Security MCQs

Which of the following is true about Spring Security?

a) Provides authentication and authorization

b) Supports declarative security via annotations

c) Integrates with servlet filters

d) All of the above

View Answer

Correct answer: D — All of the above
In Spring Security, which annotation secures method calls?

a) @Secured

b) @Autowired

c) @Bean

d) @Controller

View Answer

Correct answer: A — @Secured

What will be printed?

1	import org.springframework.security.access.annotation.Secured;
2	class EduinqService {
3	@Secured("ROLE_ADMIN")
4	public void secure(){ System.out.println("Eduinq Secure Method"); }
5	}

a) Eduinq Secure Method (if ROLE_ADMIN)

b) Eduinq

c) Compilation error

d) Runtime exception

View Answer

Correct answer: A — Eduinq Secure Method (if ROLE_ADMIN)

Which of the following is true about JWT (JSON Web Token)?

a) Compact, URL safe token format

b) Contains header, payload, signature

c) Used for stateless authentication

d) All of the above

View Answer

Correct answer: D — All of the above
Which part of JWT ensures integrity?

a) Header

b) Payload

c) Signature

d) None

View Answer

Correct answer: C — Signature
Which of the following is true about OAuth2?

a) Provides authorization framework

b) Supports flows like Authorization Code, Client Credentials

c) Widely used for API security

d) All of the above

View Answer

Correct answer: D — All of the above
In OAuth2, which flow is used for server to server communication?

a) Authorization Code

b) Client Credentials

c) Implicit

d) Password

View Answer

Correct answer: B — Client Credentials
Which of the following is true about CSRF (Cross Site Request Forgery)?

a) Exploits authenticated sessions

b) Prevented via CSRF tokens

c) Common in web applications

d) All of the above

View Answer

Correct answer: D — All of the above
In Spring Security, CSRF protection is enabled by default for:

a) Stateless APIs

b) Form based login

c) WebFlux reactive apps

d) None

View Answer

Correct answer: B — Form based login
Which of the following is true about password hashing?

a) Use strong algorithms like bcrypt, scrypt, Argon2

b) Store plain text passwords

c) Hashing prevents reverse engineering easily

d) A and C

View Answer

Correct answer: D — A and C
Which of the following is true about common security pitfalls?

a) Hardcoding secrets in code

b) Using weak hashing algorithms like MD5

c) Not validating input

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about HTTPS?

a) Encrypts communication

b) Prevents man in the middle attacks

c) Uses TLS/SSL

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about Spring Security filters?

a) DelegatingFilterProxy integrates with servlet container

b) FilterChainProxy manages security filters

c) Filters execute in defined order

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about JWT expiration?

a) Defined in payload with exp claim

b) Prevents token reuse after expiry

c) Must be validated by server

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about OAuth2 scopes?

a) Define access boundaries

b) Included in access tokens

c) Control resource permissions

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about CSRF tokens?

a) Unique per session/request

b) Validated on server side

c) Prevent unauthorized requests

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about password salting?

a) Adds randomness to hashes

b) Prevents rainbow table attacks

c) Stored alongside hash

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about Spring Security @EnableWebSecurity?

a) Enables web security configuration

b) Used with @Configuration classes

c) Allows custom HttpSecurity setup

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about JWT signature algorithms?

a) HS256 uses shared secret

b) RS256 uses public/private keys

c) Algorithm defines security strength

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about OAuth2 refresh tokens?

a) Used to obtain new access tokens

b) Extend session without re authentication

c) Must be stored securely

d) All of the above

View Answer

Correct answer: D — All of the above
In Spring Security, which class configures HTTP security?

a) WebSecurityConfigurerAdapter

b) HttpSecurity

c) AuthenticationManager

d) FilterChainProxy

View Answer

Correct answer: B — HttpSecurity
Which of the following is true about JWT revocation?

a) Tokens cannot be revoked easily once issued

b) Blacklisting is one approach

c) Short expiration reduces risk

d) All of the above

View Answer

Correct answer: D — All of the above
Which OAuth2 flow is considered insecure for modern apps?

a) Authorization Code

b) Implicit

c) Client Credentials

d) Device Code

View Answer

Correct answer: B — Implicit
Which of the following is true about CSRF edge cases?

a) Stateless APIs usually disable CSRF

b) CSRF mainly affects state changing requests

c) GET requests are generally safe

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about password policies?

a) Enforce minimum length

b) Require complexity (uppercase, digits, symbols)

c) Encourage periodic rotation

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about HTTPS certificates?

a) Issued by Certificate Authorities

b) Can be self signed for testing

c) Must be renewed periodically

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about Spring Security custom filters?

a) Extend OncePerRequestFilter

b) Added via HttpSecurity.addFilterBefore/After

c) Useful for custom authentication logic

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about JWT best practices?

a) Use HTTPS for transmission

b) Keep tokens short lived

c) Store securely (e.g., HttpOnly cookies)

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about OAuth2 Password flow?

a) Requires user credentials directly

b) Considered legacy and insecure

c) Should be avoided in modern apps

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about CSRF token storage?

a) Stored in hidden form fields

b) Sent with each request

c) Validated on server side

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about secure coding practices?

a) Validate all inputs

b) Avoid SQL injection

c) Use parameterized queries

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about Spring Security AuthenticationManager?

a) Manages authentication process

b) Delegates to AuthenticationProviders

c) Integrated with HttpSecurity

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about JWT payload?

a) Contains claims

b) Not encrypted by default

c) Can be read by anyone with token

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about OAuth2 Authorization Code flow?

a) Uses authorization server redirect

b) Exchanges code for token

c) More secure than Implicit flow

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about CSRF protection in APIs?

a) Often disabled for stateless APIs

b) Enabled for browser based apps

c) Depends on session management

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about password storage mistakes?

a) Storing plain text passwords

b) Using weak hashing algorithms

c) Not salting hashes

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about HTTPS handshake?

a) Uses asymmetric cryptography initially

b) Establishes symmetric session key

c) Ensures confidentiality and integrity

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about Spring Security roles vs authorities?

a) Roles are prefixed with "ROLE_"

b) Authorities are more granular

c) Both used for access control

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about JWT blacklisting?

a) Requires server side storage

b) Adds complexity

c) Useful for revoking tokens early

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about OAuth2 Device Code flow?

a) Designed for devices with limited input

b) Uses user verification via browser

c) Issues access token after approval

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about CSRF double submit cookie pattern?

a) Token stored in cookie and request

b) Server validates both match

c) Prevents CSRF attacks

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about secure session management?

a) Use secure cookies

b) Set HttpOnly and Secure flags

c) Regenerate session IDs on login

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about Spring Security PasswordEncoder?

a) Provides password hashing

b) Implementations include BCryptPasswordEncoder

c) Used in authentication process

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about JWT claim types?

a) Registered claims (iss, sub, exp)

b) Public claims

c) Private claims

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about OAuth2 token introspection?

a) Validates token status

b) Provides metadata about token

c) Used by resource servers

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about CSRF SameSite cookie attribute?

a) Restricts cross site cookie sending

b) Helps mitigate CSRF attacks

c) Values include Strict, Lax, None

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about secure API design?

a) Use HTTPS

b) Validate inputs

c) Implement rate limiting

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about Spring Security custom authentication providers?

a) Implement AuthenticationProvider interface

b) Provide custom authentication logic

c) Integrated with AuthenticationManager

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about JWT refresh token best practices?

a) Store securely

b) Rotate refresh tokens

c) Limit lifetime

d) All of the above

View Answer

Correct answer: D — All of the above
Which of the following is true about secure coding overall?

a) Validate and sanitize inputs

b) Use secure libraries and frameworks

c) Follow least privilege principle

d) All of the above

View Answer

Correct answer: D — All of the above

Quick Links to Explore