Common Threats on Authentication and Authorization CASEJAVA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A healthcare application allows patients to view their medical records online. The application uses a Java backend and has a role-based access control system. A security audit finds that the application does not enforce authorization on the API endpoints that return medical records; it only hides the links in the UI. What is the most likely business impact of this flaw?

   • AThe application will become slower because the UI hides links but the backend still processes all requests.
   • BPatients could access other patients' medical records by directly calling the API endpoints, leading to privacy breaches and HIPAA violations.
   • CThe application will require more storage because the API returns full records instead of summaries.
   • DThe application will be unable to log user activity because the API endpoints are not protected.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A Java web application uses a session cookie that is not marked HttpOnly. A developer argues that since the application uses Content Security Policy (CSP) to block inline scripts, the risk of XSS stealing the cookie is low. The security team wants to add the HttpOnly flag. Which consideration is most important in this decision?

   • AHttpOnly would break the application's JavaScript functionality.
   • BHttpOnly is unnecessary if CSP is properly configured.
   • CCSP reduces but does not eliminate XSS risk; HttpOnly provides a defense-in-depth layer that protects the cookie even if an XSS vulnerability is found.
   • DCSP is more important than HttpOnly because it prevents the XSS attack entirely.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A Java application exposes a REST API for a mobile app. The API uses API keys passed in the Authorization header. A security review finds that the API keys are long-lived and stored in the mobile app's source code. An attacker extracts the key and uses it to access other users' data by guessing user IDs. Which two vulnerabilities are present?

   • AInsecure storage of API keys and IDOR due to missing object-level authorization.
   • BForced browsing and privilege escalation.
   • CBrute force and credential stuffing.
   • DSession fixation and cross-site scripting.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A Java application allows users to log in with either a username/password or via OAuth2 with a social identity provider. The application stores the OAuth2 access token in the session and uses it to call the provider's API. A security review finds that the application does not validate the 'aud' (audience) claim in the ID token. What is the most likely threat this flaw exposes?

   • AThe access token will expire sooner than expected, reducing the session length for users.
   • BAn attacker could present an ID token issued for a different application, and the application might accept it as a valid authentication for its own users.
   • CThe application will be unable to refresh the access token, causing users to be logged out frequently.
   • DThe application will store the token insecurely, leading to token theft via XSS.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A Java web application uses a session management mechanism that generates session IDs using a predictable pattern. An attacker can predict another user's session ID and hijack the session. The application also does not invalidate sessions on logout. Which two controls are most important to mitigate these issues?

   • AUse a cryptographically secure random number generator for session IDs and invalidate sessions on logout.
   • BUse a longer session ID and store it in a database.
   • CUse HTTPS and set the Secure flag on the session cookie.
   • DUse a shorter session timeout and require re-authentication for sensitive actions.
   Reveal Solution Discussion Select an answer first