Access Control GWEB Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A web application has an admin panel at /admin. The application uses a filter that checks if the request URL starts with '/admin' and then verifies the user's role. However, an attacker discovers that by requesting '/ADMIN' (uppercase), the filter is bypassed and the admin page is served. What is the most likely cause?

   • AThe filter performs a case-sensitive comparison on the URL path
   • BThe filter is vulnerable to SQL injection
   • CThe filter does not check the query string
   • DThe filter does not check the HTTP method
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which access control vulnerability occurs when an application does not enforce authorization checks on sensitive functions, allowing a low-privileged user to invoke administrative operations?

   • AInsecure Direct Object Reference (IDOR)
   • BSession fixation
   • CCross-Site Scripting (XSS)
   • DMissing function-level access control
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A web application uses an access control list (ACL) to manage permissions on shared documents. Each document has an ACL that lists users and their allowed actions (read, write, delete). What is a limitation of this approach in a large organization?

   • AACLs do not support deny rules
   • BACLs are difficult to manage when users change roles frequently
   • CACLs are only applicable to file systems, not web applications
   • DACLs cannot be used for read-only access
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A web application is being redesigned to improve access control. The current system has authorization checks scattered across controllers, and a recent audit found several endpoints with missing checks. The team wants to enforce access control consistently without rewriting every controller. Which approach is most effective?

   • AUse a web application firewall (WAF) to block unauthorized requests
   • BRely on the front-end to hide unauthorized links
   • CAdd authorization checks to each controller method
   • DImplement a centralized authorization middleware that intercepts all requests and applies a policy based on the route and user attributes
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A web application exposes a REST API. The API uses URL-based access control where each endpoint is prefixed with a role, such as /admin/users and /user/profile. A security review finds that the application does not check the HTTP method when enforcing access control. An attacker can use the PUT method on /user/profile to modify another user's profile. What is the most effective fix?

   • AAdd method-based access control checks to each endpoint
   • BUse a centralized authorization middleware that checks both the URL and the HTTP method
   • CRely on the web application firewall to block PUT requests
   • DRemove the PUT method from the API entirely
   Reveal Solution Discussion Select an answer first