Courseiva
← SY0-701
Full test
hardmultiple choiceObjective-mapped

Exhibit

Web server access log excerpt:
10:41:12 GET /portal/document?docId=4411 200 user=jcarter
10:41:14 GET /portal/document?docId=4412 200 user=jcarter
10:41:15 GET /portal/document?docId=4413 200 user=jcarter

Application debug log:
[INFO] Document lookup completed successfully.
[WARN] No authorization check performed after object lookup.
[INFO] Returned file owner: finance2

Based on the exhibit, what is the BEST fix for the vulnerability being exploited?

A user with a standard account can retrieve documents by changing the `docId` value in the request. The application returns another employee's file without any authorization error.

Question 1hardmultiple choice
Full question →

Based on the exhibit, what is the BEST fix for the vulnerability being exploited?

A user with a standard account can retrieve documents by changing the `docId` value in the request. The application returns another employee's file without any authorization error.

Full question →

Answer choices

Why each option matters

Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.

A

Distractor review

Add client-side JavaScript to hide document IDs from the user interface.

Client-side hiding may reduce casual browsing, but it does not stop direct request tampering or automated attacks.

B

Best answer

Enforce server-side object-level authorization checks before returning any document.

The application is returning objects to an authenticated user without verifying whether that user is allowed to access each specific record.

C

Distractor review

Require users to change passwords more frequently to prevent unauthorized document access.

Password rotation does not address the core issue, which is missing authorization on object retrieval.

D

Distractor review

Place the document server behind a load balancer to prevent direct access to the application.

A load balancer does not fix broken access control logic inside the application and would not stop parameter tampering.

Common exam trap

Common exam trap: authentication is not authorization

Logging in proves the user can authenticate. It does not automatically mean the user is allowed to enter privileged or configuration mode. Watch for AAA authorization, privilege level and command authorization details.

Technical deep dive

How to think about this question

This kind of question is testing the difference between identity and permission. A user may successfully log in to a router because authentication is working, but still fail to enter configuration mode because authorization is missing, misconfigured or mapped to a lower privilege level.

KKey Concepts to Remember

  • Authentication checks who the user is.
  • Authorization controls what the user is allowed to do after login.
  • Privilege levels affect access to EXEC and configuration commands.
  • AAA, TACACS+ and RADIUS can separate login success from command access.

TExam Day Tips

  • Do not assume successful login means full administrative access.
  • Look for words such as cannot enter configuration mode, privilege level, authorization or command access.
  • Separate login problems from permission problems before choosing the answer.

Related practice questions

Related SY0-701 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Security+ social engineering questions

Practise SY0-701 questions linked to Security+ social engineering questions.

Security+ cryptography practice questions

Practise SY0-701 questions linked to Security+ cryptography.

Security+ IAM questions

Practise SY0-701 questions linked to Security+ IAM questions.

Security+ risk management questions

Practise SY0-701 questions linked to Security+ risk management questions.

Security+ incident response questions

Practise SY0-701 questions linked to Security+ incident response questions.

Security+ malware questions

Practise SY0-701 questions linked to Security+ malware questions.

Security+ vulnerability management questions

Practise SY0-701 questions linked to Security+ vulnerability management questions.

Security+ security operations questions

Practise SY0-701 questions linked to Security+ security operations questions.

Security+ zero trust questions

Practise SY0-701 questions linked to Security+ zero trust questions.

Security+ authentication factors questions

Practise SY0-701 questions linked to Security+ authentication factors questions.

More questions from this exam

Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.

Question 1

A laptop is suspected of being used in a malware incident. It is still powered on and connected to Wi-Fi. What should the responder do before shutting it down?

Question 2

An employee reports a ransomware note on a file server. The server is still powered on, shares are still being accessed, and management wants service restored as quickly as possible. What should the incident response team do first?

Question 3

An employee reports a ransomware note on a finance laptop. The laptop is still powered on, connected to Wi-Fi, and the user says they were just working in a spreadsheet. Management wants the fastest safe response that also preserves evidence. What should the responder do first?

Question 4

You are handed a company laptop suspected in an insider theft case. Legal says the evidence may be needed in court. Which action best preserves admissibility?

Question 5

A developer wants to reduce the risk of SQL injection in a new customer search form. Which two changes are the best mitigations? Select two.

Question 6

A branch office uses a flat LAN, and a compromise on one user workstation could spread quickly to finance systems. Management wants finance workstations isolated from general users, but finance staff still need access to a central finance application and network printer. What is the best design change?

FAQ

Questions learners often ask

What does this SY0-701 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Enforce server-side object-level authorization checks before returning any document. — The exhibit shows a classic object access control failure: the application returns documents based on a user-controlled identifier without verifying ownership or entitlement. The best fix is to enforce server-side authorization checks for every document request. In practice, the app should confirm that the authenticated session is allowed to access the requested object, and it may also use opaque indirect references to reduce enumeration risk. The key point is that the decision must happen on the server, not in the browser. Why others are wrong: Client-side hiding only obscures values and is easy to bypass by editing requests directly. Password changes do not address broken authorization logic. A load balancer improves availability and can hide internal topology, but it does not validate whether a user may view a specific file. The problem is missing access control after object lookup, so the fix must be enforced in application logic.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.

Discussion

Loading comments…

Sign in to join the discussion.