Access Control GWEB Practice Questions (Page 9)

Questions 41–43

1. 41application · medium

   A development team is designing a new web application. The security architect recommends that all access control decisions be made in a single module and that the application deny access by default unless a rule explicitly grants access. Which best practices are being applied?

   • ARole-based access control and attribute-based access control
   • BDefense in depth and fail-safe defaults
   • CLeast privilege and separation of duties
   • DCentralized enforcement and default-deny
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which type of access control in a web application verifies that a user is allowed to access a specific instance of a resource, such as a particular document or record?

   • AObject-level access control
   • BMethod-based access control
   • CURL-based access control
   • DFunction-level access control
   Reveal Solution Discussion Select an answer first
3. 43expert · hard

   A security team is testing a web application for access control vulnerabilities. They have a list of endpoints and the roles that should access them. They also have a valid session for a low-privilege user. Which testing approach would most efficiently identify missing function-level access control?

   • AManually test each endpoint by changing the HTTP method
   • BReview the source code for hardcoded roles
   • CRun a vulnerability scanner without authentication
   • DUse a script to send requests to each endpoint with the low-privilege session and compare the response status codes to expected codes
   Reveal Solution Discussion Select an answer first