5 exercises — PKI and TLS/mTLS, SSO and MFA, RBAC vs. ABAC access control, and IDS vs. IPS detection and prevention.
0 / 25 completed
1 / 25
A security architecture document mentions "PKI" as the foundation for issuing TLS certificates. What does PKI stand for, and what problem does it solve?
PKI (Public Key Infrastructure) is the trust framework underlying HTTPS and most modern authentication systems. A Certificate Authority (CA) issues digital certificates that bind a public key to an identity (a domain name, an organisation), and browsers/clients trust that certificate because they trust the CA that signed it — this chain of trust is what lets your browser show a padlock icon without you personally verifying the website's cryptographic keys.
Related vocabulary:public/private key pair — the public key can be shared openly and used to encrypt data or verify a signature; the private key must stay secret and is used to decrypt or create a signature. Certificate chain — the sequence of certificates from a website's certificate up to a trusted root CA.
2 / 25
A backend engineer says: "We're moving from TLS to mTLS for service-to-service communication." What is the difference between TLS and mTLS?
In standard TLS, only the server proves its identity via a certificate — this is why your browser can verify it's really talking to your bank's website, but the bank's server has no cryptographic proof of who you are (that's handled separately, typically by a password or session token, at the application layer).
mTLS (mutual TLS) requires both sides to present certificates, so each party cryptographically verifies the other. This is especially valuable in a microservices architecture (often implemented via a service mesh like Istio or Linkerd) where you want to guarantee that only legitimate internal services — not an attacker who has gained network access — can call sensitive internal APIs.
The tradeoff: mTLS requires managing certificates for every service (issuance, rotation, revocation), which adds operational complexity compared to standard TLS.
3 / 25
A login flow uses "SSO" combined with "MFA" for enterprise users. How would you explain these two abbreviations and why they're often paired together?
SSO (Single Sign-On) centralises authentication through one identity provider (e.g. Okta, Entra ID, Google Workspace), so employees log in once and gain access to email, code repositories, internal tools, and more without separate logins for each. This is both a convenience and a security consolidation — but it also concentrates risk: if that one central login is compromised, an attacker potentially gains access to everything connected to it.
MFA (Multi-Factor Authentication) directly mitigates that concentrated risk by requiring something beyond just a password — commonly "something you know" (password) plus "something you have" (a phone, a hardware key) or "something you are" (biometrics). Requiring MFA specifically at the SSO layer means every connected application inherits that stronger protection automatically, rather than needing MFA configured separately for each individual app.
4 / 25
An access-control design document compares "RBAC" and "ABAC" as two approaches. What's the practical difference, and when would a team choose one over the other?
Choosing between RBAC and ABAC is a real architectural tradeoff frequently discussed in security certification material and system design interviews.
RBAC is easy to understand and audit ("what can an Editor do?") but can become unwieldy when permission requirements are highly contextual — e.g. "Editors can edit documents, but only ones from their own department, and only during business hours" starts to strain a pure role model, often requiring a proliferation of narrow roles (Editor-Finance, Editor-Finance-BusinessHours...) to express.
ABAC handles this naturally by evaluating rules against attributes directly (department == resource.department AND time BETWEEN 9am-5pm) without needing a combinatorial explosion of specific roles, at the cost of policies being harder to read at a glance and harder to test exhaustively.
Practical guidance often cited: start with RBAC for its simplicity, and introduce ABAC (or a hybrid) only once genuine contextual requirements outgrow what roles alone can cleanly express.
5 / 25
A network security review mentions deploying "an IDS initially, and considering an IPS later." What's the key operational difference between these two, and why might a team deploy IDS first?
The IDS vs. IPS distinction hinges on a single word: detection versus prevention, i.e. passive alerting versus active blocking.
IDS — sits (often) out-of-band, inspecting a copy of traffic, and generates alerts for a security team to review and act on manually. Because it doesn't block anything itself, a false positive (a legitimate request incorrectly flagged as malicious) only produces an alert, not an outage.
IPS — sits in-line (directly in the traffic path) and can automatically drop or block matching traffic before it reaches its destination. This is more powerful — it can stop an attack in real time — but a false positive can now cause a real incident, blocking legitimate users or requests.
Why "IDS first" is common practice: deploying detection rules in IDS mode lets a team observe real traffic, tune rules to reduce false positives, and build confidence in the ruleset's accuracy before "flipping the switch" to IPS mode, where the same rules start actively blocking traffic — a much higher-stakes failure mode if the rules aren't well-tuned.
6 / 25
PR describes a pull request. During code review, Alice comments: 'This PR uses OWASP to validate input, which is good, but we should also consider adding CSRF protection for the form submission.' What does OWASP stand for in this context, and why is CSRF a relevant concern?
OWASP (Open Web Application Security Project) is a non-profit foundation dedicated to improving the security of software. It provides resources, tools, and best practices for developers. The concern about CSRF (Cross-Site Request Forgery) highlights that even with input validation, Alice's PR doesn't protect against malicious users tricking the server into performing actions on behalf of an authenticated user – a common web vulnerability.
7 / 25
David: 'The API response is returning a 403 error. I suspect it's an issue with our rate limiting configuration, but the documentation doesn't explicitly mention anything about 'throttling.''
David is referring to 'throttling,' which is a crucial security mechanism to prevent abuse and denial-of-service attacks. Rate limiting, or throttling, restricts the number of requests originating from a single source within a specific timeframe. Understanding this terminology is key to troubleshooting API errors related to resource exhaustion. The other options relate to different aspects of securing an API – authentication verifies identity, authorization controls access rights, and tokenization protects data.
8 / 25
During a Slack discussion about securing a new microservice API, Ben writes: "I'm seeing a lot of mentions of 'API Keys'. I understand they're used for authentication, but are they really the best way to manage access? Shouldn't we be looking at OAuth 2.0?"
API Keys are a simple form of authentication that relies on storing a single key for each application or user. While they can be useful for basic authorization, they lack the granular control and delegation capabilities offered by OAuth 2.0. OAuth 2.0 allows users to grant third-party applications limited access to their resources without sharing their credentials directly, representing a more secure and flexible approach for microservice APIs, particularly when dealing with diverse client types.
9 / 25
During a standup update, Sarah says: 'We're implementing API authentication. We've been using JWTs for a while now, but the security team is pushing us to start using 'API Keys' for new integrations.' What is the primary difference in how API Keys and JWTs are typically used for securing APIs?
JWTs (JSON Web Tokens) are self-contained tokens that hold claims about a user or application. They're signed cryptographically to ensure integrity, but rely on the signing entity to be trusted. API Keys, conversely, are simple strings that identify an application and often require the server to verify requests based on this key—this approach is stateless, meaning no session state needs to be managed by the server. Therefore, JWTs contain more information and have a different trust model than API keys.
10 / 25
Alice is reviewing a pull request that implements new user registration. The PR includes the following comment: 'I'm seeing frequent attempts to register with common usernames and passwords. We should implement account lockout policies to mitigate brute-force attacks.' What does 'account lockout' refer to in this context, and why is it a relevant security measure?
The term 'account lockout' refers to a security mechanism that temporarily disables a user account after a specified number of unsuccessful login attempts. This prevents automated or human attackers from repeatedly trying to guess passwords through brute-force attacks. Rate limiting is related, but doesn't directly address the immediate threat of repeated failed logins. Account lockout policies are a fundamental defense against credential stuffing and other password cracking techniques.
11 / 25
PR describes a pull request. During code review, Alice comments: 'This PR uses OWASP to validate input, which is good, but we should also consider adding CSRF protection for the form submission.' What does OWASP stand for in this context, and why is CSRF a relevant concern?
OWASP (Open Web Application Security Project) is a non-profit foundation dedicated to improving the security of software. It provides resources, tools, and best practices for developers. The concern about CSRF (Cross-Site Request Forgery) highlights that even with input validation, Alice's PR doesn't protect against malicious users tricking the server into performing actions on behalf of an authenticated user – a common web vulnerability.
12 / 25
David: 'The API response is returning a 403 error. I suspect it's an issue with our rate limiting configuration, but the documentation doesn't explicitly mention anything about 'throttling.''
David is referring to 'throttling,' which is a crucial security mechanism to prevent abuse and denial-of-service attacks. Rate limiting, or throttling, restricts the number of requests originating from a single source within a specific timeframe. Understanding this terminology is key to troubleshooting API errors related to resource exhaustion. The other options relate to different aspects of securing an API – authentication verifies identity, authorization controls access rights, and tokenization protects data.
13 / 25
During a Slack discussion about securing a new microservice API, Ben writes: "I'm seeing a lot of mentions of 'API Keys'. I understand they're used for authentication, but are they really the best way to manage access? Shouldn't we be looking at OAuth 2.0?"
API Keys are a simple form of authentication that relies on storing a single key for each application or user. While they can be useful for basic authorization, they lack the granular control and delegation capabilities offered by OAuth 2.0. OAuth 2.0 allows users to grant third-party applications limited access to their resources without sharing their credentials directly, representing a more secure and flexible approach for microservice APIs, particularly when dealing with diverse client types.
14 / 25
During a standup update, Sarah says: 'We're implementing API authentication. We've been using JWTs for a while now, but the security team is pushing us to start using 'API Keys' for new integrations.' What is the primary difference in how API Keys and JWTs are typically used for securing APIs?
JWTs (JSON Web Tokens) are self-contained tokens that hold claims about a user or application. They're signed cryptographically to ensure integrity, but rely on the signing entity to be trusted. API Keys, conversely, are simple strings that identify an application and often require the server to verify requests based on this key—this approach is stateless, meaning no session state needs to be managed by the server. Therefore, JWTs contain more information and have a different trust model than API keys.
15 / 25
Alice is reviewing a pull request that implements new user registration. The PR includes the following comment: 'I'm seeing frequent attempts to register with common usernames and passwords. We should implement account lockout policies to mitigate brute-force attacks.' What does 'account lockout' refer to in this context, and why is it a relevant security measure?
The term 'account lockout' refers to a security mechanism that temporarily disables a user account after a specified number of unsuccessful login attempts. This prevents automated or human attackers from repeatedly trying to guess passwords through brute-force attacks. Rate limiting is related, but doesn't directly address the immediate threat of repeated failed logins. Account lockout policies are a fundamental defense against credential stuffing and other password cracking techniques.
16 / 25
PR describes a pull request. During code review, Alice comments: 'This PR uses OWASP to validate input, which is good, but we should also consider adding CSRF protection for the form submission.' What does OWASP stand for in this context, and why is CSRF a relevant concern?
OWASP (Open Web Application Security Project) is a non-profit foundation dedicated to improving the security of software. It provides resources, tools, and best practices for developers. The concern about CSRF (Cross-Site Request Forgery) highlights that even with input validation, Alice's PR doesn't protect against malicious users tricking the server into performing actions on behalf of an authenticated user – a common web vulnerability.
17 / 25
David: 'The API response is returning a 403 error. I suspect it's an issue with our rate limiting configuration, but the documentation doesn't explicitly mention anything about 'throttling.''
David is referring to 'throttling,' which is a crucial security mechanism to prevent abuse and denial-of-service attacks. Rate limiting, or throttling, restricts the number of requests originating from a single source within a specific timeframe. Understanding this terminology is key to troubleshooting API errors related to resource exhaustion. The other options relate to different aspects of securing an API – authentication verifies identity, authorization controls access rights, and tokenization protects data.
18 / 25
During a Slack discussion about securing a new microservice API, Ben writes: "I'm seeing a lot of mentions of 'API Keys'. I understand they're used for authentication, but are they really the best way to manage access? Shouldn't we be looking at OAuth 2.0?"
API Keys are a simple form of authentication that relies on storing a single key for each application or user. While they can be useful for basic authorization, they lack the granular control and delegation capabilities offered by OAuth 2.0. OAuth 2.0 allows users to grant third-party applications limited access to their resources without sharing their credentials directly, representing a more secure and flexible approach for microservice APIs, particularly when dealing with diverse client types.
19 / 25
During a standup update, Sarah says: 'We're implementing API authentication. We've been using JWTs for a while now, but the security team is pushing us to start using 'API Keys' for new integrations.' What is the primary difference in how API Keys and JWTs are typically used for securing APIs?
JWTs (JSON Web Tokens) are self-contained tokens that hold claims about a user or application. They're signed cryptographically to ensure integrity, but rely on the signing entity to be trusted. API Keys, conversely, are simple strings that identify an application and often require the server to verify requests based on this key—this approach is stateless, meaning no session state needs to be managed by the server. Therefore, JWTs contain more information and have a different trust model than API keys.
20 / 25
Alice is reviewing a pull request that implements new user registration. The PR includes the following comment: 'I'm seeing frequent attempts to register with common usernames and passwords. We should implement account lockout policies to mitigate brute-force attacks.' What does 'account lockout' refer to in this context, and why is it a relevant security measure?
The term 'account lockout' refers to a security mechanism that temporarily disables a user account after a specified number of unsuccessful login attempts. This prevents automated or human attackers from repeatedly trying to guess passwords through brute-force attacks. Rate limiting is related, but doesn't directly address the immediate threat of repeated failed logins. Account lockout policies are a fundamental defense against credential stuffing and other password cracking techniques.
21 / 25
PR describes a pull request. During code review, Alice comments: 'This PR uses OWASP to validate input, which is good, but we should also consider adding CSRF protection for the form submission.' What does OWASP stand for in this context, and why is CSRF a relevant concern?
OWASP (Open Web Application Security Project) is a non-profit foundation dedicated to improving the security of software. It provides resources, tools, and best practices for developers. The concern about CSRF (Cross-Site Request Forgery) highlights that even with input validation, Alice's PR doesn't protect against malicious users tricking the server into performing actions on behalf of an authenticated user – a common web vulnerability.
22 / 25
David: 'The API response is returning a 403 error. I suspect it's an issue with our rate limiting configuration, but the documentation doesn't explicitly mention anything about 'throttling.''
David is referring to 'throttling,' which is a crucial security mechanism to prevent abuse and denial-of-service attacks. Rate limiting, or throttling, restricts the number of requests originating from a single source within a specific timeframe. Understanding this terminology is key to troubleshooting API errors related to resource exhaustion. The other options relate to different aspects of securing an API – authentication verifies identity, authorization controls access rights, and tokenization protects data.
23 / 25
During a Slack discussion about securing a new microservice API, Ben writes: "I'm seeing a lot of mentions of 'API Keys'. I understand they're used for authentication, but are they really the best way to manage access? Shouldn't we be looking at OAuth 2.0?"
API Keys are a simple form of authentication that relies on storing a single key for each application or user. While they can be useful for basic authorization, they lack the granular control and delegation capabilities offered by OAuth 2.0. OAuth 2.0 allows users to grant third-party applications limited access to their resources without sharing their credentials directly, representing a more secure and flexible approach for microservice APIs, particularly when dealing with diverse client types.
24 / 25
During a standup update, Sarah says: 'We're implementing API authentication. We've been using JWTs for a while now, but the security team is pushing us to start using 'API Keys' for new integrations.' What is the primary difference in how API Keys and JWTs are typically used for securing APIs?
JWTs (JSON Web Tokens) are self-contained tokens that hold claims about a user or application. They're signed cryptographically to ensure integrity, but rely on the signing entity to be trusted. API Keys, conversely, are simple strings that identify an application and often require the server to verify requests based on this key—this approach is stateless, meaning no session state needs to be managed by the server. Therefore, JWTs contain more information and have a different trust model than API keys.
25 / 25
Alice is reviewing a pull request that implements new user registration. The PR includes the following comment: 'I'm seeing frequent attempts to register with common usernames and passwords. We should implement account lockout policies to mitigate brute-force attacks.' What does 'account lockout' refer to in this context, and why is it a relevant security measure?
The term 'account lockout' refers to a security mechanism that temporarily disables a user account after a specified number of unsuccessful login attempts. This prevents automated or human attackers from repeatedly trying to guess passwords through brute-force attacks. Rate limiting is related, but doesn't directly address the immediate threat of repeated failed logins. Account lockout policies are a fundamental defense against credential stuffing and other password cracking techniques.
What will I practice in "Security Abbreviations — IT Abbreviations Exercises"?
This is an IT Abbreviations exercise set. It walks through 25 scenario-based multiple-choice questions built around real usage of IT Abbreviations terminology that IT professionals encounter on the job.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to complete with no account, sign-up, or paywall.
How many questions are in this exercise?
This set contains 25 questions. Each one shows immediate feedback and a detailed explanation after you answer, so you learn the correct usage right away rather than waiting for a final score.
Do I need prior experience to complete this exercise?
No prior experience is required. Each question includes a full explanation covering the reasoning behind the correct answer, so the exercise itself teaches the IT Abbreviations vocabulary as you go.
Can I retry the exercise if I get questions wrong?
Yes — use the "Try again" button on the results screen to reset your answers and go through all the questions again. There is no limit on attempts.
Is my progress saved?
Your answers and score for the current session are tracked in the browser as you go. No account or login is needed, and there is nothing to install.
What if I don't understand a term used in a question?
Read the explanation shown after you answer each question — it breaks down the correct term in plain English with a real-world example. You can also check the site Glossary for quick definitions.
How is this different from reading a blog article on the topic?
Exercises like this one are interactive drills that test and reinforce specific vocabulary through multiple-choice questions, while blog articles explain concepts in prose. Practising here after reading builds active recall, not just passive recognition.
Where can I find more IT Abbreviations exercises?
See the IT Abbreviations exercises hub for the full set of related pages, or browse all exercise categories from the main Exercises index.
Can I use this exercise to prepare for a technical interview?
Yes — IT Abbreviations vocabulary comes up often in technical discussions and interviews. Pair this exercise with our dedicated Interview Preparation section for role-specific practice.