A tester modifies a request parameter from 'invoice_id=100' to 'invoice_id=101' and views another customer's invoice. Which vulnerability is this?

Insecure direct object reference (IDOR)

Missing function-level access control

A security tester is analyzing the session management of a web application. The tester logs in, notes the session ID, then logs out and logs back in. The tester observes that the session ID remains the same. Which vulnerability is this behavior most indicative of?

Session ID not rotated after authentication

During a security test, a tester finds that the application allows users to set passwords that are only four characters long. Which authentication weakness does this indicate?

Lack of multi-factor authentication

A security tester is assessing the authentication mechanism of a web application. Which of the following are common weaknesses that the tester should look for? (Select all that apply.)

Insecure direct object references

Lack of multi-factor authentication

Missing function-level access control

A security tester is evaluating an application that uses ABAC. The tester discovers that a user can access another user's data by changing a parameter in the URL. The application's authorization policy is based on attributes such as department and clearance level. Which of the following is the most likely root cause of this vulnerability?

The user's attributes are not being properly authenticated

The application is not enforcing authorization checks on the server side

The application is using RBAC instead of ABAC

Certified Tester Security Tester

Domain 5Objective 2

Authentication and Authorization CT-SEC Practice Questions (Page 4)

Part of the Testing Security Mechanisms domain, which makes up ~17% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

10concepts

10 Concepts in This Objective

Definition of Authentication
Definition of Authorization
Relationship Between Authentication and Authorization
Authentication Mechanisms
Authorization Models
Testing Authentication Effectiveness
Testing Authorization Effectiveness
Common Authentication and Authorization Vulnerabilities
Security Testing Techniques for Authentication
Security Testing Techniques for Authorization

Questions 16–20

16foundation · easy
A tester modifies a request parameter from 'invoice_id=100' to 'invoice_id=101' and views another customer's invoice. Which vulnerability is this?
Select an answer first
17application · medium
A security tester is analyzing the session management of a web application. The tester logs in, notes the session ID, then logs out and logs back in. The tester observes that the session ID remains the same. Which vulnerability is this behavior most indicative of?
Select an answer first
18foundation · easy
During a security test, a tester finds that the application allows users to set passwords that are only four characters long. Which authentication weakness does this indicate?
Select an answer first
19application · medium · select all that apply
A security tester is assessing the authentication mechanism of a web application. Which of the following are common weaknesses that the tester should look for? (Select all that apply.)
Select an answer first
20expert · hard
A security tester is evaluating an application that uses ABAC. The tester discovers that a user can access another user's data by changing a parameter in the URL. The application's authorization policy is based on attributes such as department and clearance level. Which of the following is the most likely root cause of this vulnerability?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.