A security tester is assessing an application that allows users to view their own invoices by clicking a link like /invoice?id=12345. The tester changes the id to another user's invoice number and successfully views it. Which testing technique did the tester use, and what vulnerability was confirmed?

Forced browsing; missing function-level access control

Credential testing; broken authentication

Parameter manipulation; insecure direct object reference

Session analysis; session fixation

In a security testing scenario, what does authorization determine?

Whether the user's session token is still valid.

Whether the user's password matches the stored hash.

Which resources and actions an authenticated user is permitted to access or perform.

Whether the user's IP address is allowed to connect to the network.

A security tester is analyzing a web application's session management. The tester logs in, receives a session ID, and then logs out. The tester then logs in again and receives the same session ID. The tester suspects a session fixation vulnerability. Which of the following is the most effective mitigation?

Regenerate the session ID upon successful login

Use HTTPS for all communications

Why must authentication occur before authorization in a secure system?

Because authorization requires a verified identity to make access decisions.

Because authorization is only needed for unauthenticated users.

Because authorization is a stronger form of authentication.

Because authentication requires the user's permissions to be checked first.

Which statement best defines authentication in the context of security testing?

The process of encrypting data to prevent unauthorized access during transmission.

The process of verifying the identity of a user, system, or entity.

The process of determining what an authenticated entity is allowed to access or do.

The process of logging all actions performed by a user after they gain access to a system.

Certified Tester Security Tester

Domain 5Objective 2

Authentication and Authorization CT-SEC Practice Questions (Page 1)

Part of the Testing Security Mechanisms domain, which makes up ~17% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

10concepts

10 Concepts in This Objective

Definition of Authentication
Definition of Authorization
Relationship Between Authentication and Authorization
Authentication Mechanisms
Authorization Models
Testing Authentication Effectiveness
Testing Authorization Effectiveness
Common Authentication and Authorization Vulnerabilities
Security Testing Techniques for Authentication
Security Testing Techniques for Authorization

Questions 1–5

1application · medium
A security tester is assessing an application that allows users to view their own invoices by clicking a link like /invoice?id=12345. The tester changes the id to another user's invoice number and successfully views it. Which testing technique did the tester use, and what vulnerability was confirmed?
Select an answer first
2foundation · easy
In a security testing scenario, what does authorization determine?
Select an answer first
3expert · hard
A security tester is analyzing a web application's session management. The tester logs in, receives a session ID, and then logs out. The tester then logs in again and receives the same session ID. The tester suspects a session fixation vulnerability. Which of the following is the most effective mitigation?
Select an answer first
4foundation · easy
Why must authentication occur before authorization in a secure system?
Select an answer first
5foundation · easy
Which statement best defines authentication in the context of security testing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

Authentication and Authorization CT-SEC Practice Questions (Page 1)

Questions 1–5

In a security testing scenario, what does authorization determine?

Why must authentication occur before authorization in a secure system?

Which statement best defines authentication in the context of security testing?

Keep studying — Testing Security Mechanisms