CS0-003 Vulnerability Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Injection

  Why it's wrong here

  Injection vulnerabilities occur when untrusted user input is directly concatenated into an interpreter command or query, leading to unauthorized execution of code or database queries. While Burp Suite can test for this via SQLi or command injection payloads, the scenario specifically describes a failure in authorization boundaries rather than input parsing flaws.

• ✗

  Security Misconfiguration

  Why it's wrong here

  Security misconfigurations involve default accounts, unhardened HTTP headers, or verbose error pages that leak system details. Although these weaknesses can expose an application to attack, they represent a failure in hardening and setup rather than a flaw in the application's logical enforcement of user privilege boundaries.

• ✗

  Server-Side Request Forgery (SSRF)

  Why it's wrong here

  Server-Side Request Forgery occurs when a vulnerable web application is coerced into making unauthorized HTTP requests to backend systems or external APIs. This differs from access control failures, as SSRF exploits the server's trusted network position to bypass firewalls rather than manipulating user-level session permissions.

• ✓

  Broken Access Control

  Why this is correct

  Broken access control is the correct answer because it directly describes a failure to enforce restrictions on what authenticated users are allowed to do. By manipulating parameters, headers, or API endpoints in Burp Suite, testers can identify flaws like Insecure Direct Object References (IDOR) or privilege escalation, which allow unauthorized data access.

Go deeper

Related to this question