Common Threats on Authentication and Authorization CASEJAVA Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A Java application for an online banking platform uses a single sign-on (SSO) system. The SSO system issues a token that is valid for 8 hours. The application does not validate the token's audience and does not check if the user's session has been revoked. An attacker who steals a valid token from a user can use it for up to 8 hours, even if the user changes their password. What is the most significant business impact of this flaw?

   • AThe user will be locked out of their account because the token is not revoked after a password change.
   • BThe application will be unable to log the user's activity, making it difficult to detect fraudulent transactions.
   • CThe application will experience performance degradation because the token is not validated on every request.
   • DAn attacker can maintain unauthorized access to the user's financial accounts for the token's validity period, leading to fraudulent transactions and financial loss.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A Java web application uses a single sign-on (SSO) system with SAML. A security audit finds that the application does not validate the SAML response's signature correctly, allowing an attacker to forge a response and log in as any user. The development team is considering two fixes: (1) implement proper signature validation, or (2) add an additional factor to the application login. Which fix is more appropriate, and why?

   • AAdd an additional factor because it provides defense in depth and is easier to implement.
   • BBoth fixes are equally effective because they address different layers.
   • CNeither fix is needed because SAML is inherently secure.
   • DFix the SAML signature validation because the root cause is a broken authentication mechanism that cannot be compensated by an additional factor.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A Java application allows users to upload profile pictures. A security review finds that the application does not validate the file type and stores uploads in a web-accessible directory. An attacker uploads a JSP file that executes server-side code. Which type of attack is this, and which control would have prevented it?

   • ASQL injection; use prepared statements for file metadata.
   • BCross-site scripting; encode the file name before displaying it.
   • CSession hijacking; rotate session IDs after file upload.
   • DArbitrary file upload leading to remote code execution; validate file content and store uploads outside the web root.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A Java application has an admin panel that is only accessible to users with the 'admin' role. The application uses a filter to check the role, but the filter is only applied to the /admin path, not to /admin/../admin or other path variations. An attacker discovers that they can access the admin panel by requesting /admin/../admin. What is the most likely authorization threat?

   • AForced browsing, because the attacker is bypassing the authorization filter by using path traversal to access a restricted resource.
   • BIDOR, because the attacker is accessing an object by its ID.
   • CPrivilege escalation, because the attacker is changing their role to admin.
   • DSession hijacking, because the attacker is stealing an admin's session.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A Java application has an authorization flaw that allows a low-privileged user to access a high-privileged function by sending a crafted request. The application is deployed in a multi-tenant environment where each tenant has its own data. The flaw is discovered during a penetration test. The business wants to fix it quickly, but the development team is concerned about breaking existing functionality. Which approach best balances security and business continuity?

   • ADisable the high-privileged function until a full rewrite is completed.
   • BImplement server-side authorization checks in a centralized filter/interceptor that applies to all endpoints, with a fallback to deny by default.
   • CUse a random token for the high-privileged function to make it unguessable.
   • DAdd client-side checks to hide the high-privileged function from low-privileged users.
   Reveal Solution Discussion Select an answer first