ISC Systems Lifecycle Management Practice Question
Which TWO mechanisms are effective for preventing 'insecure direct object references' (IDOR) in a web application during the development phase?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Using non-enumerable, cryptographically strong identifiers (e.g., UUIDs)
Preventing IDOR requires both server-side authorization checks and the use of indirect/randomized identifiers rather than sequential, predictable keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Client-side input validation
Why it's wrong here
Client-side validation is easily bypassed and does not prevent IDOR.
- ✓
Using non-enumerable, cryptographically strong identifiers (e.g., UUIDs)
Why this is correct
UUIDs are difficult to guess, preventing unauthorized access to specific object paths.
- ✗
Disabling logging of access attempts
Why it's wrong here
Logging is a critical detective control, not a preventative measure for IDOR.
- ✗
Using sequential database IDs in URLs
Why it's wrong here
Sequential IDs make it trivial to guess and access other objects.
- ✓
Implementing server-side authorization checks
Why this is correct
Server-side checks ensure the user has permission to access the specific object requested.
About these practice questions
One of 219 original ISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official (ISC)² exam blueprint
This ISC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ISC exam.