hardMultiple Choice
CCSP Practice Question: A cloud application uses an API that allows users…
A cloud application uses an API that allows users to view other users' profile details by changing the user ID in the request. Which vulnerability is this?
⚠ Common exam trap
CCSP often tests the distinction between authentication (verifying identity) and authorization (verifying permissions), and candidates may confuse BOLA with broken authentication or excessive data exposure because all involve improper access to data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Broken object level authorization (BOLA)
Broken Object Level Authorization (BOLA) occurs when an API fails to verify that the requesting user is authorized to access the specific object (e.g., user profile) referenced in the request. In this case, changing the user ID in the request allows viewing other users' profiles because the API does not check if the authenticated user has permission to access that particular user's data. This is a classic example of BOLA, listed as API1:2019 in the OWASP API Security Top 10.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Mass assignment
Why it's wrong here
Mass assignment occurs when clients bind extra fields to server-side objects, altering attributes they should not control. Here the flaw is missing per-object authorisation on the user ID parameter, not unintended field binding. Mass assignment would be correct if a request modified fields like role or balance.
- ✗
Broken authentication
Why it's wrong here
Broken authentication concerns credential and session weaknesses, such as weak passwords or flawed token validation, not authorisation checks on object access. It is tempting because both involve access control; broken authentication would be correct if valid credentials were bypassed or sessions hijacked.
- ✓
Broken object level authorization (BOLA)
Why this is correct
BOLA arises when the API validates that a user is authenticated but omits an ownership check on the requested object. Substituting another user's ID in the request succeeds because authorisation is enforced at the endpoint level, not per object.
- ✗
Excessive data exposure
Why it's wrong here
Excessive data exposure is returning more object attributes than the client needs, not permitting access to another user's record. The vulnerability is absent object-level authorisation on the user ID. Excessive data exposure would be correct if the API returned sensitive fields within an authorised user's own response.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.