---
id: 6a298d88d1606c0f1ef322a9
title: Authentication and Authorization Quiz
challengeType: 8
dashedName: quiz-authentication-and-authorization
---

# --description--

To pass the quiz, you must correctly answer at least 18 of the 20 questions below.

# --quizzes--

## --quiz--

### --question--

#### --text--

What are the three parts of a JSON Web Token?

#### --distractors--

Header, Body, and Footer

---

Token, Payload, and Hash

---

ID, Claims, and Certificate

#### --answer--

Header, Payload, and Signature

### --question--

#### --text--

Which of the following is an example of "something you have" as an authentication factor?

#### --distractors--

A fingerprint scan.

---

A password you memorized.

---

A security question answer.

#### --answer--

A one-time code sent to your smartphone.

### --question--

#### --text--

Which of the following best describes authorization?

#### --distractors--

Verifying that a user's credentials match the stored records.

---

Generating a session token after a user successfully logs in.

---

Encrypting a user's password before saving it to the database.

#### --answer--

Deciding what actions an authenticated user is allowed to take.

### --question--

#### --text--

What is a Passport.js Strategy?

#### --distractors--

A config file that maps application routes to authentication rules.

---

A built-in function that hashes and stores user passwords securely.

---

A token generated after a user successfully completes the login flow.

#### --answer--

A plugin that defines how to authenticate users with a specific method or provider.

### --question--

#### --text--

What does Helmet.js do to the X-Powered-By header by default?

#### --distractors--

It replaces the header with a generic placeholder value.

---

It encrypts the header value before sending it to the client.

---

It moves the header information into an HTTP-only cookie.

#### --answer--

It removes the X-Powered-By header entirely.

### --question--

#### --text--

What does setting a cookie `SameSite` attribute to `Strict` do?

#### --distractors--

It encrypts the cookie before storing it in the browser.

---

It ensures the cookie is only sent over HTTPS connections.

---

It blocks the server from setting more than one cookie per response.

#### --answer--

It prevents the browser from sending the cookie on any cross-site request.

### --question--

#### --text--

In a JWT, where is the user's claim data such as user ID or role stored?

#### --distractors--

In the Signature section.

---

In the Header section.

---

In an encrypted container outside the token.

#### --answer--

In the Payload section.

### --question--

#### --text--

Which HTTP header set by Helmet prevents your site from being embedded inside an iframe on another domain?

#### --distractors--

Content-Security-Policy

---

X-Powered-By

---

Strict-Transport-Security

#### --answer--

X-Frame-Options

### --question--

#### --text--

How does a CSRF attack exploit the browser?

#### --distractors--

It injects JavaScript into the victim's browser to directly steal cookies.

---

It intercepts traffic between the victim's browser and the trusted server.

---

It sends a phishing link that redirects the victim to a fake login page.

#### --answer--

It tricks the browser into sending a request that includes the victim's session cookie automatically.

### --question--

#### --text--

What does `app.use(passport.initialize())` do in an Express app?

#### --distractors--

It registers a new authentication Strategy with the application.

---

It creates a session cookie for every user who visits the app.

---

It automatically installs all available Passport strategies.

#### --answer--

It sets up Passport as middleware to handle authentication on each incoming request.

### --question--

#### --text--

Which role in a role-based authorization system typically has full access to system settings and user management?

#### --distractors--

Editor

---

Moderator

---

Standard User

#### --answer--

Admin

### --question--

#### --text--

Which command installs the Passport.js core package and the local strategy?

#### --distractors--

`npm install passport.js passport-local`

---

`npm install passport passport-auth`

---

`npm install passportjs local-strategy`

#### --answer--

`npm install passport passport-local`

### --question--

#### --text--

Why should you never store a password in a JWT payload?

#### --distractors--

The payload has a size limit that makes storing password-length strings impossible.

---

Storing a password in the payload automatically invalidates the token's signature.

---

JWT tokens expire too quickly to make passwords stored inside them useful.

#### --answer--

The payload is Base64 encoded, not encrypted, so anyone with the token can decode it.

### --question--

#### --text--

What is the purpose of a CSRF token?

#### --distractors--

To encrypt the user's session cookie before it is stored in the browser.

---

To verify the user's identity on every API request sent to the server.

---

To replace the session cookie with a short-lived authentication credential.

#### --answer--

To confirm that a request came from the legitimate frontend, which a malicious site cannot read.

### --question--

#### --text--

Which HTTP response header does Helmet set to defend against Cross-Site Scripting (XSS)?

#### --distractors--

X-Frame-Options

---

X-Powered-By

---

Strict-Transport-Security

#### --answer--

Content-Security-Policy

### --question--

#### --text--

When a user tries to access a protected resource, which process should happen first?

#### --distractors--

Authorization

---

Role assignment

---

Session creation

#### --answer--

Authentication

### --question--

#### --text--

What does Passport.js attach to the request object after a user successfully authenticates?

#### --distractors--

The active session token as `req.sessionToken`.

---

The strategy name used for login as `req.strategy`.

---

The user's hashed password as `req.credentials`.

#### --answer--

The authenticated user object as `req.user`.

### --question--

#### --text--

What happens when a server receives a JWT whose payload has been tampered with?

#### --distractors--

The server decodes the payload and updates the user record with the new data.

---

The server silently ignores the tampered data and uses the original token claims.

---

The server deletes the token and sends the user back to the registration page.

#### --answer--

The signature will not match and the server rejects the request.

### --question--

#### --text--

Compared to `SameSite=Strict`, what does `SameSite=Lax` allow?

#### --distractors--

It allows the cookie on all cross-site requests, including form submissions.

---

It blocks the cookie on all requests that originate from outside the same domain.

---

It requires the user to log in again on any cross-site navigation.

#### --answer--

It allows the cookie on top-level navigation but still blocks it on cross-site form submissions and API requests.

### --question--

#### --text--

What does the Strict-Transport-Security header enforce when set by Helmet?

#### --distractors--

It forces the server to reject all non-HTTPS requests with an error response.

---

It encrypts the entire HTTP response body before sending it to the browser.

---

It requires all cookies to have the Secure and HttpOnly flags set.

#### --answer--

It forces the browser to communicate with the server over HTTPS only.
