Provyn Prep · Security Fundamentals competency
Auth & cryptography in the Security Fundamentals assessment
Auth & cryptography is one of the areas a Provyn Security Fundamentals credential scores separately, so a recruiter can see it on its own rather than averaged into one number. This guide explains what it covers, how it is tested and what to practice.
What it covers
Authentication and sessions, password storage, tokens, TLS and choosing the right cryptographic primitive.
Topics in the practice set for this area
- password hashing
- transport security
- auth tokens
- cryptography
- session management
- auth
- constant-time compare
How it is tested
In the timed assessment, questions in this area use these formats: matching, multiple choice, short answer. Each attempt draws its own set of questions, and this area gets its own sub-score on the credential when the attempt includes enough questions from it. The assessment questions themselves are never published; the practice set below is written separately for study.
What to practice
- Explain why passwords are hashed with a slow, salted function rather than encrypted.
- Compare session cookies and bearer tokens and where each can leak.
- Know the difference between hashing, encryption and signing, with one use for each.
Try a practice question
From the free practice set (10 questions in this area). Answers and explanations are in the practice set.
- Hashing passwords: pick the best modern algorithm.
- TLS protects:
- JWT alg=none should be:
Practice before the real thing
Both are free and use practice questions only, never questions from the real assessment.
More Security Fundamentals study guides
Last reviewed 2026-10-06.