Which statement best defines authorization in the context of security testing?

The process of tracking user activities for compliance purposes.

The process of verifying the identity of a user, system, or entity.

The process of determining what an authenticated entity is allowed to access or do.

The process of encrypting data to protect it from unauthorized access.

A tester changes a user ID in a request from '123' to '124' and finds that they can access another user's account data. Which type of authorization flaw does this demonstrate?

Horizontal privilege escalation

Missing function-level access control

Certified Tester Security Tester

Domain 5Objective 2

Authentication and Authorization CT-SEC Practice Questions (Page 7)

Part of the Testing Security Mechanisms domain, which makes up ~17% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

10concepts

10 Concepts in This Objective

Definition of Authentication
Definition of Authorization
Relationship Between Authentication and Authorization
Authentication Mechanisms
Authorization Models
Testing Authentication Effectiveness
Testing Authorization Effectiveness
Common Authentication and Authorization Vulnerabilities
Security Testing Techniques for Authentication
Security Testing Techniques for Authorization

Questions 31–33

31foundation · easy
Which security testing technique is used to verify that an application resists automated password guessing attacks?
Select an answer first
32foundation · easy
Which statement best defines authorization in the context of security testing?
Select an answer first
33foundation · easy
A tester changes a user ID in a request from '123' to '124' and finds that they can access another user's account data. Which type of authorization flaw does this demonstrate?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

Authentication and Authorization CT-SEC Practice Questions (Page 7)

Questions 31–33

Which security testing technique is used to verify that an application resists automated password guessing attacks?

Which statement best defines authorization in the context of security testing?

A tester changes a user ID in a request from '123' to '124' and finds that they can access another user's account data. Which type of authorization flaw does this demonstrate?

Keep studying — Testing Security Mechanisms