Testing Identification, Authentication and Authorization CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which test would detect a horizontal privilege escalation vulnerability?

   • ALogging in as user A and attempting to access user B's data
   • BLogging in as a normal user and attempting to access an admin page
   • CChecking if the session times out after inactivity
   • DTesting if the password field masks characters
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary goal of authorization testing?

   • ATo ensure that users can only access resources they are permitted to
   • BTo confirm that user identities are unique
   • CTo verify that users can authenticate successfully
   • DTo check that passwords meet complexity requirements
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Why is it important to test the interaction between authentication and authorization?

   • ABecause authorization is always performed before authentication
   • BBecause authorization is the only mechanism that can prevent brute-force attacks
   • CBecause authentication and authorization are independent and never affect each other
   • DBecause a failure in authentication can lead to incorrect authorization decisions
   Reveal Solution Discussion Select an answer first
5. 19expert · medium

   A security tester is evaluating a web application that uses a password-based authentication system. The tester notices that the application stores passwords using a salted hash. However, the tester also discovers that the application does not enforce a minimum password length or complexity. Which of the following is the MOST significant risk associated with this finding?

   • AThe application is vulnerable to SQL injection attacks.
   • BUsers may choose weak passwords that are susceptible to brute-force attacks.
   • CThe application is vulnerable to man-in-the-middle attacks.
   • DThe salted hash is not secure against rainbow table attacks.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A tester is assessing a web application that uses OAuth 2.0 for authorization. The application redirects the user to an authorization server, which then redirects back to the application with an authorization code. The tester notices that the application accepts the authorization code from any redirect URI, not just the one registered. Which of the following attacks is the tester MOST likely able to perform?

   • ACross-site request forgery (CSRF)
   • BSession fixation
   • CAuthorization code interception
   • DSQL injection
   Reveal Solution Discussion Select an answer first