Sample questions
As Access Control IdorDifficulty 1
What does "broken access control" mean as a vulnerability category?
- aThe login form does not validate the password format strictly enough
- bThe TLS certificate on the login page is expired
- cAn authenticated user can act on data or functions they should not be permitted to reach✓
- dThe database connection pool runs out of available connections under load, causing intermittent timeouts across all endpoints.
Explanation:Broken access control describes failures in enforcing what an already-identified user is allowed to do — the system correctly knows who is calling but fails to correctly restrict what that caller can read or change, which is why it has topped the OWASP Top 10 in recent editions.
As Access Control IdorDifficulty 2
An invoice detail page is reached via /invoices/482. A logged-in user changes the URL to /invoices/481 and sees another customer's invoice. What is the underlying flaw?
- aThe invoice numbers are not encrypted in the URL
- bThe server does not verify that the requesting user owns invoice 481 before returning it✓
- cThe session cookie is missing the
Secure flag - dThe invoice IDs are sequential integers instead of random strings, which alone lets any authenticated user enumerate every invoice.
Explanation:This is a textbook Insecure Direct Object Reference (IDOR): the server trusts the ID from the request and fetches the matching row without checking that the authenticated user is the owner of that record. Making IDs non-sequential would only add obscurity, not fix the missing ownership check.
As Access Control IdorDifficulty 2
What is the difference between horizontal and vertical privilege escalation?
- aHorizontal means accessing another user's data at the same privilege level.✓
- bHorizontal means gaining admin rights; vertical means reading another tenant's rows
- cThey both describe the same attack, just named differently by different vendors
- dHorizontal applies to REST APIs and vertical applies only to GraphQL APIs
Explanation:Horizontal escalation is a regular user reaching another regular user's resources (same rank, wrong owner) — like the invoice example. Vertical escalation is a regular user reaching functionality reserved for a higher role, such as an ordinary user calling an admin-only endpoint.
As Access Control IdorDifficulty 1
Why is hiding an "Admin Settings" button in the frontend for non-admin users not a real access control mechanism on its own?
- aBecause frontend code cannot render conditional UI at all, so any hidden element is a rendering bug rather than a design choice.
- bBecause the underlying API endpoint is still reachable directly.✓
- cBecause every browser ignores CSS
display:none - dBecause hidden buttons cause browser rendering errors
Explanation:UI hiding is a usability nicety, not a security boundary — any client can call the backend endpoint directly (via devtools, curl, or a proxy) bypassing the button entirely. The actual authorization decision must be enforced server-side, on every request.
As Access Control IdorDifficulty 2
A SaaS product stores all customers' data in one shared orders table with a tenant_id column. A bug causes an API query to omit the WHERE tenant_id = ? filter for one endpoint. What is the direct consequence?
- aQuery performance degrades but data remains isolated
- bOnly read operations are affected, writes remain isolated by default
- cThe database enforces tenant isolation automatically, since every table has a foreign key to the tenant.
- dOne tenant's request can return or affect rows belonging to a different tenant✓
Explanation:In a shared-schema multi-tenant design, tenant isolation lives entirely in application query logic (or database-level row security) — nothing else stops a query without the tenant filter from touching every tenant's rows, making this a direct cross-tenant data leak, and it can affect writes just as easily as reads.
As Access Control IdorDifficulty 1
In Role-Based Access Control (RBAC), what determines whether a request is allowed?
- aThe current time of day the request was made
- bWhether the request came from an internal IP address
- cThe length of the user's password
- dThe role(s) assigned to the user and whether that role has the required permission✓
Explanation:RBAC grants permissions to roles, and roles are assigned to users; an access decision checks whether any role held by the requesting user includes the permission needed for the action, rather than evaluating individual user attributes.