SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Exhibit
Web server access log excerpt: 10:41:12 GET /portal/document?docId=4411 200 user=jcarter 10:41:14 GET /portal/document?docId=4412 200 user=jcarter 10:41:15 GET /portal/document?docId=4413 200 user=jcarter Application debug log: [INFO] Document lookup completed successfully. [WARN] No authorization check performed after object lookup. [INFO] Returned file owner: finance2
Based on the exhibit, what is the BEST fix for the vulnerability being exploited?
A user with a standard account can retrieve documents by changing the `docId` value in the request. The application returns another employee's file without any authorization error.
⚠ Common exam trap
Many exam-takers confuse client-side hiding (option A) with a valid security control, but the SY0-701 exam emphasizes that all access control must be enforced server-side, as client-side controls are trivially bypassed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enforce server-side object-level authorization checks before returning any document.
The vulnerability is an Insecure Direct Object Reference (IDOR), where the application trusts user-supplied input (the `docId` parameter) without verifying that the authenticated user is authorized to access the requested document. The best fix is to enforce server-side object-level authorization checks before returning any document, ensuring that the server validates the user's permissions against the specific resource ID before processing the request.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add client-side JavaScript to hide document IDs from the user interface.
Why it's wrong here
Client-side JavaScript only hides document IDs from the visible interface; it does not remove them from the HTML source, browser devtools, network requests, or API responses. An attacker can simply intercept requests, inspect the underlying code, or enumerate sequential IDs to directly access other users' objects. This is security through obscurity and provides no server-side enforcement.
- ✓
Enforce server-side object-level authorization checks before returning any document.
Why this is correct
The application must validate, on the server, that the authenticated user is explicitly authorized to access each requested document before returning any data. This means enforcing object-level authorization checks such as ownership, role, or relation-based access control for every individual record, not just at the endpoint level. Called Broken Object Level Authorization (BOLA), this fix directly resolves the insecure direct object reference and prevents tampering with resource identifiers.
- ✗
Require users to change passwords more frequently to prevent unauthorized document access.
Why it's wrong here
Frequent password rotation addresses the risk of stolen credentials but does nothing to stop an already-authenticated user from accessing objects they do not own. The vulnerability stems from missing authorization checks, not from weak or reused passwords; an attacker will still be able to change document IDs in requests after logging in. This option simply wears out users and fails to mitigate the actual flaw.
- ✗
Place the document server behind a load balancer to prevent direct access to the application.
Why it's wrong here
A load balancer operates at the network/transport layer, distributing traffic across servers and providing high availability, but it does not understand application-level authorization rules. It cannot inspect or enforce whether a specific user is allowed to access a document ID, nor does it stop an attacker from modifying parameters in the HTTP request. The broken access control lies within the application code and will remain exploitable regardless of network infrastructure.
Go deeper
Related to this question
Learn chapter
Application Attacks: SQL Injection, XSS
Key term
Authorization
Authorization determines what an authenticated user is allowed to do within a system, such as accessing files, running programs, or changing settings.
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.