Authorization testing in Testing Fundamentals - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Authorization vs Authentication

Which statement best describes the difference between authorization and authentication?

A Authentication and authorization are the same and used interchangeably.

B Authentication verifies who you are; authorization determines what you can access.

C Authorization verifies who you are; authentication determines what you can access.

D Authorization is done before authentication in the login process.

💡 Hint

Think about logging in first, then checking permissions.

Authentication confirms your identity, like entering a password. Authorization checks your rights to access resources after you are identified.

❓ Predict Output

intermediate

Result of Role-Based Access Check

What will be the output of the following Python code simulating a simple authorization check?

Testing Fundamentals

user_role = 'editor'
resource = 'article'

permissions = {
    'admin': ['article', 'comment', 'user'],
    'editor': ['article', 'comment'],
    'viewer': ['article']
}

if resource in permissions.get(user_role, []):
    print('Access granted')
else:
    print('Access denied')

A Access granted

B KeyError

C Access denied

D TypeError

💡 Hint

Check if 'article' is in the list for 'editor' role.

The 'editor' role has permission for 'article', so the condition is true and 'Access granted' is printed.

❓ assertion

advanced

Validating Authorization Failure in Test Assertion

Which assertion correctly tests that a user without 'admin' role cannot delete a user account?

Testing Fundamentals

def can_delete_user(user_role):
    return user_role == 'admin'

user_role = 'viewer'
result = can_delete_user(user_role)

A assert result is False

B assert result == True

C assert result != False

D assert result == None

💡 Hint

The function returns True only for 'admin'. For 'viewer', it returns False.

The assertion must confirm the function returns False for a non-admin role, so 'assert result is False' is correct.

🔧 Debug

advanced

Identify the Bug in Authorization Logic

What is the bug in this JavaScript authorization check code?

Testing Fundamentals

function checkAccess(role) {
  if (role == 'admin') {
    return true;
  } else {
    return false;
  }
}

console.log(checkAccess('viewer'));

A The role variable is not declared.

B The function does not return any value.

C The assignment operator '=' is used instead of comparison '=='.

D The console.log statement is missing parentheses.

💡 Hint

Check the condition inside the if statement carefully.

The code uses '=' which assigns 'admin' to role instead of comparing it. This causes the condition to always be true.

❓ framework

expert

Best Practice for Authorization Testing in Automation Framework

In an automated test framework, which approach best ensures authorization rules are tested effectively?

A Test only happy paths where users have full access to resources.

B Test authorization only after deployment to production.

C Skip authorization tests and rely on manual testing for security.

D Use parameterized tests to check multiple roles against resource access permissions.

💡 Hint

Think about covering different user roles and permissions efficiently.

Parameterized tests allow running the same test logic with different roles and resources, ensuring broad coverage of authorization rules.