CCSP · Question #372
Which of the following threat types involves an application that does not validate authorization for portions of itself after the initial checks?
The correct answer is B. Missing function-level access control. Missing function-level access control occurs when an application only enforces access restrictions at the entry point (e.g., login) but fails to revalidate authorization for individual functions, pages, or API endpoints within the application. An attacker can exploit this by dire
Question
Which of the following threat types involves an application that does not validate authorization for portions of itself after the initial checks?
Options
- AInjection
- BMissing function-level access control
- CCross-site request forgery
- DCross-site scripting
How the community answered
(31 responses)- A3% (1)
- B94% (29)
- D3% (1)
Explanation
Missing function-level access control occurs when an application only enforces access restrictions at the entry point (e.g., login) but fails to revalidate authorization for individual functions, pages, or API endpoints within the application. An attacker can exploit this by directly accessing protected URLs or functions without proper privilege. Injection involves malicious code/commands being sent to an interpreter, Cross-site scripting (XSS) involves injecting malicious scripts into web pages, and Cross-site request forgery (CSRF) tricks authenticated users into performing unintended actions.
Topics
Community Discussion
No community discussion yet for this question.