authentication, and what problems does that cause?
What is machine-to-machine authentication, and how does the client-credentials flow support it?
What is the purpose of the nonce in OpenID Connect?
What is discovery in OpenID Connect, and how does the well-known configuration endpoint help clients?
Describe the Authorization Code flow with PKCE in OAuth 2.0. Why is PKCE important, especially for public clients?
Explain other OAuth 2.0 grant types such as Client Credentials, Device Code, Implicit, and Resource Owner Password Credentials, and discuss their use cases and why some are deprecated or discouraged.
What is the difference between the front channel and back channel in OAuth flows, and why does it matter for security?
What are the key changes introduced in OAuth 2.1 compared to OAuth 2.0?
What is OAuth token exchange, and when would you use it?
Explain the difference between delegation and impersonation, and how the on-behalf-of flow works.
Federated Identity & Sso
Explain the concept of Single Sign-On (SSO) and how protocols like SAML or OIDC facilitate it.
What's the difference between JWT, OAuth, and SAML?
Explain the conceptual flow of Kerberos authentication. What are its main components (KDC, AS, TGS)?
What is LDAP and how is it used as an identity store, particularly with Active Directory?
Explain how SAML assertions work and the roles of the Identity Provider and Service Provider.
What is the difference between a centralized identity provider and per-application authentication? What are the trade-offs?
What is social login, and what are the risks of relying on a third-party identity provider?
Compare SAML and OpenID Connect. Discuss their differences in data format, use cases, and when you would choose one over the other.
What is the difference between SP-initiated and IdP-initiated SSO?
What is federated identity, and how is trust established between organizations?
Multi Factor & Passwordless
Can you explain how OTP (One-Time Password) is used for verification in an authentication flow?
Explain Multi-Factor Authentication (MFA). What are its common types such as TOTP, push-based, and biometrics, and their trade-offs?
What are Passkeys / WebAuthn / FIDO2, and what problems do they solve compared to traditional password-based authentication?
What is MFA fatigue/bombing, and how can it be mitigated?
What is the difference between TOTP and HOTP one-time passwords?
Why is SMS-based OTP considered a weaker second factor, and what attacks target it?
How do magic-link and one-time-code passwordless flows work, and what are their trade-offs?
How does biometric authentication work as a factor, and what do false-accept and false-reject rates mean?
What is the role of recovery codes in MFA, and how should they be stored and handled?
What is step-up (adaptive) authentication, and when would you require it?
What does 'phishing-resistant authentication' mean, and why is WebAuthn considered phishing-resistant?
Session Management
Compare and contrast session-based authentication and token-based authentication such as JWT. Discuss their statefulness, scalability, and security trade-offs.
Explain session fixation and session hijacking attacks. What are common mitigations?
How can CSRF attacks impact authentication (against session cookies), and what are the primary defenses (SameSite cookies, anti-CSRF tokens)?
What are the Secure, HttpOnly, and SameSite attributes for cookies, and how do they enhance security for session management?
What is the difference between idle (inactivity) timeout and absolute session timeout, and why use both?
How does server-side session invalidation on logout work, and why is stateless logout harder?
Api & Service Authentication
Describe the use cases and limitations of API keys for authentication.
What is authentication in API design?
What is the difference between a 401 Unauthorized and a 403 Forbidden response?
Explain the API Gateway authentication pattern and its benefits.
What is the role of authentication and authorization middleware, and why is their order important?
Can you describe the process of authentication and authorization in Web APIs?
Explain the HTTP authentication schemes — Basic, Digest, and Bearer — and how the Authorization header is used with each.
What is the purpose of the WWW-Authenticate header and the 401 challenge in HTTP authentication?
Discuss common patterns for service-to-service authentication in a microservices architecture, such as mTLS and signed service tokens.
How do you implement authorization checks with JWT claims, especially in a microservices architecture?
How does certificate-based (mutual TLS) authentication work as an identity mechanism?
Should authorization be enforced at the API gateway or inside each service? Discuss the trade-offs.
How is a token propagated across services in a microservices call chain, and what are the risks?
Zero Trust Architecture
What is Zero Trust Architecture? Explain its core principles, such as 'never trust, always verify' and continuous verification.
How does Zero Trust differ from traditional perimeter-based security?
How is identity important in Zero Trust Architecture?
Explain the role of micro-segmentation in a Zero Trust model.
Authorization Vulnerabilities
What is Broken Authentication and what are common vulnerabilities that lead to it?
What is Broken Access Control? Why is it considered one of the most critical OWASP vulnerabilities?
Explain horizontal vs. vertical privilege escalation.
What is broken object-level authorization (BOLA) or Insecure Direct Object References (IDOR), and how do you prevent them?
Authentication Attacks & Defenses
What is the difference between a brute-force attack and a dictionary attack, and what are common prevention methods for each?
What are replay attacks in the context of authentication, and how can they be prevented (jti claim, short-lived tokens)?
What is token theft (e.g., via XSS) and how can it be mitigated, especially when using JWTs?
What is credential stuffing, and how does it differ from password spraying? How do you defend against each?
What defenses against brute-force login attempts do you know — rate limiting, account lockout, CAPTCHA — and their trade-offs?
What is account (username) enumeration, and how do timing and error-message differences leak it?
How do you design a secure password-reset and account-recovery flow?
What is an open-redirect vulnerability via the redirect_uri in OAuth, and how do you prevent it?
Jwt Attacks
How does a weak signing secret enable a JWT attack, and how do you protect against it?
Explain JWT-specific attacks such as 'alg:none' bypass and algorithm confusion (RS256 to HS256 downgrade). How are they mitigated?