Common Threats on User Authentication and Authorization CASENET Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An e-commerce site has been experiencing a high volume of failed login attempts from a small set of IP addresses. The attempts use username/password pairs that appear to be from previous data breaches. The site currently has no rate limiting on the login endpoint. Which two measures should be implemented to directly address this attack?

   • AAdd a CAPTCHA to the login form and increase the password length requirement.
   • BImplement account lockout after a few failed attempts and enable multi-factor authentication for all users.
   • CDisable the login endpoint for the affected IP addresses and require users to reset their passwords.
   • DUse a Web Application Firewall to block the IP addresses and log all failed attempts.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A developer is writing code to fetch a user's profile. The current code uses the user-supplied 'userId' query parameter to retrieve the profile from the database. A security review flags this as an IDOR vulnerability. Which code change is the most effective remediation?

   • AUse the authenticated user's ID from the session instead of the query parameter
   • BEncrypt the userId parameter to hide it from the user
   • CValidate that the userId is a positive integer
   • DRemove the userId parameter and always return the first profile
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which mitigation strategy is most effective in preventing credential stuffing attacks?

   • AUsing longer passwords
   • BEncrypting database passwords
   • CEnforcing multi-factor authentication (MFA)
   • DDisabling session timeouts
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A web application has a role-based access control system. The 'Admin' role can access the admin panel, and the 'User' role cannot. A security test reveals that a 'User' can access the admin panel by directly entering the URL /admin. Which mitigation should be implemented?

   • AUse a random URL for the admin panel.
   • BEncrypt the admin panel URL.
   • CRemove the admin panel link from the user interface.
   • DAdd an authorization attribute to the admin controller that requires the 'Admin' role.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is implementing a new customer portal. The security team wants to protect against credential stuffing and brute-force attacks. Which combination of controls is most effective?

   • ACAPTCHA on every login attempt
   • BA strong password policy and a longer session timeout
   • CIP allowlisting for all users
   • DMulti-factor authentication, account lockout, and rate limiting on the login endpoint
   Reveal Solution Discussion Select an answer first