Advanced IT Security & Auth Abbreviations
Test your knowledge of advanced IT abbreviations: DKIM, SPF, DMARC, mTLS, JWT, PKCE, SAML, OIDC, RBAC, ABAC in professional security and authentication contexts.
0 / 45 completed
1 / 45
A developer says: 'We need to add DKIM to our outbound mail server.' What does DKIM stand for?
DKIM stands for DomainKeys Identified Mail. It adds a cryptographic signature to outgoing emails, allowing receiving servers to verify the message was sent by an authorised domain and was not altered in transit.
2 / 45
During a security review, the engineer says: 'Our SPF record is misconfigured.' What is SPF?
SPF stands for Sender Policy Framework. It is a DNS record that specifies which mail servers are authorised to send email on behalf of a domain, helping prevent email spoofing.
3 / 45
The architect recommends: 'We should implement DMARC to tie together our SPF and DKIM policies.' What does DMARC mean?
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It builds on SPF and DKIM by specifying what to do with emails that fail authentication checks and provides reporting to domain owners.
4 / 45
The security team says: 'Service-to-service calls must use mTLS.' What does mTLS stand for?
mTLS stands for Mutual TLS (Transport Layer Security). Unlike standard TLS where only the server presents a certificate, in mTLS both the client and the server authenticate each other with certificates, which is common in zero-trust architectures.
5 / 45
The backend developer explains: 'We issue a JWT after login and the client sends it in every request.' What is JWT?
JWT stands for JSON Web Token. It is a compact, URL-safe token format used to represent claims between two parties. A JWT typically contains a header, payload (claims), and a cryptographic signature.
6 / 45
PR Description:
"Fix: Implement rate limiting on the API endpoint to mitigate potential DDoS attacks. Using a combination of Redis for caching and an algorithmic rate limiter."The PR description refers to 'rate limiting', which is the correct term. Rate limiting involves setting restrictions on the number of requests that can be made within a specific timeframe. While authentication and authorization are related concepts in security, they aren't directly described here; encryption protects data *in transit* or *at rest*, not the rate of API calls. Understanding this terminology is crucial for discussing API security best practices during code reviews.
7 / 45
PR Description:
"Implement OAuth 2.0 for third-party API access."OAuth 2.0 relies on tokens to manage access permissions. An access token grants temporary access, while a refresh token allows you to obtain new ones without re-authenticating the user. Understanding these distinctions is crucial for designing secure API integrations. The PR describes using OAuth 2.0, therefore the refresh token is the relevant term.
8 / 45
Sarah: 'I'm seeing a lot of 503 errors on the user registration endpoint. I think we need to implement Idempotency Keys.' What does an Idempotency Key primarily address in a distributed system?
Idempotency Keys are crucial for handling unreliable networks and retries. They ensure that a single request is processed only once, even if sent multiple times due to temporary failures – preventing unintended side effects like duplicate account creation or incorrect data updates. Option A describes digital signatures; option C concerns auto-scaling; and option D refers to encryption.
9 / 45
Martin: 'We're getting a lot of '403 Forbidden' errors when users try to update their profiles. I think we should use API Gateway authorization with IAM roles.' What does IAM primarily provide in this context?
The question highlights a common issue with API access and asks about IAM roles. IAM (Identity and Access Management) is fundamentally about controlling who can do what within your system. It provides a way to define granular permissions based on user identities and attributes, granting only the necessary access to resources – in this case, profile updates – preventing unauthorized actions. Options A, C, and D describe entirely different security or operational concepts.
10 / 45
John: 'I'm investigating a spike in failed API calls. The logs show many clients are sending the same request multiple times – it seems like we might need to implement retry logic with exponential backoff.' What does 'exponential backoff' refer to within this context?
Exponential backoff is a key technique for handling transient failures in distributed systems. It involves increasing the delay between retry attempts after each failure, starting with a short delay and doubling it with each subsequent attempt – this prevents overwhelming the system during temporary outages. Option A is incorrect because timeout values are typically configured statically, not dynamically adjusted based on failure rates. Options C and D describe entirely different approaches to security and debugging.
11 / 45
PR Description:
"Fix: Implement rate limiting on the API endpoint to mitigate potential DDoS attacks. Using a combination of Redis for caching and an algorithmic rate limiter."The PR description refers to 'rate limiting', which is the correct term. Rate limiting involves setting restrictions on the number of requests that can be made within a specific timeframe. While authentication and authorization are related concepts in security, they aren't directly described here; encryption protects data *in transit* or *at rest*, not the rate of API calls. Understanding this terminology is crucial for discussing API security best practices during code reviews.
12 / 45
PR Description:
"Implement OAuth 2.0 for third-party API access."OAuth 2.0 relies on tokens to manage access permissions. An access token grants temporary access, while a refresh token allows you to obtain new ones without re-authenticating the user. Understanding these distinctions is crucial for designing secure API integrations. The PR describes using OAuth 2.0, therefore the refresh token is the relevant term.
13 / 45
Sarah: 'I'm seeing a lot of 503 errors on the user registration endpoint. I think we need to implement Idempotency Keys.' What does an Idempotency Key primarily address in a distributed system?
Idempotency Keys are crucial for handling unreliable networks and retries. They ensure that a single request is processed only once, even if sent multiple times due to temporary failures – preventing unintended side effects like duplicate account creation or incorrect data updates. Option A describes digital signatures; option C concerns auto-scaling; and option D refers to encryption.
14 / 45
Martin: 'We're getting a lot of '403 Forbidden' errors when users try to update their profiles. I think we should use API Gateway authorization with IAM roles.' What does IAM primarily provide in this context?
The question highlights a common issue with API access and asks about IAM roles. IAM (Identity and Access Management) is fundamentally about controlling who can do what within your system. It provides a way to define granular permissions based on user identities and attributes, granting only the necessary access to resources – in this case, profile updates – preventing unauthorized actions. Options A, C, and D describe entirely different security or operational concepts.
15 / 45
John: 'I'm investigating a spike in failed API calls. The logs show many clients are sending the same request multiple times – it seems like we might need to implement retry logic with exponential backoff.' What does 'exponential backoff' refer to within this context?
Exponential backoff is a key technique for handling transient failures in distributed systems. It involves increasing the delay between retry attempts after each failure, starting with a short delay and doubling it with each subsequent attempt – this prevents overwhelming the system during temporary outages. Option A is incorrect because timeout values are typically configured statically, not dynamically adjusted based on failure rates. Options C and D describe entirely different approaches to security and debugging.
16 / 45
PR Description:
"Fix: Implement rate limiting on the API endpoint to mitigate potential DDoS attacks. Using a combination of Redis for caching and an algorithmic rate limiter."The PR description refers to 'rate limiting', which is the correct term. Rate limiting involves setting restrictions on the number of requests that can be made within a specific timeframe. While authentication and authorization are related concepts in security, they aren't directly described here; encryption protects data *in transit* or *at rest*, not the rate of API calls. Understanding this terminology is crucial for discussing API security best practices during code reviews.
17 / 45
PR Description:
"Implement OAuth 2.0 for third-party API access."OAuth 2.0 relies on tokens to manage access permissions. An access token grants temporary access, while a refresh token allows you to obtain new ones without re-authenticating the user. Understanding these distinctions is crucial for designing secure API integrations. The PR describes using OAuth 2.0, therefore the refresh token is the relevant term.
18 / 45
Sarah: 'I'm seeing a lot of 503 errors on the user registration endpoint. I think we need to implement Idempotency Keys.' What does an Idempotency Key primarily address in a distributed system?
Idempotency Keys are crucial for handling unreliable networks and retries. They ensure that a single request is processed only once, even if sent multiple times due to temporary failures – preventing unintended side effects like duplicate account creation or incorrect data updates. Option A describes digital signatures; option C concerns auto-scaling; and option D refers to encryption.
19 / 45
Martin: 'We're getting a lot of '403 Forbidden' errors when users try to update their profiles. I think we should use API Gateway authorization with IAM roles.' What does IAM primarily provide in this context?
The question highlights a common issue with API access and asks about IAM roles. IAM (Identity and Access Management) is fundamentally about controlling who can do what within your system. It provides a way to define granular permissions based on user identities and attributes, granting only the necessary access to resources – in this case, profile updates – preventing unauthorized actions. Options A, C, and D describe entirely different security or operational concepts.
20 / 45
John: 'I'm investigating a spike in failed API calls. The logs show many clients are sending the same request multiple times – it seems like we might need to implement retry logic with exponential backoff.' What does 'exponential backoff' refer to within this context?
Exponential backoff is a key technique for handling transient failures in distributed systems. It involves increasing the delay between retry attempts after each failure, starting with a short delay and doubling it with each subsequent attempt – this prevents overwhelming the system during temporary outages. Option A is incorrect because timeout values are typically configured statically, not dynamically adjusted based on failure rates. Options C and D describe entirely different approaches to security and debugging.
21 / 45
PR Description:
"Fix: Implement rate limiting on the API endpoint to mitigate potential DDoS attacks. Using a combination of Redis for caching and an algorithmic rate limiter."The PR description refers to 'rate limiting', which is the correct term. Rate limiting involves setting restrictions on the number of requests that can be made within a specific timeframe. While authentication and authorization are related concepts in security, they aren't directly described here; encryption protects data *in transit* or *at rest*, not the rate of API calls. Understanding this terminology is crucial for discussing API security best practices during code reviews.
22 / 45
PR Description:
"Implement OAuth 2.0 for third-party API access."OAuth 2.0 relies on tokens to manage access permissions. An access token grants temporary access, while a refresh token allows you to obtain new ones without re-authenticating the user. Understanding these distinctions is crucial for designing secure API integrations. The PR describes using OAuth 2.0, therefore the refresh token is the relevant term.
23 / 45
Sarah: 'I'm seeing a lot of 503 errors on the user registration endpoint. I think we need to implement Idempotency Keys.' What does an Idempotency Key primarily address in a distributed system?
Idempotency Keys are crucial for handling unreliable networks and retries. They ensure that a single request is processed only once, even if sent multiple times due to temporary failures – preventing unintended side effects like duplicate account creation or incorrect data updates. Option A describes digital signatures; option C concerns auto-scaling; and option D refers to encryption.
24 / 45
Martin: 'We're getting a lot of '403 Forbidden' errors when users try to update their profiles. I think we should use API Gateway authorization with IAM roles.' What does IAM primarily provide in this context?
The question highlights a common issue with API access and asks about IAM roles. IAM (Identity and Access Management) is fundamentally about controlling who can do what within your system. It provides a way to define granular permissions based on user identities and attributes, granting only the necessary access to resources – in this case, profile updates – preventing unauthorized actions. Options A, C, and D describe entirely different security or operational concepts.
25 / 45
John: 'I'm investigating a spike in failed API calls. The logs show many clients are sending the same request multiple times – it seems like we might need to implement retry logic with exponential backoff.' What does 'exponential backoff' refer to within this context?
Exponential backoff is a key technique for handling transient failures in distributed systems. It involves increasing the delay between retry attempts after each failure, starting with a short delay and doubling it with each subsequent attempt – this prevents overwhelming the system during temporary outages. Option A is incorrect because timeout values are typically configured statically, not dynamically adjusted based on failure rates. Options C and D describe entirely different approaches to security and debugging.
26 / 45
PR Description:
"Fix: Implement rate limiting on the API endpoint to mitigate potential DDoS attacks. Using a combination of Redis for caching and an algorithmic rate limiter."The PR description refers to 'rate limiting', which is the correct term. Rate limiting involves setting restrictions on the number of requests that can be made within a specific timeframe. While authentication and authorization are related concepts in security, they aren't directly described here; encryption protects data *in transit* or *at rest*, not the rate of API calls. Understanding this terminology is crucial for discussing API security best practices during code reviews.
27 / 45
PR Description:
"Implement OAuth 2.0 for third-party API access."OAuth 2.0 relies on tokens to manage access permissions. An access token grants temporary access, while a refresh token allows you to obtain new ones without re-authenticating the user. Understanding these distinctions is crucial for designing secure API integrations. The PR describes using OAuth 2.0, therefore the refresh token is the relevant term.
28 / 45
Sarah: 'I'm seeing a lot of 503 errors on the user registration endpoint. I think we need to implement Idempotency Keys.' What does an Idempotency Key primarily address in a distributed system?
Idempotency Keys are crucial for handling unreliable networks and retries. They ensure that a single request is processed only once, even if sent multiple times due to temporary failures – preventing unintended side effects like duplicate account creation or incorrect data updates. Option A describes digital signatures; option C concerns auto-scaling; and option D refers to encryption.
29 / 45
Martin: 'We're getting a lot of '403 Forbidden' errors when users try to update their profiles. I think we should use API Gateway authorization with IAM roles.' What does IAM primarily provide in this context?
The question highlights a common issue with API access and asks about IAM roles. IAM (Identity and Access Management) is fundamentally about controlling who can do what within your system. It provides a way to define granular permissions based on user identities and attributes, granting only the necessary access to resources – in this case, profile updates – preventing unauthorized actions. Options A, C, and D describe entirely different security or operational concepts.
30 / 45
John: 'I'm investigating a spike in failed API calls. The logs show many clients are sending the same request multiple times – it seems like we might need to implement retry logic with exponential backoff.' What does 'exponential backoff' refer to within this context?
Exponential backoff is a key technique for handling transient failures in distributed systems. It involves increasing the delay between retry attempts after each failure, starting with a short delay and doubling it with each subsequent attempt – this prevents overwhelming the system during temporary outages. Option A is incorrect because timeout values are typically configured statically, not dynamically adjusted based on failure rates. Options C and D describe entirely different approaches to security and debugging.
31 / 45
PR Description:
"Fix: Implement rate limiting on the API endpoint to mitigate potential DDoS attacks. Using a combination of Redis for caching and an algorithmic rate limiter."The PR description refers to 'rate limiting', which is the correct term. Rate limiting involves setting restrictions on the number of requests that can be made within a specific timeframe. While authentication and authorization are related concepts in security, they aren't directly described here; encryption protects data *in transit* or *at rest*, not the rate of API calls. Understanding this terminology is crucial for discussing API security best practices during code reviews.
32 / 45
PR Description:
"Implement OAuth 2.0 for third-party API access."OAuth 2.0 relies on tokens to manage access permissions. An access token grants temporary access, while a refresh token allows you to obtain new ones without re-authenticating the user. Understanding these distinctions is crucial for designing secure API integrations. The PR describes using OAuth 2.0, therefore the refresh token is the relevant term.
33 / 45
Sarah: 'I'm seeing a lot of 503 errors on the user registration endpoint. I think we need to implement Idempotency Keys.' What does an Idempotency Key primarily address in a distributed system?
Idempotency Keys are crucial for handling unreliable networks and retries. They ensure that a single request is processed only once, even if sent multiple times due to temporary failures – preventing unintended side effects like duplicate account creation or incorrect data updates. Option A describes digital signatures; option C concerns auto-scaling; and option D refers to encryption.
34 / 45
Martin: 'We're getting a lot of '403 Forbidden' errors when users try to update their profiles. I think we should use API Gateway authorization with IAM roles.' What does IAM primarily provide in this context?
The question highlights a common issue with API access and asks about IAM roles. IAM (Identity and Access Management) is fundamentally about controlling who can do what within your system. It provides a way to define granular permissions based on user identities and attributes, granting only the necessary access to resources – in this case, profile updates – preventing unauthorized actions. Options A, C, and D describe entirely different security or operational concepts.
35 / 45
John: 'I'm investigating a spike in failed API calls. The logs show many clients are sending the same request multiple times – it seems like we might need to implement retry logic with exponential backoff.' What does 'exponential backoff' refer to within this context?
Exponential backoff is a key technique for handling transient failures in distributed systems. It involves increasing the delay between retry attempts after each failure, starting with a short delay and doubling it with each subsequent attempt – this prevents overwhelming the system during temporary outages. Option A is incorrect because timeout values are typically configured statically, not dynamically adjusted based on failure rates. Options C and D describe entirely different approaches to security and debugging.
36 / 45
PR Description:
"Fix: Implement rate limiting on the API endpoint to mitigate potential DDoS attacks. Using a combination of Redis for caching and an algorithmic rate limiter."The PR description refers to 'rate limiting', which is the correct term. Rate limiting involves setting restrictions on the number of requests that can be made within a specific timeframe. While authentication and authorization are related concepts in security, they aren't directly described here; encryption protects data *in transit* or *at rest*, not the rate of API calls. Understanding this terminology is crucial for discussing API security best practices during code reviews.
37 / 45
PR Description:
"Implement OAuth 2.0 for third-party API access."OAuth 2.0 relies on tokens to manage access permissions. An access token grants temporary access, while a refresh token allows you to obtain new ones without re-authenticating the user. Understanding these distinctions is crucial for designing secure API integrations. The PR describes using OAuth 2.0, therefore the refresh token is the relevant term.
38 / 45
Sarah: 'I'm seeing a lot of 503 errors on the user registration endpoint. I think we need to implement Idempotency Keys.' What does an Idempotency Key primarily address in a distributed system?
Idempotency Keys are crucial for handling unreliable networks and retries. They ensure that a single request is processed only once, even if sent multiple times due to temporary failures – preventing unintended side effects like duplicate account creation or incorrect data updates. Option A describes digital signatures; option C concerns auto-scaling; and option D refers to encryption.
39 / 45
Martin: 'We're getting a lot of '403 Forbidden' errors when users try to update their profiles. I think we should use API Gateway authorization with IAM roles.' What does IAM primarily provide in this context?
The question highlights a common issue with API access and asks about IAM roles. IAM (Identity and Access Management) is fundamentally about controlling who can do what within your system. It provides a way to define granular permissions based on user identities and attributes, granting only the necessary access to resources – in this case, profile updates – preventing unauthorized actions. Options A, C, and D describe entirely different security or operational concepts.
40 / 45
John: 'I'm investigating a spike in failed API calls. The logs show many clients are sending the same request multiple times – it seems like we might need to implement retry logic with exponential backoff.' What does 'exponential backoff' refer to within this context?
Exponential backoff is a key technique for handling transient failures in distributed systems. It involves increasing the delay between retry attempts after each failure, starting with a short delay and doubling it with each subsequent attempt – this prevents overwhelming the system during temporary outages. Option A is incorrect because timeout values are typically configured statically, not dynamically adjusted based on failure rates. Options C and D describe entirely different approaches to security and debugging.
41 / 45
PR Description:
"Fix: Implement rate limiting on the API endpoint to mitigate potential DDoS attacks. Using a combination of Redis for caching and an algorithmic rate limiter."The PR description refers to 'rate limiting', which is the correct term. Rate limiting involves setting restrictions on the number of requests that can be made within a specific timeframe. While authentication and authorization are related concepts in security, they aren't directly described here; encryption protects data *in transit* or *at rest*, not the rate of API calls. Understanding this terminology is crucial for discussing API security best practices during code reviews.
42 / 45
PR Description:
"Implement OAuth 2.0 for third-party API access."OAuth 2.0 relies on tokens to manage access permissions. An access token grants temporary access, while a refresh token allows you to obtain new ones without re-authenticating the user. Understanding these distinctions is crucial for designing secure API integrations. The PR describes using OAuth 2.0, therefore the refresh token is the relevant term.
43 / 45
Sarah: 'I'm seeing a lot of 503 errors on the user registration endpoint. I think we need to implement Idempotency Keys.' What does an Idempotency Key primarily address in a distributed system?
Idempotency Keys are crucial for handling unreliable networks and retries. They ensure that a single request is processed only once, even if sent multiple times due to temporary failures – preventing unintended side effects like duplicate account creation or incorrect data updates. Option A describes digital signatures; option C concerns auto-scaling; and option D refers to encryption.
44 / 45
Martin: 'We're getting a lot of '403 Forbidden' errors when users try to update their profiles. I think we should use API Gateway authorization with IAM roles.' What does IAM primarily provide in this context?
The question highlights a common issue with API access and asks about IAM roles. IAM (Identity and Access Management) is fundamentally about controlling who can do what within your system. It provides a way to define granular permissions based on user identities and attributes, granting only the necessary access to resources – in this case, profile updates – preventing unauthorized actions. Options A, C, and D describe entirely different security or operational concepts.
45 / 45
John: 'I'm investigating a spike in failed API calls. The logs show many clients are sending the same request multiple times – it seems like we might need to implement retry logic with exponential backoff.' What does 'exponential backoff' refer to within this context?
Exponential backoff is a key technique for handling transient failures in distributed systems. It involves increasing the delay between retry attempts after each failure, starting with a short delay and doubling it with each subsequent attempt – this prevents overwhelming the system during temporary outages. Option A is incorrect because timeout values are typically configured statically, not dynamically adjusted based on failure rates. Options C and D describe entirely different approaches to security and debugging.
Frequently Asked Questions
What will I practice in "Advanced IT Security & Auth Abbreviations"?
This is an IT Abbreviations exercise set. It walks through 45 scenario-based multiple-choice questions built around real usage of IT Abbreviations terminology that IT professionals encounter on the job.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to complete with no account, sign-up, or paywall.
How many questions are in this exercise?
This set contains 45 questions. Each one shows immediate feedback and a detailed explanation after you answer, so you learn the correct usage right away rather than waiting for a final score.
Do I need prior experience to complete this exercise?
No prior experience is required. Each question includes a full explanation covering the reasoning behind the correct answer, so the exercise itself teaches the IT Abbreviations vocabulary as you go.
Can I retry the exercise if I get questions wrong?
Yes — use the "Try again" button on the results screen to reset your answers and go through all the questions again. There is no limit on attempts.
Is my progress saved?
Your answers and score for the current session are tracked in the browser as you go. No account or login is needed, and there is nothing to install.
What if I don't understand a term used in a question?
Read the explanation shown after you answer each question — it breaks down the correct term in plain English with a real-world example. You can also check the site Glossary for quick definitions.
How is this different from reading a blog article on the topic?
Exercises like this one are interactive drills that test and reinforce specific vocabulary through multiple-choice questions, while blog articles explain concepts in prose. Practising here after reading builds active recall, not just passive recognition.
Where can I find more IT Abbreviations exercises?
See the IT Abbreviations exercises hub for the full set of related pages, or browse all exercise categories from the main Exercises index.
Can I use this exercise to prepare for a technical interview?
Yes — IT Abbreviations vocabulary comes up often in technical discussions and interviews. Pair this exercise with our dedicated Interview Preparation section for role-specific practice.