CCSP Practice Question: Which OWASP Top 10 vulnerability is most directly…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Security Misconfiguration

  Why it's wrong here

  Security misconfiguration covers exposed defaults, verbose errors and open storage, not a valid request whose identifier is changed to read another user's data. It is tempting because cloud APIs are frequently misconfigured, but the described flaw is Broken Object Level Authorisation, requiring per-object ownership validation.

• ✗

  Injection

  Why it's wrong here

  Injection covers untrusted input altering queries or commands, not authorised requests whose object identifiers are swapped to reach another tenant's records. It is tempting because both involve crafted input, yet the scenario describes Broken Object Level Authorisation, where the API omits per-object ownership checks.

• ✓

  Broken Object Level Authorization

  Why this is correct

  Broken Object Level Authorization occurs when an API trusts a client-supplied object identifier without verifying the caller owns it, so manipulating a parameter exposes another user's data. It is the OWASP API Security Top 1 risk.

• ✗

  Cross-Site Request Forgery (CSRF)

  Why it's wrong here

  CSRF exploits a victim's ambient session cookie to force unintended requests, not parameter tampering that reads another user's records. It is tempting because both involve forged requests, but the described manipulation of object identifiers is Broken Object Level Authorisation, an API access-control flaw.