What is the difference between authentication and authorization?
What they are really testing: A screen-out. People blur these constantly. They want the clean distinction (who you are vs what you can do) and the order they happen in.
A real interview question
What is the difference between authentication and authorization?
What most people say
drag me
“Authentication is logging in and authorization is permissions, they are basically the same thing.”
"Basically the same thing" is the red flag. They are distinct steps with distinct failure modes (401 vs 403), and conflating them leads to real access-control bugs.
The follow-ups they ask next
A user is logged in but gets a 403 on an endpoint. AuthN or authZ problem?
Authorization: they are authenticated (the system knows them) but lack permission for that action. A 401 would mean authentication itself failed.
Where does MFA fit, authentication or authorization?
Authentication: it adds a second factor to more strongly prove identity. It says nothing about what you are then permitted to do.
What the interviewer is listening for
- Clean "who you are" vs "what you can do"
- Knows authN precedes authZ
- Maps 401 vs 403
What sinks the answer
- "Basically the same thing"
- Gets the order backwards
- Cannot distinguish 401 from 403
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“Authentication is [proving who you are: password, token, cert, plus MFA]. Authorization is [what you are allowed to do: roles, policies, scopes]. You [authenticate first, then authorize]. They fail differently: [401 = authN failed, do not know you; 403 = authZ failed, known but not allowed].”
Keep going with security
Foundation
Explain the shared responsibility model. Where does the cloud provider's job end and yours begin?
Foundation
What is the CIA triad, and why is it a useful way to think about security?
Junior
What is the difference between encryption at rest and in transit, and why do you need both?
Junior
How should an application running in the cloud get credentials to call other cloud services? Why avoid long-lived access keys?
Junior
What is the difference between symmetric and asymmetric encryption, and where is each used?
Mid
What does it mean to "shift security left", and how would you build security into a CI/CD pipeline?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free