A01:2021 – Broken Access Control

Which of the following is the most crucial aspect of effective access control?

Access control failures can lead to unauthorized modification but not the destruction of data.

What is the principle where access is granted only for particular capabilities, roles, or users, but is available to anyone?

Match the following attack techniques with their corresponding descriptions:

Which of the following is NOT a common access control vulnerability?

Access control is less effective in server-side code where the attacker can modify the access control check.

What type of attack involves replaying or tampering with a JSON Web Token to elevate privileges?

Failing to invalidate stateful session identifiers after logout can lead to session __________

What is the purpose of rate limiting API access?

Deny by default is not a recommended security practice.

What does CORS stand for, in the context of web application security?

Access control mechanisms should be implemented _________ and reused throughout the application.

What should access controls enforce regarding records?

Web server directory listing should always be enabled for easy access to files.

What type of tokens should be short-lived to minimize the window of opportunity for an attacker?

Logging access control failures and alerting admins is important for __________ detection.

Which of the following is an example of 'Force browsing' attack?

Functional access control unit and integration tests should NOT be included by developers and QA staff.

What is the primary consequence of broken access control?

Access control is most effective when implemented in client-side code.

What principle should be followed when granting access to resources, roles or users?

Bypassing access control checks can be achieved by modifying the URL, internal application state, or the HTML page, which is also known as parameter __________ or force browsing.

Which of the following is an example of elevation of privilege?

Disabling web server directory listing helps prevent information exposure.

What type of attack involves replaying or tampering with a JSON Web Token (JWT) to elevate privileges?

What type of session identifiers should be invalidated after logout?

The configuration that allows API access from unauthorized/untrusted origins is called __________ misconfiguration.

Match the following access control vulnerabilities with their descriptions:

Which of the following is a recommendation for preventing broken access control?

What should domain models enforce regarding access controls?

For longer lived JWTs it's highly recommended to follow the __________ standards to revoke access.

Which of the options is a failure related to access control?

Which of the following helps to minimize the harm from automated attack tooling?

What is the primary consequence of access control failures?

What is the principle of least privilege?

Bypassing access control checks by modifying the URL is known as ______.

Which of the following is a recommended method for preventing access control vulnerabilities?

Disabling web server directory listing helps prevent information disclosure.

What type of testing should developers include to test access controls?

Stateless JWT tokens should be ______ to minimize the window of opportunity for attackers.

In the context of JWTs, what does the OAuth standard recommend for longer-lived tokens?

Access control failures can lead to the violation of the principle of ______.

What should access controls enforce regarding records within an application?

What should happen to stateful session identifiers after a user logs out?

Permitting viewing or editing of someone else's account by providing its unique identifier is an example of a secure direct object reference.

Which attack involves replaying or tampering with a JSON Web Token (JWT) to elevate privileges?

Application business limit requirements should be enforced by ______.

What is the primary risk associated with broken access control?

What security principle is violated when access is granted to anyone instead of specific roles or users?

Disabling web server directory listing is a recommended practice to prevent exposing file metadata.

To minimize harm from automated attack tooling, it is important to __________ API and controller access.

Which of the following is a mitigation strategy against broken access control?

According to the material, it is not important to log access control failures.

The use of unverified data in a SQL call is an example of what scenario of compromising account information?

An attacker forcing a browse to a URL is an example of ___________ if they are unauthenticated, or are not an admin.

CWE stands for Common Weakness Exposure based on the text provided.

Access control enforces policy such that users can act outside of their intended permissions.

Match the weakness to the description

What is the principle of least privilege, in the context of access control?

Modifying a URL to bypass access control checks is known as ______.

Which of the following is a common access control vulnerability related to direct object references?

Disabling web server directory listing is a recommended practice to prevent access control vulnerabilities.

A CORS ______ can allow API access from unauthorized origins.

What should developers and QA staff include in testing to prevent access control issues?

In the context of JWTs, what does it mean for a token to be 'short-lived' and why is it important?

Access control failures should be ______ and admins should be alerted when appropriate.

Deny by default means that, unless a specific exception is in place, access is ______

Which of the following statements is correct regarding access control?

Using extremely long-lived, stateless JWT tokens is the best method for long session management.