Skills101
← All practice quizzes

Quiz: Broken Access Control

5 questionsNo time limitPass: 60%+10 XP on first pass

The number-one web risk explained: changing an ID in the URL to see someone else's data (IDOR), students reaching admin functions, mass assignment, and SSRF — with Python examples of the checks that prevent them.

Log in to take the quiz

Free account · see your score, answers and explanations, earn XP

  1. Question 1

    A student changes /api/marks/101 to /api/marks/102 and sees another student's marks. This is:

  2. Question 2

    The "Delete user" button is hidden from students in the UI. Is that enough?

  3. Question 3

    In the mass-assignment demo, what happened to the "role" field sent by the attacker?

  4. Question 4

    Which address is a classic SSRF target on cloud servers?

  5. Question 5

    Why can it be better to return 404 instead of 403 for someone else's record?