A web application uses cookie-based sessions. A security analyst notices that after a user logs in, the session ID remains the same as before login. An attacker who can predict or obtain the pre-login session ID could impersonate the user. Which mitigation should be implemented?

Regenerate the session ID upon successful authentication.

Implement a session timeout of 30 minutes.

Set the Secure flag on the session cookie.

Use HttpOnly attribute on the session cookie.

A tester is assessing a web application and finds that a regular user can access an admin-only page by changing the 'role' parameter in the URL from 'user' to 'admin'. What is the most likely vulnerability and the best fix?

Forced browsing; hide the admin link

Privilege escalation; do not trust client-supplied role parameters; derive roles from the server-side session

Session fixation; regenerate the session ID

IDOR; validate the user ID in the session

Which general mitigation strategy helps prevent both IDOR and forced browsing vulnerabilities?

Increasing session timeout duration

Implementing server-side authorization checks for every request

Using client-side JavaScript to hide links

An e-commerce application has a role-based access control (RBAC) system. A customer discovers that by manually navigating to /admin/dashboard, they can view internal sales reports. The application's menu hides the admin link from non-admins, but the server does not enforce the role check on the page itself. Which authorization threat is this, and what is the primary mitigation?

Forced browsing; enforce authorization checks on every server-side endpoint

Session hijacking; regenerate the session ID

Privilege escalation; assign the customer to a lower role

IDOR; validate the user ID in the session

A developer is implementing authorization for a REST API. The API uses JWT tokens for authentication. The developer needs to ensure that a user can only access resources belonging to their own tenant. Which approach is the most secure?

Include the tenant ID in the JWT claims and enforce tenant matching on every API request

Use a global API key for all tenants

Allow the client to pass the tenant ID as a query parameter

EC-CouncilCertified Application Security Engineer (.NET)

Domain 4Objective 1

Common Threats on User Authentication and Authorization CASENET Practice Questions (Page 6)

Part of the Secure Coding: Authentication and Authorization domain, which makes up ~7% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

4concepts

Questions 26–30

26application · medium
A web application uses cookie-based sessions. A security analyst notices that after a user logs in, the session ID remains the same as before login. An attacker who can predict or obtain the pre-login session ID could impersonate the user. Which mitigation should be implemented?
Select an answer first
27application · medium
A tester is assessing a web application and finds that a regular user can access an admin-only page by changing the 'role' parameter in the URL from 'user' to 'admin'. What is the most likely vulnerability and the best fix?
Select an answer first
28foundation · easy
Which general mitigation strategy helps prevent both IDOR and forced browsing vulnerabilities?
Select an answer first
29application · medium
An e-commerce application has a role-based access control (RBAC) system. A customer discovers that by manually navigating to /admin/dashboard, they can view internal sales reports. The application's menu hides the admin link from non-admins, but the server does not enforce the role check on the page itself. Which authorization threat is this, and what is the primary mitigation?
Select an answer first
30expert · hard
A developer is implementing authorization for a REST API. The API uses JWT tokens for authentication. The developer needs to ensure that a user can only access resources belonging to their own tenant. Which approach is the most secure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.