CISSP Software Development Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Insecure direct object reference in profile URLs

  Why it's wrong here

  An Insecure Direct Object Reference (IDOR) vulnerability allows an attacker to bypass authorization by directly manipulating object references in URLs, parameters, or other inputs to access resources they are not authorized for. While it impacts overall security, IDOR is fundamentally an authorization flaw, not a weakness in the process of verifying a user's identity (authentication). The system successfully authenticated the user, but failed to properly restrict their access to specific objects or functions.

• ✗

  Verbose error messages disclosing user IDs

  Why it's wrong here

  Verbose error messages that disclose sensitive information like user IDs are a form of information leakage, often stemming from security misconfiguration rather than a direct flaw in the authentication mechanism. While this information could potentially aid an attacker in subsequent brute-force or social engineering attacks, it does not directly represent a failure in the authentication process itself, which is the verification of a user's identity. The system's authentication process might be robust, but its error handling is poorly configured.

• ✓

  Lack of multi-factor authentication for sensitive actions

  Why this is correct

  The absence of multi-factor authentication (MFA) for sensitive actions constitutes a significant broken authentication vulnerability. MFA requires users to provide two or more distinct verification factors to gain access, substantially increasing the difficulty for unauthorized users to compromise an account even if one factor (like a password) is stolen. Without MFA, a single compromised credential can grant full access to critical functions, directly weakening the authentication process for high-value operations.

• ✗

  Session timeout set to 60 minutes

  Why it's wrong here

  A session timeout of 60 minutes is a security control designed to limit the window of opportunity for session hijacking or unauthorized access if a user leaves their session unattended. While a shorter timeout might be more secure in some contexts, a 60-minute timeout is a policy decision regarding session management, not an inherent flaw in the underlying authentication mechanism itself. It does not indicate a failure in verifying user identity, but rather a configuration choice for session duration.

• ✓

  Allowing weak passwords without complexity requirements

  Why this is correct

  Allowing weak passwords without enforcing complexity requirements directly undermines the strength of the authentication mechanism. Passwords that are short, simple, or commonly used are highly susceptible to dictionary attacks, brute-force attempts, or credential stuffing, making it trivial for attackers to guess or crack them. A robust authentication system must mandate strong password policies to ensure that the primary authentication factor provides adequate security against compromise.

Go deeper

Related to this question