GCIH Exploiting Insecure Web App References Practice Question
How can an application distinguish between an authorized user requesting their own profile and an unauthorized user attempting to access a different profile via IDOR?
⚠ Common exam trap
Test-takers frequently believe that strong session tokens or multifactor authentication alone are sufficient to automatically prevent IDOR without backend code logic changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
By verifying ownership of the requested resource in the backend
The application must correlate the authenticated user's identity (from the session) with the requested resource identifier on the back-end. By checking if the session user owns the requested resource ID before returning data, the application enforces authorization. This moves the logic from 'is this user allowed to access anything?' to 'is this user allowed to access THIS SPECIFIC object?', which is the foundation of secure resource access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
By validating that the user has a session cookie
Why it's wrong here
Validating a session cookie only confirms authentication, not authorization. An attacker with a valid session cookie can still request resources belonging to others. The application must perform an additional check to verify that the session user has the required permissions to access the specific requested resource ID within the database.
- ✗
By checking if the resource ID is a valid integer
Why it's wrong here
Validating the data type (like ensuring an ID is an integer) is a form of input validation that prevents certain types of crashes, but it does not prevent IDOR. An attacker can supply a valid integer ID that belongs to another user, and the application will still process the request successfully.
- ✓
By verifying ownership of the requested resource in the backend
Why this is correct
Verifying ownership is the correct approach to prevent IDOR. The application must check that the currently authenticated user's identifier matches the owner ID of the requested resource. This server-side check ensures that users can only access their own data, effectively blocking unauthorized requests for objects belonging to other users.
- ✗
By using a CAPTCHA on every request
Why it's wrong here
CAPTCHAs are intended to prevent automated bot activity, not to control access to data. An attacker can solve a CAPTCHA and still perform an IDOR attack manually or programmatically. This does not verify ownership or authorization, and it significantly harms the user experience without providing meaningful security against logical object access.
About these practice questions
Courseiva writes every GCIH question from scratch — 322 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCIH practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCIH exam.