Common Threats on Authentication and Authorization CASEJAVA Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A Java application has an admin panel that is accessible at /admin. The application uses a filter that checks whether the user's role is 'admin' before allowing access to any URL starting with /admin. However, the application also serves static resources from /admin-resources, and the filter does not cover that path. An attacker discovers that they can access admin functionality by requesting /admin-resources/../admin. What is the most effective fix that also minimizes the risk of breaking legitimate functionality?

   • ADisable directory traversal in the web server configuration and rely on the existing filter.
   • BAdd a check in the admin servlet that verifies the user's role, but leave the filter as is.
   • CNormalize the request path in the filter before applying authorization checks, and ensure the filter covers all URL patterns that could map to admin functionality.
   • DRename the /admin-resources directory to /resources and update the filter to block any URL containing 'admin'.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A Java web application uses a 30-minute session timeout and stores the session ID in a cookie. A user reports that after logging in on a public computer, they closed the browser and left. Later, they noticed unauthorized purchases on their account. Which combination of weaknesses most likely contributed to this session hijacking?

   • AThe user's password was weak and easily guessed by the attacker.
   • BThe session cookie was not set with Secure and HttpOnly flags, and the session was not invalidated on browser close.
   • CThe session timeout was too short, causing the user to be logged out prematurely.
   • DThe application used URL rewriting to carry the session ID, which is more secure than cookies.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A financial services company deploys a Java application that uses role-based access control (RBAC). A security audit reveals that the application does not re-validate authorization on every request; instead, it caches the user's role in the session and trusts it indefinitely. An attacker who performs a privilege escalation by modifying a hidden form field gains admin access. What is the most significant business impact of this authorization flaw?

   • AThe application will become slower because the session cache is not cleared, causing performance degradation for all users.
   • BUnauthorized users could access and modify sensitive financial data, leading to data breaches, regulatory fines, and loss of customer trust.
   • CThe company will need to purchase additional hardware to handle the increased load from unauthorized admin sessions.
   • DThe application will be unable to log user activity because the session cache overwrites audit trails.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A Java-based e-commerce application stores user passwords as salted SHA-256 hashes. During a security review, the team discovers that the login endpoint has no rate limiting and that the application returns a generic 'invalid credentials' message for both unknown usernames and wrong passwords. Which combination of controls would most effectively reduce the risk of credential stuffing and brute-force attacks while also improving the security impact of the authentication flaw?

   • AImplement account lockout after a small number of failed attempts, add progressive rate limiting per IP and per account, and migrate password hashing to a slow, memory-hard algorithm such as bcrypt or Argon2.
   • BSwitch to a custom hash function that combines SHA-256 with a static salt, and increase the session timeout to reduce the number of login attempts needed.
   • CKeep the generic error message, but remove rate limiting to avoid blocking legitimate users, and rely on the salted SHA-256 hashes to protect stored passwords.
   • DAdd a CAPTCHA only after the first failed login attempt, and change the error message to 'user not found' for unknown usernames to help users understand the issue.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A Java application for a government agency allows citizens to file tax returns online. The application uses a username/password login and has no rate limiting on the login endpoint. A security audit finds that the application does not lock accounts after multiple failed attempts. An attacker uses a large list of usernames and common passwords to attempt login. What is the most significant business impact of this vulnerability?

   • AThe application will become unavailable due to the high volume of login attempts, causing a denial of service.
   • BThe application will be unable to log user activity because the login attempts overwrite the audit logs.
   • CThe agency will need to purchase additional servers to handle the login attempt traffic.
   • DUnauthorized access to citizens' tax records, leading to identity theft, financial fraud, and loss of public trust in the agency.
   Reveal Solution Discussion Select an answer first