All quizzesHard
Advanced Security Decisions — Series 3
Preview — 3 of 10 questions
A route uses Security(get_user, scopes=["read"]) while another route uses the same dependency with no scopes. What should the no-scope route still require?
AA valid authenticated user if get_user is mandatory
BEvery scope defined in the application
CNo token at all because its scope list is empty
DThe read scope from the unrelated route
A parent security dependency declares write, and its nested child declares audit. Which grants must a validator at the inner node require?
AOnly audit because it is closer
BBoth write and audit along that dependency path
COnly write because it is at the parent
DNo scopes until OpenAPI is opened
A token has scope="read" but its signature check failed. Should matching the route's required read scope authorize it?
AYes, because the scope text matches
BYes, if /docs shows the scope
CNo, unverified claims cannot grant permissions
DOnly when the route is synchronous
Sign up free to play
Answer all 10 questions (7 more), see explanations for every answer, and track your score.