Skip to content
Sharp

Authentication interview questions

JSON Web Tokens (JWT), JWT Signatures, Plaintext Passwords, Salting and BCrypt

81 questions with answers and explanations · 81 flashcards

Take a free Authentication testAll Java Interview Prep topics

Questions (page 2 of 2)

  1. In a stateless JWT authentication system, how can you effectively revoke a token?Multiple choiceHard
  2. Which OWASP vulnerability does using prepared statements help mitigate?Multiple choiceMedium
  3. Why is it important to understand that JWT Payloads are not encrypted?Multiple choiceMedium
  4. Why does a CSRF token in web applications matter in practice?Multiple choiceEasy
  5. How would you explain a potential risk of using a long-lived JWT without refresh tokens in an interview?Multiple choiceHard
  6. Which of the following is a benefit of using BCrypt for password hashing?Multiple choiceMedium
  7. Which part of a JWT token can be used to verify the integrity and authenticity of the token?Multiple choiceMedium
  8. Which component of the Spring Security filter chain is directly responsible for processing JWTs?Multiple choiceMedium
  9. How does a prepared statement enhance security in database interactions?Multiple choiceMedium
  10. When preventing SQL injection attacks in Java, why is using 'PreparedStatement' preferred over plain 'Statement'?Multiple choiceHard
  11. How does HTML encoding help prevent stored XSS (Cross-Site Scripting) attacks?Multiple choiceMedium
  12. How does the concept of a 'bcrypt work factor' contribute to password security?Multiple choiceMedium
  13. Why does a signature in a JWT token matter in this design?Multiple choiceEasy
  14. How can a developer prevent stored XSS in user-generated content?Multiple choiceMedium
  15. How would you explain a significant advantage of using stateless JWT tokens over traditional session-based authentication in an interview?Multiple choiceHard
  16. Why should passwords never be stored in plaintext in a database?Multiple choiceEasy
  17. How does appending a unique random 'Salt' to passwords enhance security?Multiple choiceMedium
  18. Why do teams use JWTs over traditional JSESSIONID cookies in a distributed system in production code?Multiple choiceEasy
  19. When using BCrypt to hash passwords, why should you consider increasing the work factor over time?Multiple choiceMedium
  20. Why do teams use BCrypt for hashing passwords in a Java application in production code?Multiple choiceEasy
  21. Why does signing-key rotation matter even if tokens validate correctly today?Multiple choiceHard
  22. How can you mitigate replay attacks when using JWTs in an e-commerce application?Multiple choiceHard
  23. What does the 'exp' claim in a JWT represent?Multiple choiceEasy
  24. Which of the following best describes the 'Work Factor' in BCrypt?Multiple choiceMedium
  25. In Spring Security, where would you typically configure the JWT Filter in the Security Filter Chain?Multiple choiceMedium
  26. Why does a JWT ecosystem need the kid header during key rotation?Multiple choiceMedium
  27. In the context of stateless JWT tokens, what is the role of the signature?Multiple choiceMedium
  28. How does HTML encoding help prevent stored XSS attacks?Multiple choiceMedium
  29. How does a server verify the authenticity of a JWT without a database lookup?Multiple choiceMedium
  30. How can a developer mitigate the risk of JWT replay attacks?Multiple choiceHard
  31. How would you explain a common strategy to mitigate CSRF attacks in a Java web application using JWTs in an interview?Multiple choiceHard