Access Control GWEB Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A web application uses a REST API with endpoints like /api/orders/{id}. The application has a global middleware that checks if the user is authenticated. However, each endpoint is responsible for checking whether the user can access the specific order. A penetration test reveals that a user can access another user's order by changing the ID. What is the most effective remediation?

   • AAdd an ownership check in a centralized middleware that runs before the endpoint handler
   • BAdd a role check in the endpoint handler
   • CLog all requests to the API
   • DUse a random UUID for order IDs
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which access control vulnerability occurs when an application uses a user-supplied identifier to directly access an object without verifying the user's authorization?

   • AInsecure Direct Object Reference (IDOR)
   • BPrivilege escalation
   • CCross-Site Request Forgery (CSRF)
   • DMissing function-level access control
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security engineer is investigating a potential access control flaw in a web application. The application uses a role-based access control system where users have a 'role' attribute stored in a JWT. The JWT is signed with a secret key. The engineer discovers that the JWT verification is only performed on the login endpoint, not on subsequent requests. An attacker can modify the role claim in the JWT and access admin functions. What is the most effective remediation?

   • AUse HTTPS to protect the JWT in transit
   • BShorten the JWT expiration time
   • CVerify the JWT signature on every request that requires authorization
   • DStore the role in a server-side session instead of the JWT
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company is migrating a legacy web application to a modern architecture. The legacy application has access control checks scattered throughout the codebase, and some pages have no checks at all. The security team wants to implement a best-practice access control framework. Which approach is most aligned with best practices?

   • AUse a web application firewall to block unauthorized requests
   • BCreate a centralized authorization module and refactor all pages to use it
   • CAdd checks to the pages that currently lack them, leaving existing checks in place
   • DImplement a new authentication system and rely on it for access control
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which principle states that a subject should be granted only the permissions necessary to perform its legitimate tasks?

   • ADefense in depth
   • BSeparation of duties
   • CLeast privilege
   • DFail-safe defaults
   Reveal Solution Discussion Select an answer first