Access Control GWEB Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An e-commerce site has an admin panel at /admin. The application uses a middleware that checks if the user's session contains the 'isAdmin' flag before allowing access to any route under /admin. However, a penetration tester finds that sending a GET request to /admin/../admin/deleteUser still executes the delete function. Which access control weakness is most directly exploited?

   • APrivilege escalation because the user can change their own session flag
   • BIDOR due to predictable object references
   • CMissing function-level access control because the middleware only checks the path prefix and can be bypassed with path traversal
   • DBroken access control due to the use of a deny-list instead of an allow-list
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A financial institution is implementing a new trading platform. The platform must ensure that a trader cannot both enter and approve a trade. The system uses role-based access control. The security team is considering two designs: (1) assign each trader a single role that includes both permissions, and (2) assign separate roles for 'trader' and 'approver' and require two different users to perform the actions. Which design best enforces separation of duties?

   • ABoth designs enforce separation of duties equally
   • BNeither design enforces separation of duties
   • CDesign 2, because it requires two different users to complete a transaction
   • DDesign 1, because it simplifies role management
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security tester is reviewing a web application and finds that the endpoint /admin/deleteUser accepts a POST request. The tester sends a POST request to this endpoint without any authentication token and receives a 302 redirect to the login page. What does this indicate?

   • AThe endpoint is not protected at all
   • BThe endpoint is protected by authentication but may still have authorization issues
   • CThe endpoint is vulnerable to IDOR
   • DThe endpoint is vulnerable to CSRF
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A web application has an endpoint /api/reports/quarterly that should only be accessible to users with the 'analyst' role. The application uses a front-end router that hides the link to this endpoint from non-analyst users. What is the most important additional control to implement?

   • ALog all requests to the endpoint
   • BServer-side authorization check on the endpoint
   • CUse HTTPS to protect the endpoint
   • DAdd a CAPTCHA to the endpoint
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A web application has a role hierarchy where 'admin' inherits all permissions from 'editor', and 'editor' inherits from 'viewer'. A security audit reveals that a user with the 'viewer' role can access an admin-only endpoint by manually crafting a request. The application uses a middleware that checks the user's role against a list of allowed roles for each endpoint. What is the most likely cause of this vulnerability?

   • AThe application is vulnerable to CSRF
   • BThe application does not use HTTPS
   • CThe application uses client-side role checks
   • DThe middleware checks the role but does not verify the user's actual permissions in the role hierarchy
   Reveal Solution Discussion Select an answer first