A security consultant is reviewing a web application that uses a GraphQL API. The consultant suspects IDOR because the API allows queries like 'user(id: 123) { profile }'. Which testing approach is most effective for identifying IDOR in this GraphQL API?

Use a SQL injection payload in the GraphQL query.

Run a standard web vulnerability scanner against the GraphQL endpoint.

Use a GraphQL introspection query to discover all available queries and then test each query with different object IDs.

Test only the REST endpoints because GraphQL is secure by default.

What is the primary cause of an Insecure Direct Object Reference (IDOR) vulnerability?

The application uses weak encryption algorithms to protect object identifiers in transit.

The application generates object identifiers that are too long and difficult to manage.

The application relies on user-supplied object identifiers without verifying the user's authorization to access the referenced object.

The application stores object identifiers in client-side cookies without hashing them.

Which of the following is a common input vector where an IDOR vulnerability might be found?

HTTP cookies that store session tokens

HTTP headers such as User-Agent

HTTP status codes returned by the server

Query string parameters like ?file=report.pdf

A QA engineer at a healthcare portal is testing the appointment-rescheduling feature. The URL is https://portal.example.com/reschedule?appointmentId=48291. When the engineer changes the ID to 48290, the response returns the full medical history of another patient. Which action best describes the vulnerability being exploited?

Testing for cross-site request forgery by modifying the appointment ID parameter

Performing a SQL injection attack by altering the numeric ID in the URL

Manipulating a direct object reference to access another user's resource without an authorization check

Exploiting a broken session management flaw that allows session fixation

A developer is reviewing code for a file download feature. The code retrieves the file based on a 'file_id' parameter from the URL without checking if the user owns the file. Which of the following is the most direct indicator of an IDOR vulnerability?

The application logs all file downloads.

The application uses a Content Delivery Network (CDN) to serve files.

The file_id parameter is directly used in a database query without an ownership check.

The file_id is encrypted in the URL.

EC-CouncilWeb Application Hacking and Security

Domain 1Objective 2

Insecure Direct Object References (IDOR) WAHS Practice Questions (Page 1)

Part of the Broken Access Control domain, which makes up ~23% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~33–55 in this domain), expect 7–11 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 1–5

1expert · hard
A security consultant is reviewing a web application that uses a GraphQL API. The consultant suspects IDOR because the API allows queries like 'user(id: 123) { profile }'. Which testing approach is most effective for identifying IDOR in this GraphQL API?
Select an answer first
2foundation · easy
What is the primary cause of an Insecure Direct Object Reference (IDOR) vulnerability?
Select an answer first
3foundation · easy
Which of the following is a common input vector where an IDOR vulnerability might be found?
Select an answer first
4application · medium
A QA engineer at a healthcare portal is testing the appointment-rescheduling feature. The URL is https://portal.example.com/reschedule?appointmentId=48291. When the engineer changes the ID to 48290, the response returns the full medical history of another patient. Which action best describes the vulnerability being exploited?
Select an answer first
5application · medium
A developer is reviewing code for a file download feature. The code retrieves the file based on a 'file_id' parameter from the URL without checking if the user owns the file. Which of the following is the most direct indicator of an IDOR vulnerability?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.