Trust boundaries and least privilege

A section of the "Security" topic. The questions check an understanding of practice, not memory of specific library APIs. After each answer comes a review: why the correct option is right, what is wrong with each incorrect one and which chapter to read.

Quiz difficulty Formats: several correct options, order of steps, one correct option

Quiz 7.4Trust boundaries and least privilegeStart Practice or a ranked attempt — you choose after clicking.
01

What we check

  1. What a trust boundary is
  2. A public API or your own model
  3. A pessimistic trust boundary
  4. Layers of constraints by resistance to bypass
  5. A check outside the context
  6. A false refusal
02

Where to read

How the quizzes and the fair ranking work

01Modes

Practice
No timer and no limit on the number of attempts. After every answer you see the correct option and an explanation. It does not affect the ranking. Available without signing in.
Ranked attempt
Time for each question is limited; correctness and explanations come only after the last question. The result goes into the ranking. Requires signing in with Telegram.
Diagnostic
32 questions, about 30 minutes: for each of the eight topics one easy, two medium and one hard question, new every time. It is a check for yourself: no sign-in and no ranking, and at the end — a knowledge map and a list of what is worth brushing up on. Topics and their sections count toward the ranking.

02Time and answers

  • The server keeps the time, not the browser: from 30 to 90 seconds per question depending on difficulty and format. Reloading the page does not reset the timer — the question comes back with the same time.
  • Questions come in different formats: pick one option, mark all correct ones, put steps in order, find the faulty line.
  • If time runs out, the question counts as skipped. A small allowance for network delay is built in.
  • You cannot go back to a previous question. Sending an answer again changes nothing — the first one counts.
  • Number keys select elements, Enter sends the answer. In practice you can open a hint.
  • The "Not sure about the answer" mark does not affect the points, but a correct answer with it goes into the review as a topic worth brushing up on.
  • You can change the site language at any time, even in the middle of an attempt: the question and the timer stay the same.

03Limits on ranked attempts

  • One ranked attempt per quiz per day. Days are counted in UTC — a new day starts at 00:00 UTC.
  • Switching to another tab or minimizing the window during a ranked question counts it as skipped.
  • Leaving the quiz early: the question on screen counts as skipped, and the questions you never reached count neither in the result nor in the ranking. You can retry this quiz the next day.
  • Closed the tab or got distracted — you can come back to a ranked attempt within an hour. After that it closes by itself, and the questions you never reached do not count either.

04How points are counted

  • Every question has its own difficulty rating, refined by the answers of all participants. A correct answer to a hard question gives more points, a mistake on an easy one costs more.
  • A skip and "time is up" count as mistakes. The "not sure" mark does not affect the points.
  • A partly correct answer has exactly one mistake: one correct option left unmarked or one extra option marked, two neighbouring steps swapped, two pairs mixed up, one card in the wrong bucket. It is worth half a point — in the attempt's result and in the ranking.
  • The result of an attempt is the correct answers plus half of the partly correct ones, out of the questions shown. An attempt with fewer than half of its questions shown gets no level.
  • How many points an answer gives also depends on how you answered before: every participant has a rating — overall and for each topic, 1000 at the start. It changes after every answer: the higher it is, the less an easy question gives and the more a mistake costs.
  • Each question — together with its paraphrases — gives points once: the first time you meet it in a ranked attempt. After that you have seen the correct answer, so on a repeat — in the same section or in the whole topic — it gives neither a plus nor a minus. A ranked attempt asks the questions you have not met yet first.
  • The result of a ranked attempt does not reveal the questions it did not reach: they stay new for the rating.
  • The ranking is the same for the Russian and English versions of the site: the questions and their difficulty are shared.
  • The "Best" table ranks by the rating itself: it lists those with at least 30 counted answers and a ranked attempt within the last 30 days. The "Week" and "Month" tables show how much the rating rose or fell over the calendar week or month.
  • Sometimes a control question is added to a ranked attempt. It does not count toward the score.

05A fair ranking

  • One Telegram account is one participant. When you sign in, we receive only your name and username.
  • An attempt clearly taken by a program rather than a person does not count toward the ranking.
  • Fast answers alone are not penalised: strong participants answer fast too.