Unit 4: Authentication and Database Integration - Practice Quiz

1 What is the main purpose of authentication in a web application?

2 Which credential is commonly used with a username during authentication?

3 What does a session commonly store after a user logs in?

4 What usually happens to a user's session when they log out?

5 What is a protected route?

6 Where is an unauthenticated user commonly sent when opening a protected route?

7 What does authorization determine?

8 Which check is an example of authorization?

9 In role-based access control, permissions are primarily assigned to what?

10 Which role would commonly have permission to manage all user accounts?

11 What does ORM stand for?

12 What does an ORM help developers do?

13 What is required for an application to connect to a database?

14 Which value is commonly included in database connection settings?

15 What does the letter C represent in CRUD?

16 Which CRUD operation changes an existing database record?

17 Which CRUD operation retrieves stored data?

18 Why is user input validated before it is stored?

19 Which is a basic validation rule for a required email field?

20 Why are environment variables commonly used in web applications?

21 A web application stores user passwords for login verification. Which approach provides the best protection if the database is exposed?

22 Why should a server regenerate a session identifier after a user successfully logs in?

23 A session cookie should not be accessible through client-side JavaScript because of which cookie attribute?

24 An application must ensure that a session cookie is sent only over HTTPS connections. Which cookie setting addresses this requirement?

25 What is the primary purpose of an idle session timeout?

26 A request to /dashboard is received without a valid authenticated session. What should protected-route middleware typically do?

27 A frontend hides an administrator link, but the corresponding API endpoint has no server-side authentication check. What is the main security problem?

28 A logged-in user requests another user's private profile by changing the user ID in the URL. Which authorization check is needed?

29 Which response status is most appropriate when a user is authenticated but lacks permission to delete a resource?

30 In a role-based access control system, a user has the role editor, which permits updating articles but not deleting them. What should happen when the user sends a delete request?

31 What is a key advantage of assigning permissions to roles instead of configuring permissions separately for every user?

32 In an ORM, a User class is mapped to a database table. What does an instance of the class usually represent?

33 What is the main purpose of an ORM migration?

34 An application is deployed to production and fails because it cannot connect to the database. Which configuration should be checked first?

35 Why should a web application use a connection pool for frequent database access?

36 Which operation best represents updating a user's email address in a database?

37 A user submits a form to create a new blog post. Which practice best reduces SQL injection risk when inserting the data?

38 A registration endpoint receives an email field that contains an empty string. What is the best validation behavior?

39 Why should validation be performed on the server even when the frontend already validates the form?

40 Which value is most appropriate to store in an environment variable rather than directly in source code?

41 A web application stores passwords using a fast hash function with a unique salt per user. An attacker obtains the password table and can evaluate billions of hashes per second. Which change most directly improves resistance to offline cracking?

42 A login endpoint returns the same HTTP status, response body structure, and approximate timing for an unknown email and an incorrect password. What security property is this design primarily intended to provide?

43 A user logs in successfully, but the server keeps the anonymous session identifier and merely adds an authenticated flag. Which remediation is most important?

44 A server-side session store uses a sliding idle timeout. Two requests from the same session arrive concurrently: one is valid at time , while the other was sent before the session expired but reaches the server afterward. Which design best prevents stale-request resurrection?

45 A single-page application hides an admin link for non-admin users, but its API endpoint only checks whether a request has a valid login session. What is the primary flaw?

46 A protected route checks authentication in middleware, then redirects unauthenticated users to a login page. An attacker supplies a URL containing an external destination as the return parameter. Which control is required?

47 An endpoint permits a user to fetch /orders/4821 after checking that the user is logged in, but it does not compare the order's owner ID with the requester. What vulnerability remains?

48 A document update service first verifies that a user may edit a document and then performs the update using only the document ID. The document can be moved between tenants by another process between these operations. Which solution best addresses the issue?

49 A user has both viewer and editor roles. The application denies access if any assigned role lacks permission, even when another role grants it. Which RBAC evaluation model is usually intended instead?

50 An administrator changes a user's role from admin to support, but existing access tokens contain the old role claim and remain valid for one hour. Which mitigation most directly limits stale privilege?

51 An ORM loads 1,000 posts and lazily fetches each author's record while rendering them. The database receives one query for posts and 1,000 author queries. What is the most appropriate correction when all authors are needed?

52 An ORM model accepts a request body containing email, displayName, and isAdmin, and uses a generic update method. A client changes isAdmin despite lacking permission. Which ORM-level control is most relevant?

53 A production service opens a new database connection for every request and occasionally exhausts the database connection limit under load. Which architecture is most appropriate?

54 A database transaction updates an inventory row, but a second transaction can read the intermediate value before the first transaction commits. Which database property is missing or inadequately configured?

55 An API implements PUT /users/7 by updating only fields present in the request and leaving all other fields unchanged. A client omits a field expecting it to be cleared. Which design correction is most accurate?

56 Two clients read a product with version 12. Both submit updates, and the second update silently overwrites the first. Which implementation provides optimistic concurrency control?

57 A registration validator checks that an email has a valid format, but the database later rejects it because the email column is unique. Which validation strategy is correct?

58 A server validates a request's JSON structure but accepts a string such as "999999999999999999999" for an integer amount, allowing inconsistent coercion across services. What is the strongest fix?

59 A deployment reads DATABASE_URL successfully, but a secret containing a dollar sign and spaces is truncated or altered by the shell. Which practice best prevents this configuration error?

60 An application falls back to a development signing key when AUTH_SECRET is missing. In production, a deployment typo therefore starts successfully but issues forgeable tokens. Which design is safest?