Common Threats on User Authentication and Authorization CASENET Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A large enterprise application uses a centralized identity provider (IdP) and issues JWTs to clients. The IdP has a bug that occasionally issues tokens with the 'Admin' role to non-admin users. The application team cannot immediately fix the IdP bug. They need to mitigate the risk of privilege escalation while the bug is being fixed. Which approach is most effective?

   • AShorten the token expiration time to 5 minutes.
   • BUse a blacklist to revoke tokens issued during the bug period.
   • CChange the application to ignore the role claim and use a different claim.
   • DAdd an authorization policy that validates the user's role against a database on every request.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is migrating its on-premises web application to Azure. The application currently uses forms-based authentication with a session cookie. The security team wants to reduce the risk of session hijacking and also support single sign-on with Microsoft 365. Which authentication approach should they adopt?

   • AUse Azure AD with OpenID Connect and enforce conditional access policies
   • BUse basic authentication over HTTPS
   • CUse a custom token stored in local storage
   • DKeep forms-based authentication but add a longer session timeout
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A multi-tenant SaaS application allows users to upload files. The application uses a shared storage bucket and generates file URLs that include the tenant ID and file name. A security researcher discovers that by changing the tenant ID in the URL, they can access files belonging to another tenant. The application uses a single shared storage account. What is the most effective mitigation?

   • AEncrypt the file URLs with a server-side secret.
   • BGenerate random file names using GUIDs.
   • CUse a separate storage container for each tenant.
   • DImplement an authorization check that verifies the logged-in user belongs to the tenant that owns the file before serving the file.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A healthcare portal is experiencing a brute-force attack on its admin login page. The security team wants to block automated attempts while minimizing impact on legitimate users. They also need to comply with a policy that prohibits permanent account lockouts. Which approach best balances security and usability?

   • ADisable the login page temporarily until the attack stops
   • BLock the account permanently after five failed attempts
   • CImplement progressive delays and CAPTCHA after a threshold of failed attempts, with temporary lockout for a short duration
   • DOnly rely on IP-based blocking after multiple failures
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company's web application uses cookie-based authentication. The security team wants to reduce the risk of session hijacking via cross-site scripting (XSS). Which configuration should be applied to the session cookie?

   • ASet the HttpOnly flag on the session cookie.
   • BSet the Secure flag on the session cookie.
   • CSet the cookie domain to the application's domain only.
   • DSet the SameSite attribute to Strict.
   Reveal Solution Discussion Select an answer first