hardMultiple SelectObjective-mapped
CCSP Practice Question: A cloud application exposes an API that allows…
A cloud application exposes an API that allows users to view their own orders. Which TWO vulnerabilities could allow an attacker to view another user's orders?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Insecure Direct Object Reference (IDOR)
Broken Object Level Authorization (BOLA) occurs when the API does not verify that the user owns the object, and IDOR (Insecure Direct Object Reference) allows access by manipulating object IDs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Excessive Data Exposure
Why it's wrong here
Excessive data exposure returns too much data, but not necessarily another user's orders.
- ✗
SQL Injection
Why it's wrong here
SQL injection can extract data but not specifically for viewing other orders.
- ✓
Insecure Direct Object Reference (IDOR)
Why this is correct
IDOR occurs when user input directly references objects without authorization checks.
- ✓
Broken Object Level Authorization (BOLA)
Why this is correct
BOLA allows unauthorized access to objects by failing to check user ownership.
- ✗
Cross-Site Scripting (XSS)
Why it's wrong here
XSS injects scripts into pages, not directly related to viewing other orders.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.