Skip to content
Sharp

Authentication interview questions

JSON Web Tokens (JWT), JWT Signatures, Plaintext Passwords, Salting and BCrypt

81 questions with answers and explanations · 81 flashcards

Take a free Authentication testAll Java Interview Prep topics

Questions (page 1 of 2)

  1. What role does the header play in a JWT token?Multiple choiceMedium
  2. In the context of JWT, what is the primary purpose of the signature?Multiple choiceEasy
  3. How can a Java developer verify the signature of a JWT using HMAC SHA-256?Multiple choiceMedium
  4. How would you explain a significant consequence of using stateless JWT tokens for authentication in an interview?Multiple choiceHard
  5. Which statement about JWT payloads is correct?Multiple choiceEasy
  6. Which statement best describes the use of CSRF tokens in web applications?Multiple choiceHard
  7. Why is using BCrypt preferable over a fast hashing algorithm like SHA-256 for password hashing?Multiple choiceEasy
  8. Which aspect of JWT usage can lead to vulnerabilities if not properly managed?Multiple choiceHard
  9. In the context of Spring Security, why is it important to add a CSRF token to forms?Multiple choiceMedium
  10. Which part of a JWT is responsible for ensuring data integrity and preventing tampering?Multiple choiceMedium
  11. Which token-lifecycle design best limits damage if an access token is stolen?Multiple choiceMedium
  12. Which element in a JWT contains the algorithm details used for signing?Multiple choiceEasy
  13. Why do teams use JWTs over traditional session-based authentication in production code?Multiple choiceMedium
  14. Which OWASP Top 10 vulnerability is addressed by using parameterized queries?Multiple choiceEasy
  15. How does a server verify the integrity of a JWT when using HMAC SHA-256?Multiple choiceHard
  16. Which OWASP vulnerability does using HTML encoding help mitigate?Multiple choiceMedium
  17. How would you explain a significant risk of storing a JWT in localStorage in a browser context in an interview?Multiple choiceHard
  18. Which strategy is best for storing JWT secrets securely in a Spring Boot application?Multiple choiceHard
  19. Why is using a fast hashing algorithm like MD5 considered insecure for storing passwords?Multiple choiceEasy
  20. Why does a CSRF token matter in practice?Multiple choiceEasy
  21. In the context of JWTs, which of the following statements is true about the Signature part?Multiple choiceEasy
  22. What role does the Header play in a JWT?Multiple choiceEasy
  23. Which part of a JWT is used to verify its integrity?Multiple choiceMedium
  24. How would you explain a potential risk of using JWT tokens without proper expiration management in an interview?Multiple choiceHard
  25. When implementing stateless authentication using JWTs, how can a server manage user logout effectively?Multiple choiceHard
  26. What are the three parts of a JSON Web Token (JWT)?Multiple choiceEasy
  27. Which Java library is commonly used to create and verify JWTs in Spring applications?Multiple choiceMedium
  28. Which component in the JWT Header specifies the algorithm used to sign the token?Multiple choiceEasy
  29. Why is using fast hashing algorithms like MD5 for passwords a security problem?Multiple choiceMedium
  30. Why does adding a 'salt' to a password before hashing help in practice?Multiple choiceMedium
  31. Why is it important to store passwords using hash functions instead of plaintext?Multiple choiceEasy
  32. In a JWT, why should the secret key used for signing be kept secure?Multiple choiceMedium
  33. Why does a Signature in a JWT matter in practice?Multiple choiceMedium
  34. Why is it useful to adding a salt to a password before hashing it?Multiple choiceMedium
  35. In Spring Security, what is the role of the filter chain?Multiple choiceMedium
  36. How does BCrypt help mitigate the risk of brute-force attacks on passwords?Multiple choiceHard
  37. How can HTML encoding help prevent stored XSS attacks in a Java web application?Multiple choiceHard
  38. Why is it beneficial to use stateless JWTs instead of stateful sessions in a microservices architecture?Multiple choiceEasy
  39. Why is a 30-day access token usually a security risk?Multiple choiceMedium
  40. Why does a PreparedStatement in preventing SQL Injection attacks matter in this design?Multiple choiceMedium
  41. Why are prepared statements recommended for database interactions in Java?Multiple choiceMedium
  42. In a JWT, which part contains the information about the user's roles and permissions?Multiple choiceMedium
  43. Which of the following is a potential consequence of storing passwords in plaintext?Multiple choiceHard
  44. In the context of JWT, what role does the Payload play?Multiple choiceEasy
  45. How would you explain a common method to prevent Cross-Site Request Forgery (CSRF) attacks in web applications in an interview?Multiple choiceEasy
  46. How does the 'Work Factor' in BCrypt protect against brute-force attacks?Multiple choiceMedium
  47. Why is HTML encoding important for preventing stored XSS attacks?Multiple choiceMedium
  48. In the context of Spring Security, what is the primary role of the 'AuthenticationManager'?Multiple choiceHard
  49. Why is it important for a JWT to have a short expiration time?Multiple choiceMedium
  50. In Spring Security, what is the primary function of the filter chain?Multiple choiceHard