Common Threats on Authentication and Authorization CASEJAVA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A Java application uses a microservices architecture where each service has its own authorization logic. The API gateway authenticates users and passes a JWT to downstream services. A security audit finds that one downstream service trusts the 'role' claim in the JWT without verifying the token's signature. An attacker who can obtain a valid JWT for a low-privileged user can modify the role claim to 'admin' and access admin endpoints in that service. What is the most effective fix that maintains the current architecture?

   • AHave the API gateway call a separate authorization service for every request and pass the result to downstream services.
   • BUse a shared secret between the API gateway and downstream services to encrypt the JWT payload.
   • CConfigure the downstream service to verify the JWT signature using the same public key as the API gateway, and validate the role claim against an authorization policy.
   • DRemove the role claim from the JWT and have each service query the user database for roles on every request.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which attack is characterized by an attacker using a large list of username/password pairs obtained from previous data breaches to try against a web application, relying on the fact that users often reuse passwords across different services?

   • ACredential stuffing
   • BPhishing
   • CBrute force attack
   • DSession hijacking
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A Java application uses a role-based access control system where users can have multiple roles. The application checks the user's role in a filter and allows access to certain pages. A security audit finds that the filter only checks the first role in the list, and an attacker can add a second role to their account via a self-service API. What is the most likely authorization threat?

   • ACredential stuffing, because the attacker uses stolen credentials to log in with multiple roles.
   • BSession hijacking, because the attacker can steal another user's session to gain their roles.
   • CForced browsing, because the attacker can directly navigate to restricted URLs without authentication.
   • DPrivilege escalation, because the attacker can add a high-privileged role and the filter may not check all roles, allowing access to restricted pages.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   An authorization flaw allows any authenticated user to view other users' personal data, including health records. Which of the following is a potential business impact of this vulnerability?

   • ALegal liability and loss of customer trust
   • BImproved user experience
   • CIncreased system performance
   • DReduced storage costs
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A successful authentication flaw allows an attacker to impersonate a legitimate user and perform financial transactions on their behalf. What is the most direct business impact of this vulnerability?

   • AFinancial loss and regulatory penalties
   • BMinor inconvenience with no lasting effect
   • CIncreased server load
   • DLoss of source code
   Reveal Solution Discussion Select an answer first