Authentication vs authorization in HLD - Practice Questions

Challenge - 5 Problems

🧠 Conceptual

intermediate

Difference between Authentication and Authorization

Which statement correctly describes the difference between authentication and authorization?

A Authentication determines what you can do; authorization verifies who you are.

B Authentication verifies who you are; authorization determines what you can do.

C Authentication and authorization both verify user identity.

D Authorization is done before authentication in a secure system.

💡 Hint

Think about logging in versus accessing resources.

Authentication confirms user identity, while authorization controls access rights.

❓ Architecture

intermediate

Component responsible for Authorization in a Web System

In a typical web application architecture, which component is primarily responsible for authorization decisions?

A Authentication server

B User interface

C Resource server or API gateway

D Database server

💡 Hint

Authorization controls access to resources after identity is confirmed.

The resource server or API gateway checks permissions before allowing access to resources.

❓ scaling

advanced

Scaling Authentication in a Large Distributed System

Which approach best supports scaling authentication in a large distributed system with many users?

A Distributed authentication with stateless tokens like JWTs validated locally

B Storing user credentials on each client device for offline authentication

C Centralized authentication server handling all requests synchronously

D Using a single database for all user credentials without caching

💡 Hint

Consider reducing bottlenecks and network calls.

Stateless tokens allow local validation without contacting a central server for each request, improving scalability.

❓ tradeoff

advanced

Tradeoff Between Authentication Strength and User Experience

What is a common tradeoff when increasing authentication strength in a system?

A Authentication strength does not affect system performance or user experience

B Stronger authentication always improves user experience without drawbacks

C Weaker authentication improves security but reduces user convenience

D Stronger authentication can reduce user convenience but improves security

💡 Hint

Think about multi-factor authentication and user effort.

Adding steps like multi-factor authentication increases security but may make login slower or harder for users.

❓ estimation

expert

Estimating Load on Authorization Service

A system has 1 million active users. Each user makes 10 resource requests per minute. If each request requires an authorization check, estimate the number of authorization checks per second the system must handle.

A Approximately 166,667 authorization checks per second

B Approximately 10,000 authorization checks per second

C Approximately 600,000 authorization checks per second

D Approximately 1,000,000 authorization checks per second

💡 Hint

Calculate total requests per minute, then convert to per second.

1,000,000 users * 10 requests = 10,000,000 requests per minute. Divide by 60 seconds = 166,666.67 checks per second.

Practice

1. Which of the following best describes authentication in system design?

easy

A. Encrypting user data

B. Granting access to resources

C. Logging user activities

D. Verifying the identity of a user

Solution

1. Step 1: Understand authentication purpose

   Authentication is the process of confirming who the user is by checking credentials like username and password.

2. Step 2: Differentiate from authorization

   Authorization controls what the user can do after identity is confirmed, not the identity check itself.

3. Final Answer:

   Verifying the identity of a user -> Option D

4. Quick Check:

   Authentication = Verifying identity [OK]

Hint: Authentication = Who you are, Authorization = What you can do [OK]

Common Mistakes:

• Confusing authentication with authorization
• Thinking authentication controls permissions
• Mixing identity verification with data encryption

2. Which of the following is a correct example of an authorization check in code?

easy

A. if user.password == input_password:

B. if user.session_token is not None:

C. if user.role == 'admin':

D. if user.email_verified:

Solution

1. Step 1: Identify authorization logic

   Authorization checks what actions a user can perform, often by checking roles or permissions like user.role == 'admin'.

2. Step 2: Differentiate from authentication checks

   Authentication checks credentials like passwords or tokens, not roles.

3. Final Answer:

   if user.role == 'admin': -> Option C

4. Quick Check:

   Authorization checks roles/permissions [OK]

Hint: Authorization checks roles or permissions, not passwords [OK]

Common Mistakes:

• Using password checks as authorization
• Confusing session token presence with authorization
• Checking email verification as authorization

3. Consider this code snippet:

def access_resource(user):
    if not user.is_authenticated:
        return "Access Denied"
    if user.permission != 'read':
        return "Permission Denied"
    return "Resource Content"

What will be the output if user.is_authenticated is True but user.permission is 'write'?

medium

A. "Permission Denied"

B. "Resource Content"

C. "Access Denied"

D. Error due to missing permission

Solution

1. Step 1: Check authentication condition

   The user is authenticated (True), so the first if condition fails and does not return "Access Denied".

2. Step 2: Check authorization condition

   The user's permission is 'write', which is not equal to 'read', so the second if returns "Permission Denied".

3. Final Answer:

   "Permission Denied" -> Option A

4. Quick Check:

   Authenticated but wrong permission = Permission Denied [OK]

Hint: Authenticated? Check permission next for authorization [OK]

Common Mistakes:

• Ignoring permission check and returning resource
• Confusing authentication failure with permission failure
• Assuming 'write' permission equals 'read'

4. A developer wrote this code to check access:

if user.is_authorized:
    print("Access granted")
else:
    print("Access denied")

But the system always denies access even for valid users. What is the likely issue?

medium

A. The variable is_authorized is misspelled

B. The code checks authorization without authenticating the user first

C. The print statements are reversed

D. The user object is not defined

Solution

1. Step 1: Analyze authentication and authorization order

   Authorization should only be checked after confirming the user is authenticated. Skipping authentication can cause authorization to fail.

2. Step 2: Understand why access is always denied

   If is_authorized depends on authentication, but authentication is missing, it will always be false or unset, denying access.

3. Final Answer:

   The code checks authorization without authenticating the user first -> Option B

4. Quick Check:

   Authenticate before authorizing [OK]

Hint: Always authenticate before authorization checks [OK]

Common Mistakes:

• Checking authorization without authentication
• Assuming authorization implies authentication
• Ignoring user object initialization

5. In designing a secure web service, which approach correctly applies authentication and authorization to protect user data?

hard

A. Authenticate users with passwords, then authorize access based on roles before serving data

B. Authorize users first, then authenticate them before data access

C. Allow data access after authentication without any authorization checks

D. Skip authentication if the user has a valid session token

Solution

1. Step 1: Understand correct security flow

   First, confirm user identity by authentication (e.g., passwords). Then, check what the user is allowed to do by authorization (e.g., roles).

2. Step 2: Evaluate options for security best practice

   Authenticate users with passwords, then authorize access based on roles before serving data follows the correct order: authenticate then authorize. Other options either reverse order, skip authorization, or skip authentication improperly.

3. Final Answer:

   Authenticate users with passwords, then authorize access based on roles before serving data -> Option A

4. Quick Check:

   Authenticate first, then authorize [OK]

Hint: Authenticate identity first, then authorize actions [OK]

Common Mistakes:

• Reversing authentication and authorization order
• Skipping authorization after authentication
• Trusting session tokens without authentication