Common Threats on User Authentication and Authorization CASENET Practice Questions (Page 8)

Questions 36–37

1. 36application · medium

   A developer is implementing an authorization check for a banking application. The requirement is that a user can only view their own transactions. Which approach is the most secure?

   • AHide the transaction links from users who do not own them
   • BUse a random transaction ID that is hard to guess
   • CCheck that the transaction's account ID matches the user's account ID from the session
   • DRely on the client-side JavaScript to validate access
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A developer is designing an authorization model for a document management system. Users can be in multiple roles, and documents can be shared with specific users. The requirement is that a user should be able to access a document if they have the 'Reader' role OR if the document is explicitly shared with them. Which authorization approach is most appropriate?

   • AImplement a custom authorization check that evaluates both role membership and document-level permissions
   • BUse only document-level permissions and ignore roles
   • CUse only role-based access control and ignore document sharing
   • DUse a single global role for all users
   Reveal Solution Discussion Select an answer first