An e-commerce application allows users to view their orders via /order?id=12345. A security tester finds that changing the id to another number reveals another customer's order details, including address and payment card last four digits. What is the most significant security impact of this flaw?

Unauthorized disclosure of sensitive personal and financial information

Privilege escalation to administrator role

Malware infection of the user's browser

Denial of service to the order system

A penetration tester is testing an API that uses GUIDs for object references. The tester suspects IDOR but finds that guessing GUIDs is impractical. What is the best next step to test for IDOR?

Attempt to brute-force all possible GUIDs.

Stop testing because GUIDs are secure.

Use a SQL injection payload in the GUID parameter.

Look for other endpoints or parameters that use sequential or predictable IDs, such as numeric user IDs or order numbers.

A real-world IDOR incident involved a healthcare portal where patients could access other patients' medical records by changing a numeric ID in the URL. What common pattern does this illustrate?

Weak encryption of medical records in the database.

Poor session management allowing session hijacking.

Sequential object identifiers combined with missing authorization checks.

Misconfigured firewall rules exposing the database.

A healthcare portal exposes patient records via /patient/record?id=123. A security review finds that any authenticated user can access any record by changing the id. The development team must fix this quickly. Which mitigation is most effective?

Encrypt the ID parameter in the URL.

Implement an access control check on the server that verifies the logged-in user is authorized to view the requested record.

Use a random UUID for each record instead of sequential numbers.

Add a client-side JavaScript check to disable the ID field.

EC-CouncilWeb Application Hacking and Security

Domain 1Objective 2

Insecure Direct Object References (IDOR) WAHS Practice Questions (Page 9)

Part of the Broken Access Control domain, which makes up ~23% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~33–55 in this domain), expect 7–11 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 41–45

41application · medium
An e-commerce application allows users to view their orders via /order?id=12345. A security tester finds that changing the id to another number reveals another customer's order details, including address and payment card last four digits. What is the most significant security impact of this flaw?
Select an answer first
42application · medium
A penetration tester is testing an API that uses GUIDs for object references. The tester suspects IDOR but finds that guessing GUIDs is impractical. What is the best next step to test for IDOR?
Select an answer first
43foundation · easy
A real-world IDOR incident involved a healthcare portal where patients could access other patients' medical records by changing a numeric ID in the URL. What common pattern does this illustrate?
Select an answer first
44application · medium
A healthcare portal exposes patient records via /patient/record?id=123. A security review finds that any authenticated user can access any record by changing the id. The development team must fix this quickly. Which mitigation is most effective?
Select an answer first
45foundation · easy
What is a potential security impact of an IDOR vulnerability that allows a low-privileged user to access an administrative function?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.