A content management system (CMS) has an admin panel at /admin. A standard user discovers that by directly navigating to /admin/users, they can view the user list without any error. The application relies on hiding the admin link from non-admin users. What is the most effective mitigation?

Add a JavaScript check that redirects non-admin users away from the admin panel.

Remove the admin link from the navigation menu for non-admin users.

Use a more complex URL for the admin panel, such as /admin-9f3k2p.

Implement a server-side authorization filter that checks the user's role before allowing access to any /admin/* endpoint.

Which of the following is a common technique used to exploit vertical privilege escalation?

Performing a phishing attack to steal user credentials.

Using a directory traversal attack to read sensitive files.

Modifying HTTP requests to change role or permission parameters.

Changing the session ID in a cookie to impersonate another user.

A web application has a 'user' role and an 'admin' role. A user discovers that by adding a 'role=admin' parameter to the profile update request, they can change their role. What is the most effective mitigation?

Use a hidden field to store the current role and update it on the server.

Ignore client-supplied role parameters and derive the role from the server-side session.

Encrypt the role parameter in the request.

Validate that the role parameter is one of the allowed values.

A large web application has multiple user roles (user, editor, admin) and uses a centralized authorization library. A recent penetration test found that some endpoints, such as /api/v1/reports, do not check the user's role and allow any authenticated user to access admin reports. The development team wants to fix this without breaking existing functionality. Which of the following approaches is the most secure and least likely to introduce regressions?

Change the API to use a different authentication method, such as OAuth 2.0, to improve security.

Implement a centralized middleware that enforces role-based access control on all /api/v1/* endpoints, and explicitly whitelist public endpoints.

Add role checks to each endpoint individually as they are discovered to be vulnerable.

Use a Web Application Firewall (WAF) to block requests to /api/v1/reports from non-admin users.

A web application uses a role-based access control (RBAC) system. A penetration test reveals that a low-privileged user can change their role by intercepting the request and modifying the 'role' parameter from 'user' to 'admin'. Which of the following is the most effective control to prevent this?

Store the user's role in the server-side session and never accept role information from client requests.

Use HTTPS to encrypt the traffic between the client and server.

Implement a Web Application Firewall (WAF) to block requests with modified role parameters.

Add a hidden field in the form that contains the user's role and validate it on the server.

EC-CouncilWeb Application Hacking and Security

Domain 1Objective 1

Privilege Escalation WAHS Practice Questions (Page 4)

Part of the Broken Access Control domain, which makes up ~23% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~33–55 in this domain), expect 7–11 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

5concepts

Questions 16–20

16application · medium
A content management system (CMS) has an admin panel at /admin. A standard user discovers that by directly navigating to /admin/users, they can view the user list without any error. The application relies on hiding the admin link from non-admin users. What is the most effective mitigation?
Select an answer first
17foundation · easy
Which of the following is a common technique used to exploit vertical privilege escalation?
Select an answer first
18application · medium
A web application has a 'user' role and an 'admin' role. A user discovers that by adding a 'role=admin' parameter to the profile update request, they can change their role. What is the most effective mitigation?
Select an answer first
19expert · hard
A large web application has multiple user roles (user, editor, admin) and uses a centralized authorization library. A recent penetration test found that some endpoints, such as /api/v1/reports, do not check the user's role and allow any authenticated user to access admin reports. The development team wants to fix this without breaking existing functionality. Which of the following approaches is the most secure and least likely to introduce regressions?
Select an answer first
20application · medium
A web application uses a role-based access control (RBAC) system. A penetration test reveals that a low-privileged user can change their role by intercepting the request and modifying the 'role' parameter from 'user' to 'admin'. Which of the following is the most effective control to prevent this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.