I85PREP
⌘ K
OutSystems Security Specialist study materials
OutSystems Security Specialist study resources

OutSystems Security Specialist practice questions

One question at a time. Build your OutSystems Security Specialist understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Authentication

In OutSystems, which built-in authentication mechanism lets end users log in with credentials stored in the platform's own identity store rather than an external provider?

  1. OpenID Connect provider
  2. SAML 2.0 federation
  3. Users authentication Correct answer.
  4. Active Directory integration via LDAP

Explanation

Users authentication is the platform's native authentication method, where the end user's credentials and password hash are managed by the OutSystems Users entity. External identity protocols such as SAML 2.0 and OpenID Connect delegate verification to a separate identity provider, so they are not the built-in credential store.

Question 2Authentication

Which OutSystems role is automatically assigned to every end user of a module and should therefore never be used to gate sensitive screens?

  1. SuperUser
  2. Registered Correct answer.
  3. Administrator
  4. Anonymous

Explanation

The Registered role is granted to any end user who has successfully authenticated, so it expresses 'is logged in' rather than any specific permission. Sensitive functionality must be protected by custom roles that are explicitly granted, because Registered membership is effectively universal.

Question 3Authentication

What is the primary purpose of the Anonymous role in an OutSystems Reactive Web application?

  1. It stores the credentials of users who select a remember-me option.
  2. It encrypts session cookies sent to the browser.
  3. It elevates a logged-in user to administrative privileges.
  4. It grants unauthenticated visitors access to screens that are explicitly exposed to them. Correct answer.

Explanation

The Anonymous role represents visitors who have not authenticated, and screens granted to it are reachable without login. Developers use it deliberately for public areas such as landing pages or self-registration forms, understanding that no identity is verified.

Question 4Authentication

In OutSystems, where is the idle session timeout for end users of a Reactive Web application configured?

  1. In the screen's OnInitialize action
  2. In the Users entity record of each end user
  3. In the Service Center's database connection string
  4. In the module's application properties related to session timeout Correct answer.

Explanation

Session timeout is an application-level property that defines how long an idle session remains valid before the user must authenticate again. It is a deployment-wide security setting, not something stored per user record or set inside screen logic.

Question 5Authentication

Which OutSystems component is used to integrate an application with an external SAML 2.0 identity provider for single sign-on?

  1. The Timer component
  2. The Users entity's built-in password field
  3. The Chart widget
  4. The SAML 2.0 component from the OutSystems Forge Correct answer.

Explanation

SAML 2.0 federation in OutSystems is implemented through a Forge component that handles the protocol exchange with the identity provider. The platform does not natively speak SAML, so the component supplies the assertion processing and metadata handling.

Question 6Authentication

What does the 'Is Active' attribute on a User record control in OutSystems?

  1. Whether the account is permitted to authenticate and use the application Correct answer.
  2. Whether the user receives email notifications
  3. Whether the user's password has expired
  4. Whether the user is a member of the Administrator role

Explanation

Setting Is Active to false disables the account so authentication attempts are rejected, which is the standard way to revoke access without deleting the user. It is independent of password age, notification preferences, and role membership.

Question 7Authentication

Which built-in OutSystems action should be used inside server logic to verify a username and password pair against the platform's Users store?

  1. CheckUserRole
  2. GetUserId
  3. LoginPassword Correct answer.
  4. CreateUser

Explanation

LoginPassword validates the supplied username and password and, on success, establishes the authenticated session. The Login action instead accepts a UserId and does not itself verify a password. Role checks, identifier lookup and account creation do not perform this credential check.

Question 8Authentication

Why does OutSystems recommend against granting the Administrator role to screens that ordinary business users need to reach?

  1. Because the Administrator role is intended for platform and application administration and over-grants privileges Correct answer.
  2. Because the Administrator role prevents the use of SAML federation
  3. Because the Administrator role disables session timeout
  4. Because the Administrator role cannot be assigned to more than one user

Explanation

Role-based access control should follow least privilege, and the Administrator role carries broad administrative capability. Granting it to ordinary screens widens the attack surface for every user who needs that screen, so purpose-specific roles are preferred.

Question 9Authentication

A developer wants a public marketing page reachable without login while the rest of the module requires authentication. Which configuration achieves this?

  1. Set the session timeout to zero
  2. Grant every screen to the Administrator role
  3. Disable the Users authentication provider for the module
  4. Grant the screen to the Anonymous role and leave other screens granted to Registered plus specific roles Correct answer.

Explanation

Screen-level role grants determine reachability, so exposing only the marketing screen to Anonymous keeps the rest protected behind authentication. The other screens remain accessible only to authenticated users holding the required roles.

Question 10Authentication

An application must authenticate users against a corporate OpenID Connect provider. Which OutSystems capability supports this requirement?

  1. Adding the users to the Users entity with local passwords
  2. Creating a Timer that refreshes credentials hourly
  3. Using the Anonymous role for all screens
  4. Configuring an OpenID Connect provider in the module's authentication settings Correct answer.

Explanation

OutSystems supports OpenID Connect as a federated authentication provider configured at the module level, redirecting users to the external provider for verification. Local Users records with passwords would bypass the corporate identity provider entirely.

Question 11Authentication

After a successful Login action in a Reactive Web app, a developer needs to confirm whether the authenticated user holds a specific role before showing a menu item. Which approach is correct?

  1. Call CheckUserRole with the role name and branch on the result Correct answer.
  2. Call CreateUser and inspect the returned identifier
  3. Compare the session timeout value to the current time
  4. Read the Is Active attribute of the User record

Explanation

CheckUserRole returns whether the current user is a member of the named role, which is the supported way to branch UI or logic on authorization. The Is Active flag only indicates whether the account may authenticate at all.

Question 12Authentication

A security reviewer finds that a screen granted only to the Registered role displays a customer's billing details. What is the most accurate conclusion?

  1. The screen is protected by the Administrator role
  2. The screen is publicly accessible to unauthenticated visitors
  3. The data is safe because Registered users are trusted employees
  4. Any authenticated user can reach the screen, so authorization must be tightened with a specific role Correct answer.

Explanation

Registered is granted to every authenticated end user, so it provides authentication without meaningful authorization. Sensitive screens must be granted to a narrower role that reflects who is actually entitled to the data.

Question 13Authentication

Which statement best describes the relationship between authentication and authorization in an OutSystems module?

  1. Authorization establishes identity, while authentication assigns roles
  2. Both are performed exclusively by the Anonymous role
  3. Authentication and authorization are both controlled solely by the session timeout
  4. Authentication establishes who the user is, while authorization decides which screens and actions that identity may use Correct answer.

Explanation

Authentication verifies identity through a provider such as Users, SAML, or OpenID Connect, and authorization then evaluates role grants to permit or deny access. Keeping the two concerns distinct is what makes role-based access control auditable.

Question 14Authentication

A team wants to end a user's session programmatically when an administrator disables the account. Which built-in action should the logic invoke?

  1. CheckUserRole
  2. Logout Correct answer.
  3. Login
  4. GetUserId

Explanation

The Logout action terminates the current authenticated session, which is the supported way to force re-authentication. Disabling the account alone prevents future logins but does not by itself clear an existing session.

Question 15Authentication

What is the security consequence of storing a plain-text password in a custom attribute of the Users entity?

  1. The session timeout is reduced to protect the account
  2. SAML federation is automatically enabled
  3. The password becomes readable by anyone with data access, defeating the protection of the platform's hashed credential storage Correct answer.
  4. The platform automatically hashes the custom attribute at runtime

Explanation

The platform stores native credentials as a hash so that the original password is not recoverable, but a custom text attribute is stored as ordinary data. Anyone able to read that attribute, including through a data leak, obtains the password directly.

Question 16Authentication

Which configuration most directly reduces the risk of an unattended workstation being used to access a sensitive OutSystems application?

  1. Setting a short idle session timeout for the application Correct answer.
  2. Granting all screens to the Registered role
  3. Increasing the password minimum length
  4. Enabling the Anonymous role on the dashboard

Explanation

A short idle timeout limits how long an abandoned authenticated session stays usable, directly addressing the unattended-workstation scenario. Password length strengthens credentials at login but does nothing once a session is already open.

Question 17Authentication

A developer must expose a self-registration screen so new users can create accounts before they have credentials. Which role grant is required?

  1. Anonymous Correct answer.
  2. Administrator
  3. A custom role assigned only after approval
  4. Registered

Explanation

Self-registration is reached by visitors who have not yet authenticated, so the screen must be granted to Anonymous. A custom post-approval role cannot apply because the user does not yet hold any role.

Question 18Authentication

Why should role checks be enforced in server-side logic rather than only by hiding UI elements in a Reactive Web screen?

  1. Because hiding elements automatically logs the user out
  2. Because server-side logic runs faster than client-side rendering
  3. Because UI elements cannot be bound to role membership
  4. Because client-side visibility can be manipulated, while server actions execute the authoritative authorization decision Correct answer.

Explanation

Anything enforced only in the browser can be bypassed by a user who manipulates the client, so the server must re-evaluate authorization before performing sensitive operations. UI hiding improves usability but is not a security boundary.

Question 19Authentication

Which pair of OutSystems built-in actions is most appropriate for creating a new end user and then immediately authenticating that user?

  1. GetUserId followed by CheckUserRole
  2. CheckUserRole followed by Logout
  3. Login followed by CreateUser
  4. CreateUser followed by Login Correct answer.

Explanation

CreateUser provisions the account with a hashed password, and Login then verifies those credentials and starts the session. Reversing the order would attempt authentication before any credentials exist.

Question 20Authentication

An OutSystems application must support both local Users authentication for contractors and SAML 2.0 single sign-on for employees. Which statement is correct?

  1. Only one authentication provider can ever be configured per module
  2. Local authentication is disabled whenever SAML is configured
  3. SAML 2.0 replaces the Users entity entirely
  4. Multiple authentication providers can coexist, with each provider handling its own user population Correct answer.

Explanation

OutSystems allows several authentication providers to be configured for an application, so employees can federate through SAML while contractors authenticate locally. The platform resolves which provider applies to a given login attempt.

Question 21Authentication

A SAML 2.0 integration is failing intermittently because assertions are rejected. Which area should be investigated first?

  1. The number of records in the Users entity
  2. The chart color palette of the login screen
  3. Clock skew and assertion validity conditions between the identity provider and the service provider Correct answer.
  4. The session timeout of the Anonymous role

Explanation

SAML assertions carry NotBefore and NotOnOrAfter conditions, so a time difference between the identity provider and the service provider causes valid assertions to be rejected. Checking clock synchronization and assertion validity windows is the standard first diagnostic.

Question 22Authentication

A developer grants a sensitive back-office screen to both the Registered role and a custom 'BackOffice' role, expecting only BackOffice members to reach it. What actually happens?

  1. Only Administrator users reach the screen, because the conflict escalates privileges
  2. Only BackOffice members reach the screen, because the narrower role takes precedence
  3. Every authenticated user reaches the screen, because holding any granted role is sufficient Correct answer.
  4. No user reaches the screen, because conflicting grants cancel out

Explanation

Screen access is permitted when the user holds at least one of the granted roles, so adding Registered makes the screen reachable by all authenticated users. The narrower role grant provides no restriction once a broader role is also granted.

Question 23Authentication

Which practice best protects against credential-stuffing attacks on an OutSystems application that uses local Users authentication?

  1. Granting the Registered role to more screens
  2. Enforcing strong password policy and monitoring or throttling repeated failed logins Correct answer.
  3. Increasing the session timeout so users log in less often
  4. Storing passwords in a custom Users attribute for easier auditing

Explanation

Credential stuffing succeeds by replaying leaked credentials, so password strength rules and detection or throttling of repeated failures reduce the chance of a successful replay. Broadening role grants or lengthening sessions only increases the impact of a compromise.

Question 24Authentication

An auditor asks how to prove that only entitled users can invoke a sensitive server action exposed by a REST endpoint in an OutSystems module. Which control is the most direct?

  1. Rely on the session timeout being short
  2. Rely on the screen's conditional visibility of the button that calls the action
  3. Rely on the Anonymous role being disabled for the module
  4. Enforce role checks inside the action's server logic before performing the operation Correct answer.

Explanation

A REST endpoint can be called directly without any screen, so authorization must be re-verified in the server action itself. Conditional visibility and session settings do not constrain a direct invocation of the exposed endpoint.

Question 25Authentication

A team configures OpenID Connect and observes that users authenticate successfully at the provider but are not recognized inside the application. Which explanation is most plausible?

  1. The claim mapping between provider attributes and the platform's user identity is misconfigured Correct answer.
  2. The Anonymous role is granted to the login screen
  3. The session timeout is set too high
  4. The Users entity contains too many records

Explanation

Federated login succeeds at the provider, but the application must map the returned claims to a local identity to establish roles and profile. A misconfigured claim mapping leaves the user authenticated yet unresolved within the module.

Question 26Authentication

In an OutSystems Reactive Web app using the built-in Users authentication, which mechanism carries the authenticated identity from the browser to each subsequent server request?

  1. A query-string parameter appended to every screen URL
  2. A signed session cookie issued by the platform after a successful Login action Correct answer.
  3. A custom Users attribute that stores the last successful login timestamp
  4. A hidden input on each screen populated by the client-side Login flow

Explanation

The OutSystems platform issues a session cookie when the Login action succeeds, and that cookie identifies the authenticated user on each following request. The runtime validates it server-side before executing screen or server-action logic, which is why identity cannot be forged by manipulating screen data.

Question 27Authentication

A developer needs to know whether the currently logged-in user holds the 'Manager' role inside a server action. Which approach reflects OutSystems authentication practice?

  1. Query the session variable that stores the last screen the user visited
  2. Inspect the browser's cookie contents for a role list
  3. Read the Roles attribute of the User entity and compare it to a literal string
  4. Call the CheckRole built-in action with the role name and branch on its result Correct answer.

Explanation

CheckRole is the supported built-in action for evaluating role membership in server-side logic, and it returns a boolean the developer can branch on. It evaluates the roles granted to the current session user, so it stays consistent with how screen grants are enforced.

Question 28Authentication

Which OutSystems built-in action ends the current user's authenticated session on the server side?

  1. Logout Correct answer.
  2. CheckRole
  3. GetUserId
  4. Login

Explanation

The Logout action terminates the active session so the session cookie no longer grants access to authenticated screens. It is the counterpart of Login and is the supported way to end a session from application logic.

Question 29Authentication

A module exposes a screen granted to 'Anonymous' that lets visitors submit a contact request. Which statement about that grant is accurate?

  1. Anonymous access automatically creates a user record for each visitor
  2. Anonymous access disables the platform's CSRF protections for that screen
  3. Anonymous access still requires the visitor to hold the Registered role
  4. Anonymous access means the screen runs without an authenticated user, so it must not rely on session identity Correct answer.

Explanation

Granting a screen to the Anonymous role allows unauthenticated visitors to reach it, so any logic depending on a logged-in user will not have one available. Developers must therefore avoid assuming a session identity inside anonymous screens.

Question 30Authentication

An OutSystems app must let users sign in with a corporate identity provider using OIDC, while a small group of vendors continues to use local Users credentials. Which configuration best satisfies this requirement?

  1. Disable the Login action and rely on the identity provider to redirect users to the correct screen
  2. Configure the OIDC provider in the module and keep the built-in Users provider available for the vendor accounts Correct answer.
  3. Replace the Users provider entirely with OIDC and create vendor accounts at the identity provider
  4. Store the OIDC client secret in a client variable so the browser can complete the token exchange

Explanation

OutSystems supports configuring multiple authentication providers in the same module, so an external OIDC provider can coexist with the built-in Users provider. Each provider authenticates its own population, and the platform maps the resulting identity to a user record.

Question 31Authentication

During an OIDC login, users authenticate at the provider but return to the OutSystems app unrecognized. Which area should be investigated first?

  1. The value of the session timeout configured on the module
  2. The number of concurrent sessions allowed per user
  3. The screen's role grants for the Anonymous role
  4. The claim-to-user mapping, such as the claim used to match or create the local user record Correct answer.

Explanation

When authentication at the provider succeeds but the app does not recognize the user, the failure is usually in mapping the returned claims to a local user record. Verifying which claim is used for the username and whether auto-provisioning is allowed isolates the problem quickly.

Question 32Authentication

A team wants passwords for local Users accounts to meet a stricter policy than the platform default. Which OutSystems capability addresses this requirement?

  1. Storing a password strength score in a custom Users attribute
  2. Configuring the password policy settings available for the Users provider in the environment Correct answer.
  3. Adding a JavaScript validator on the registration screen only
  4. Relying on the browser's autocomplete to suggest strong passwords

Explanation

OutSystems exposes password policy configuration for the built-in Users provider, covering aspects such as minimum length and complexity. Enforcing the rule at the platform level ensures it applies regardless of which screen submits the password.

Question 33Authentication

A developer must protect a REST endpoint exposed by an OutSystems module so that only authenticated callers can invoke it. Which setting accomplishes this?

  1. Set the endpoint's authentication to require a valid authenticated session or supported token Correct answer.
  2. Grant the endpoint's method to the Anonymous role
  3. Enable the endpoint's caching so responses are reused
  4. Add a client action that hides the endpoint URL in the UI

Explanation

Exposed REST endpoints have an authentication setting that determines whether callers must present valid credentials. Requiring authentication rejects unauthenticated requests before the method logic runs, which is the correct control for a sensitive endpoint.

Question 34Authentication

An OutSystems app uses SAML 2.0 with a corporate identity provider. Which item must match between the service provider configuration and the identity provider metadata for assertions to be accepted?

  1. The theme applied to the login screens
  2. The module's session timeout value
  3. The assertion consumer service URL and the entity identifier registered for the app Correct answer.
  4. The number of roles defined in the module

Explanation

SAML assertions are addressed to a specific assertion consumer service URL and audience, so both the ACS URL and the entity identifier must agree with what the identity provider has registered. A mismatch causes the provider or the app to reject the assertion.

Question 35Authentication

A security review finds that a server action performing a refund is called from a screen granted to Registered users, but the action itself performs no role check. What is the primary risk?

  1. The action will fail because server actions cannot be called from screens
  2. The action will be exposed to anonymous visitors automatically
  3. Any authenticated user who can reach the action can trigger a refund regardless of intended entitlement Correct answer.
  4. The refund will be executed twice because of missing idempotency keys

Explanation

Screen grants control who can open a screen, not who may execute each server action it calls. Without an explicit role check inside the action, any user able to invoke it inherits the refund capability, which is a classic missing authorization control.

Question 36Authentication

Which practice most directly mitigates brute-force guessing against local Users accounts in an OutSystems application?

  1. Increasing the session timeout for authenticated users
  2. Displaying a generic message that does not reveal whether the username exists
  3. Enabling account lockout after a configured number of failed login attempts Correct answer.
  4. Requiring users to re-enter their password before sensitive screens

Explanation

Account lockout throttles repeated failed attempts and is the control aimed specifically at brute-force guessing of credentials. Complementary measures help, but lockout directly limits how many guesses an attacker can make.

Question 37Authentication

A developer configures an external identity provider but leaves the built-in Users provider enabled with default settings. Which consequence deserves attention during a security review?

  1. Local accounts remain a valid authentication path, so their lifecycle and password policy must still be governed Correct answer.
  2. Users will be forced to authenticate twice on every request
  3. Role grants stop working for externally authenticated users
  4. The external provider will refuse all logins while the Users provider is enabled

Explanation

Enabling an external provider does not remove the local Users provider, so local credentials remain an entry point that must be managed. Reviewers should confirm that local accounts are intentional, limited, and subject to an appropriate password policy.

Question 38Authentication

An auditor asks for evidence that a sensitive screen is reachable only by users holding a specific role. Which combination provides the strongest evidence in an OutSystems module?

  1. The presence of a client-side condition that disables the submit button
  2. The screen's role grants plus a server-side check in the actions it invokes, verified with test users lacking the role Correct answer.
  3. A comment in the screen's preparation stating that the role is required
  4. A screenshot of the menu entry hidden for unauthorized users

Explanation

Screen grants control access to the screen, while server-side checks in the invoked actions control what an authenticated user can execute. Testing with users who lack the role demonstrates both controls actually deny access, which is the evidence an auditor needs.

Question 39Authentication

A team must ensure that disabling a user account immediately prevents further access, even if the user has an active session. Which approach best meets this requirement?

  1. Deactivate the user record and terminate active sessions through the platform's session management Correct answer.
  2. Change the user's password so the current session becomes invalid
  3. Remove the user from all roles and wait for the session to expire naturally
  4. Deactivate the user record and rely on the next scheduled login attempt to fail

Explanation

Deactivating the record blocks future logins, but an existing session may remain valid until it ends. Terminating active sessions through the platform's session management closes that gap so the disabled account loses access immediately.

Question 40Authentication

A developer wants to record which authentication provider was used for each successful login. Which approach is consistent with OutSystems authentication design?

  1. Store the provider name in the password field of the Users entity
  2. Capture the provider information available after login and persist it in a dedicated entity linked to the user Correct answer.
  3. Read the provider name from a client variable set on the login screen
  4. Infer the provider from the browser's user-agent string

Explanation

Provider information becomes available through the platform's login context, and persisting it in a dedicated entity keeps the Users entity untouched. This supports auditing without compromising credential storage.

Question 41Access control

In OutSystems, which built-in role represents any authenticated end user for screen access checks?

  1. Service Center Manager
  2. System Administrator
  3. Registered Correct answer.
  4. Anonymous

Explanation

The Registered role represents authenticated end users for application access checks. A screen that permits Registered access but not Anonymous access requires the user to log in. This does not automatically grant administration rights in the Users application or access to Service Center, which use separate permissions.

Question 42Access control

A developer wants only users who are authenticated to reach a screen, but no specific role should be required. Which screen property configuration achieves this?

  1. Set the screen's Roles property to a role that every user holds, such as Registered
  2. Leave the screen's Roles property empty and set the application's default authentication to required Correct answer.
  3. Set the screen property Anonymous Access to Yes
  4. Configure the screen's Roles property with the Anonymous role

Explanation

When a screen has no explicit roles and the module or application requires authentication, any logged-in user can reach it while anonymous visitors cannot. This is the standard way to express 'authenticated but not role-restricted' access.

Question 43Access control

Which statement best describes the relationship between a role and a user in OutSystems?

  1. A role belongs to exactly one user
  2. Roles are defined per screen and cannot be reused
  3. A user can hold many roles, and a role can be held by many users Correct answer.
  4. A user holds exactly one role at a time

Explanation

Roles and users have a many-to-many relationship: a single end user can be granted several roles, and each role can be granted to many users. Roles are defined at the module level and can be checked by many screens and server actions.

Question 44Access control

What is the purpose of the Check Role entity action in OutSystems?

  1. To verify at runtime whether the current user holds a given role and return a Boolean result Correct answer.
  2. To list every role defined in the environment
  3. To remove a role from the current session
  4. To create a new role and grant it to the current user

Explanation

The Check Role action evaluates role membership for the current user at runtime and returns a Boolean, which lets logic branch on authorization. It does not modify grants or enumerate roles.

Question 45Access control

Which entity stores the association between end users and the roles granted to them in the OutSystems platform data model?

  1. Group
  2. Role
  3. User_Role Correct answer.
  4. User

Explanation

User_Role is the system entity that records which roles are assigned to which users. User holds account data and Role holds role definitions, while the association is materialized in User_Role.

Question 46Access control

A developer needs to protect a server action that returns payroll data so it can only be invoked by users holding the PayrollManager role. What is the correct OutSystems mechanism?

  1. Set the server action's Roles property to PayrollManager Correct answer.
  2. Set the module's Is Anonymous property to True
  3. Check the role only in the screen's Preparation and rely on that
  4. Add a client action that hides the button when the role is absent

Explanation

Server actions expose a Roles property that enforces role membership whenever the action is called, including from other server actions or exposed REST endpoints. Enforcing the check at the server action itself prevents bypass through direct invocation.

Question 47Access control

Which statement about the Anonymous role in OutSystems is accurate?

  1. It must be explicitly assigned by an administrator to each guest
  2. It represents unauthenticated visitors and is checked when no user is logged in Correct answer.
  3. It can be used to grant administrative access to the Service Center
  4. It is granted to every registered user by default

Explanation

The Anonymous role models visitors who have not authenticated, and screen or action role checks evaluate against it for such sessions. It is not a stored grant on user accounts and carries no privileges by itself.

Question 48Access control

A team exposes a REST API from a module and wants callers authenticated with the end user's credentials to be subject to the same role checks as the web screens. Which configuration supports this?

  1. Turn off authentication on the module and check the username in a client variable
  2. Set the REST endpoint's authentication to Anonymous and validate a shared secret in code
  3. Remove roles from the exposed actions and rely on IP allowlisting
  4. Enable the endpoint with end-user authentication so the caller's identity flows into role checks Correct answer.

Explanation

When an exposed integration uses end-user authentication, the caller's identity is established and OutSystems role checks on screens and actions apply to that identity. This keeps one authorization model across web and API access.

Question 49Access control

What does the Grant Role action accomplish in OutSystems?

  1. It checks whether the current user holds a role
  2. It creates a new role definition in the module
  3. It revokes all roles from the current session
  4. It assigns an existing role to a user account at runtime Correct answer.

Explanation

Grant Role assigns a role to a specified user, which is useful for self-service or workflow-driven provisioning. It changes persisted membership and therefore affects subsequent role checks for that user.

Question 50Access control

An application has a screen with Roles set to Manager. A user holding only the Registered role navigates to that screen's URL directly. What happens?

  1. The user is redirected to the login screen or an access-denied page Correct answer.
  2. The screen renders but its data queries return empty results
  3. The screen renders because the user is authenticated
  4. The user is granted the Manager role automatically

Explanation

Screen role checks are enforced on every request, so direct URL access by a user lacking the required role is blocked and the platform redirects to login or denial handling. Authentication alone does not satisfy a role requirement.