A mobile app uses a REST API to fetch user data. The API endpoint /api/users/{id} returns a JSON object with user details. A security tester discovers that by changing the id in the URL, they can view other users' data without authorization. What is the most likely vulnerability and the best fix?

Broken Object Level Authorization (BOLA) — implement server-side authorization checks to verify the authenticated user has permission to access the requested resource.

SQL injection — sanitize the id parameter by escaping single quotes before using it in a database query.

Insecure Direct Object Reference (IDOR) — use a random UUID instead of sequential IDs in the URL.

Cross-Site Request Forgery (CSRF) — add a CSRF token to the API requests.

A company's web application allows users to log in and view their account details. After a recent security review, the team wants to ensure that login credentials and session cookies are protected from interception while users are on public Wi-Fi. Which configuration should the team implement?

Enforce HTTPS on all pages, especially login and authenticated areas, and set the Secure flag on session cookies.

Implement a Content Security Policy (CSP) to block mixed content and insecure resource loads.

Use a VPN on the server side to encrypt all incoming and outgoing web traffic.

Use HTTP for all pages but set the HttpOnly flag on session cookies to prevent JavaScript access.

Why are cookies commonly used in web applications that rely on HTTP?

To permanently store large files on the user's computer

To encrypt all data transmitted between client and server

To maintain state and session information across stateless HTTP requests

To replace the need for a server-side database

What is the primary purpose of JavaScript in a web browser?

To define the visual appearance of web pages

To add interactivity and dynamic behavior to web pages

To structure the content of web pages

EC-CouncilSOC Essentials

Domain 1Objective 5

Web Application Fundamentals SCE Practice Questions (Page 5)

Part of the Computer Network and Security Fundamentals domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

8concepts

Questions 21–25

21application · medium
A mobile app uses a REST API to fetch user data. The API endpoint /api/users/{id} returns a JSON object with user details. A security tester discovers that by changing the id in the URL, they can view other users' data without authorization. What is the most likely vulnerability and the best fix?
Select an answer first
22application · medium
A company's web application allows users to log in and view their account details. After a recent security review, the team wants to ensure that login credentials and session cookies are protected from interception while users are on public Wi-Fi. Which configuration should the team implement?
Select an answer first
23foundation · easy
Why are cookies commonly used in web applications that rely on HTTP?
Select an answer first
24foundation · easy
What is the primary purpose of JavaScript in a web browser?
Select an answer first
25foundation · easy
In a RESTful API, which HTTP method is typically used to retrieve a resource without modifying it?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.