A tester is reviewing a multi-tenant SaaS application. Each tenant has its own workspace, and users can be members of multiple workspaces. The application uses a session cookie that contains the user's ID. When a user switches workspaces, the application updates the session to include the new workspace ID. The tester logs in as a regular user in workspace A, then manually modifies the session cookie to include the workspace ID of workspace B (where the tester is not a member). The application grants access to workspace B's data. Which of the following is the MOST likely cause of this authorization bypass?

The workspace ID is stored in the session instead of in a database.

The application does not validate the user's membership in the workspace on each request.

The session cookie is not encrypted.

The application uses a single session cookie for all workspaces.

Which authentication mechanism relies on a shared secret that is verified without transmitting the secret itself?

Challenge-response authentication

In a security test, what is the correct order of testing the IAA components?

Authorization, authentication, identification

Authentication, identification, authorization

Identification, authentication, authorization

What is a primary security property of multi-factor authentication (MFA)?

It eliminates the need for passwords

It combines two or more independent factors of authentication

It requires the use of biometric data

It ensures the user is physically present

Which authorization model grants access based on the role a user has been assigned?

Attribute-Based Access Control (ABAC)

Discretionary Access Control (DAC)

Role-Based Access Control (RBAC)

Certified Tester Security Test Engineer

Domain 2Objective 5

Testing Identification, Authentication and Authorization CT-STE Practice Questions (Page 3)

Part of the Security Test Techniques domain, which makes up ~15% of our current practice bank. ISTQB does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

7concepts

Questions 11–15

11application · medium
A tester is reviewing a multi-tenant SaaS application. Each tenant has its own workspace, and users can be members of multiple workspaces. The application uses a session cookie that contains the user's ID. When a user switches workspaces, the application updates the session to include the new workspace ID. The tester logs in as a regular user in workspace A, then manually modifies the session cookie to include the workspace ID of workspace B (where the tester is not a member). The application grants access to workspace B's data. Which of the following is the MOST likely cause of this authorization bypass?
Select an answer first
12foundation · easy
Which authentication mechanism relies on a shared secret that is verified without transmitting the secret itself?
Select an answer first
13foundation · easy
In a security test, what is the correct order of testing the IAA components?
Select an answer first
14foundation · easy
What is a primary security property of multi-factor authentication (MFA)?
Select an answer first
15foundation · easy
Which authorization model grants access based on the role a user has been assigned?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-STE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-STE” is a trademark of its owner, used for identification only.