PT0-002 Attacks and Exploits Practice Question
In a web application test, you find a parameter that directly references internal object IDs (e.g., user_id=123) and changing the ID allows access to another user's data. This vulnerability is known as:
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Insecure Direct Object Reference (IDOR)
IDOR (Insecure Direct Object Reference) occurs when an application exposes internal object references without proper access control checks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Insecure Direct Object Reference (IDOR)
Why this is correct
IDOR allows unauthorized access to objects by modifying reference values.
- ✗
Cross-site scripting (XSS)
Why it's wrong here
XSS involves injecting client-side scripts, not direct object reference manipulation.
- ✗
SQL injection
Why it's wrong here
SQL injection involves injecting SQL commands, not simply changing object IDs.
- ✗
Cross-site request forgery (CSRF)
Why it's wrong here
CSRF tricks a user into performing actions, not directly accessing object references.
Go deeper
Related to this question
About these practice questions
This PT0-003 question is part of Courseiva's 185-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.