Common Threats on Authentication and Authorization CASEJAVA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A Java REST API exposes an endpoint GET /api/orders/{orderId} that returns order details. A penetration test reveals that an authenticated user can retrieve another user's order by changing the orderId in the URL. The application uses JWT-based authentication and does not check whether the order belongs to the current user. Which remediation is the most appropriate?

   • AAdd an authorization check in the service layer that verifies the order's owner matches the authenticated user's ID from the JWT.
   • BUse a random UUID for orderId instead of a sequential number.
   • CRequire the user to re-authenticate before each API call.
   • DEncrypt the orderId parameter in the URL so it cannot be guessed.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A Java application has an API endpoint that allows users to update their own profile. The endpoint accepts a 'userId' parameter in the request body. A security tester finds that by changing the 'userId' to another user's ID, they can update that user's profile. The application uses JWT for authentication. Which is the most effective fix?

   • AUse a random UUID for 'userId' to make it harder to guess.
   • BIgnore the 'userId' parameter and use the authenticated user's ID from the JWT for all profile updates.
   • CValidate that the 'userId' parameter is a number and within a valid range.
   • DEncrypt the 'userId' parameter to prevent tampering.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A Java application allows users to reset their passwords via a link sent to their email. The reset link contains a token that is valid for 24 hours and is stored in the database. A security review finds that the token is generated using a predictable random number generator and is not invalidated after use. Which of the following is the most likely attack that could succeed?

   • AAn attacker could predict or brute-force the token, reset another user's password, and gain unauthorized access.
   • BAn attacker could reuse the same reset link multiple times to reset the password repeatedly.
   • CAn attacker could intercept the reset link over HTTP if the user is on a public network.
   • DAn attacker could modify the reset link to change the user ID and reset a different user's password.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A Java application has a role hierarchy where a 'manager' role inherits permissions from 'employee'. A bug in the authorization framework allows a user with the 'employee' role to escalate to 'manager' by manipulating a request parameter. Which type of authorization threat is this, and what is the most effective mitigation?

   • ASession fixation; regenerate the session ID after role change.
   • BForced browsing; hide the manager menu from employees.
   • CIDOR; use random tokens for role identifiers.
   • DPrivilege escalation; enforce authorization on the server side using the authenticated principal's roles, not client-supplied parameters.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A Java application uses a two-factor authentication (2FA) system that sends a one-time passcode (OTP) via SMS. The application has a rate limit of 5 attempts per phone number per hour. A security review finds that the OTP is only 4 digits and is not hashed in the database. An attacker who knows the victim's phone number and has obtained a valid session ID can attempt to brute-force the OTP. What is the most effective mitigation that also maintains usability?

   • AIncrease the OTP length to 8 digits, hash the OTP in the database, and implement a per-account lockout after a small number of failed attempts.
   • BUse a push notification instead of SMS, but keep the same 4-digit OTP and rate limit.
   • CStore the OTP in plain text in the database and rely on the rate limit to prevent brute-force.
   • DKeep the 4-digit OTP but increase the rate limit to 10 attempts per hour to reduce user frustration.
   Reveal Solution Discussion Select an answer first