A security analyst is investigating a potential privilege escalation. They find that a user with the 'viewer' role can access a function that is supposed to be restricted to 'editor' role. The application uses a single codebase and the authorization logic is scattered across multiple controllers. Which of the following is the most effective long-term solution?

Centralize authorization logic into a dedicated service or middleware that is applied consistently across all controllers.

Change the user's role to 'editor' to allow access.

Use a WAF to block requests from 'viewer' users to the restricted function.

Add a role check to the specific controller that was found vulnerable.

An application has an API endpoint /api/user/updateProfile that accepts a JSON payload. A tester notices that the payload includes a 'role' field. When the tester changes 'role' to 'admin', the server updates the user's role in the database. What is the most effective way to prevent this vertical privilege escalation?

Use a Web Application Firewall (WAF) to block requests with 'role' in the JSON payload.

Encrypt the JSON payload so that the client cannot modify the 'role' field.

Add a validation rule that rejects any request containing a 'role' field.

Remove the 'role' field from the client-side input and set the role only on the server based on the authenticated session.

A web application allows users to share documents with other users via a link. The link contains a document ID. A user discovers that by changing the document ID, they can access documents that were not shared with them. The application uses a 'shared_documents' table to track sharing permissions. Which of the following is the most effective fix?

Add a CAPTCHA to the document access page to slow down automated enumeration.

Use a random document ID that is difficult to guess.

Encrypt the document ID in the URL to prevent tampering.

Modify the document access query to join the 'shared_documents' table and verify that the current user has permission for the requested document ID.

A penetration test reveals that a web application allows a user to access another user's documents by changing a numeric document ID in the URL. The application also has an admin panel that is not linked in the UI but is accessible by guessing the path. The team must fix both issues with minimal code changes. Which approach addresses both vulnerabilities?

Add client-side JavaScript to hide the admin panel and validate document IDs.

Use unpredictable document IDs and rename the admin panel path.

Implement a centralized authorization filter that checks both object ownership and role-based access for all requests.

Require users to re-authenticate before accessing documents or the admin panel.

A web application allows users to view their own invoices by navigating to a URL like /invoice?id=12345. An attacker changes the id parameter to 12346 and views another user's invoice. Which type of vulnerability is this?

Cross-Site Request Forgery (CSRF)

Insecure Direct Object Reference (IDOR)

EC-CouncilWeb Application Hacking and Security

Domain 1Objective 1

Privilege Escalation WAHS Practice Questions (Page 3)

Part of the Broken Access Control domain, which makes up ~23% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~33–55 in this domain), expect 7–11 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

5concepts

Questions 11–15

11expert · hard
A security analyst is investigating a potential privilege escalation. They find that a user with the 'viewer' role can access a function that is supposed to be restricted to 'editor' role. The application uses a single codebase and the authorization logic is scattered across multiple controllers. Which of the following is the most effective long-term solution?
Select an answer first
12application · medium
An application has an API endpoint /api/user/updateProfile that accepts a JSON payload. A tester notices that the payload includes a 'role' field. When the tester changes 'role' to 'admin', the server updates the user's role in the database. What is the most effective way to prevent this vertical privilege escalation?
Select an answer first
13expert · hard
A web application allows users to share documents with other users via a link. The link contains a document ID. A user discovers that by changing the document ID, they can access documents that were not shared with them. The application uses a 'shared_documents' table to track sharing permissions. Which of the following is the most effective fix?
Select an answer first
14expert · hard
A penetration test reveals that a web application allows a user to access another user's documents by changing a numeric document ID in the URL. The application also has an admin panel that is not linked in the UI but is accessible by guessing the path. The team must fix both issues with minimal code changes. Which approach addresses both vulnerabilities?
Select an answer first
15foundation · easy
A web application allows users to view their own invoices by navigating to a URL like /invoice?id=12345. An attacker changes the id parameter to 12346 and views another user's invoice. Which type of vulnerability is this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.

Privilege Escalation WAHS Practice Questions (Page 3)

Questions 11–15

A web application allows users to view their own invoices by navigating to a URL like /invoice?id=12345. An attacker changes the id parameter to 12346 and views another user's invoice. Which type of vulnerability is this?

Keep studying — Broken Access Control