A security tester is reviewing an application that allows users to upload profile pictures. The tester uploads a file and then accesses it via a URL like /uploads/profile.jpg. The tester suspects that the application is vulnerable to IDOR. Which of the following is the most likely way to confirm this vulnerability?

Check if the application uses HTTPS

Attempt to upload a malicious file

Test the application's password policy

Change the filename in the URL to another user's filename

Which authorization model grants permissions based on the roles a user has been assigned?

Discretionary access control (DAC)

Role-based access control (RBAC)

Attribute-based access control (ABAC)

Which statement correctly describes the relationship between authentication and authorization?

Authentication and authorization are the same process, with authorization being the technical term.

Authentication and authorization are independent processes that can occur in any order.

Authentication must occur before authorization, as authorization requires a verified identity.

Authorization occurs before authentication to ensure only authorized users are authenticated.

A security tester is examining a web application and notices that the application does not perform any authorization checks on the server side for certain administrative functions. The tester is able to directly request the URL for an admin function while logged in as a standard user and the function executes successfully. Which vulnerability is present?

Insecure direct object reference

Missing function-level access control

Certified Tester Security Tester

Domain 5Objective 2

Authentication and Authorization CT-SEC Practice Questions (Page 3)

Part of the Testing Security Mechanisms domain, which makes up ~17% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

10concepts

10 Concepts in This Objective

Definition of Authentication
Definition of Authorization
Relationship Between Authentication and Authorization
Authentication Mechanisms
Authorization Models
Testing Authentication Effectiveness
Testing Authorization Effectiveness
Common Authentication and Authorization Vulnerabilities
Security Testing Techniques for Authentication
Security Testing Techniques for Authorization

Questions 11–15

11application · medium
A security tester is evaluating the authentication mechanism of a web application. The tester wants to determine if the application is resistant to brute-force attacks. Which testing technique is most appropriate for this purpose?
Select an answer first
12expert · medium
A security tester is reviewing an application that allows users to upload profile pictures. The tester uploads a file and then accesses it via a URL like /uploads/profile.jpg. The tester suspects that the application is vulnerable to IDOR. Which of the following is the most likely way to confirm this vulnerability?
Select an answer first
13foundation · easy
Which authorization model grants permissions based on the roles a user has been assigned?
Select an answer first
14foundation · easy
Which statement correctly describes the relationship between authentication and authorization?
Select an answer first
15application · medium
A security tester is examining a web application and notices that the application does not perform any authorization checks on the server side for certain administrative functions. The tester is able to directly request the URL for an admin function while logged in as a standard user and the function executes successfully. Which vulnerability is present?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

Authentication and Authorization CT-SEC Practice Questions (Page 3)

Questions 11–15

A security tester is evaluating the authentication mechanism of a web application. The tester wants to determine if the application is resistant to brute-force attacks. Which testing technique is most appropriate for this purpose?

Which authorization model grants permissions based on the roles a user has been assigned?

Which statement correctly describes the relationship between authentication and authorization?

Keep studying — Testing Security Mechanisms