Authentication vs authorization in HLD - Practice Questions

Challenge - 5 Problems

🧠 Conceptual

intermediate

Difference between Authentication and Authorization

Which statement correctly describes the difference between authentication and authorization?

A Authentication determines what you can do; authorization verifies who you are.

B Authentication verifies who you are; authorization determines what you can do.

C Authentication and authorization both verify user identity.

D Authorization is done before authentication in a secure system.

💡 Hint

Think about logging in versus accessing resources.

Authentication confirms user identity, while authorization controls access rights.

❓ Architecture

intermediate

Component responsible for Authorization in a Web System

In a typical web application architecture, which component is primarily responsible for authorization decisions?

A Authentication server

B User interface

C Resource server or API gateway

D Database server

💡 Hint

Authorization controls access to resources after identity is confirmed.

The resource server or API gateway checks permissions before allowing access to resources.

❓ scaling

advanced

Scaling Authentication in a Large Distributed System

Which approach best supports scaling authentication in a large distributed system with many users?

A Distributed authentication with stateless tokens like JWTs validated locally

B Storing user credentials on each client device for offline authentication

C Centralized authentication server handling all requests synchronously

D Using a single database for all user credentials without caching

💡 Hint

Consider reducing bottlenecks and network calls.

Stateless tokens allow local validation without contacting a central server for each request, improving scalability.

❓ tradeoff

advanced

Tradeoff Between Authentication Strength and User Experience

What is a common tradeoff when increasing authentication strength in a system?

A Authentication strength does not affect system performance or user experience

B Stronger authentication always improves user experience without drawbacks

C Weaker authentication improves security but reduces user convenience

D Stronger authentication can reduce user convenience but improves security

💡 Hint

Think about multi-factor authentication and user effort.

Adding steps like multi-factor authentication increases security but may make login slower or harder for users.

❓ estimation

expert

Estimating Load on Authorization Service

A system has 1 million active users. Each user makes 10 resource requests per minute. If each request requires an authorization check, estimate the number of authorization checks per second the system must handle.

A Approximately 166,667 authorization checks per second

B Approximately 10,000 authorization checks per second

C Approximately 600,000 authorization checks per second

D Approximately 1,000,000 authorization checks per second

💡 Hint

Calculate total requests per minute, then convert to per second.

1,000,000 users * 10 requests = 10,000,000 requests per minute. Divide by 60 seconds = 166,666.67 checks per second.