CISSP Software Development Security Practice Question
A web application exposes an API that allows users to fetch data from internal network resources based on a URL parameter. An attacker discovers they can use this API to access internal servers that are not meant to be public. Which vulnerability is being exploited?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Server-side request forgery (SSRF)
SSRF allows an attacker to induce the server to make requests to internal or external resources, bypassing firewalls and access controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Insecure direct object reference (IDOR)
Why it's wrong here
IDOR occurs when an application exposes a direct reference to an internal object—such as a file, database record, or account ID—and fails to verify that the requesting user is authorized to access that specific object. In this scenario the attacker isn't manipulating an object reference; they're coercing the server itself into issuing requests to other internal hosts via a URL parameter, which is a server-side trust boundary failure, not a missing authorization check on a user-owned resource.
- ✗
Remote code execution (RCE)
Why it's wrong here
Remote code execution means an attacker gets the server to execute arbitrary commands or code they supply, typically through an unsafe deserialization, injection, or file-upload flaw. Nothing in this scenario shows the attacker running code on the server—they're only causing the server to make outbound HTTP requests to internal addresses on their behalf. Triggering unintended network requests is a distinct vulnerability class from achieving code execution, even though a chained SSRF could sometimes lead to RCE in specific environments.
- ✗
Cross-site request forgery (CSRF)
Why it's wrong here
CSRF tricks an already-authenticated victim's browser into submitting a state-changing request to an application without their consent, exploiting the browser's automatic inclusion of session cookies. That requires a human victim's browser and session to be involved. Here, the attacker is directly manipulating a URL parameter to make the server itself issue requests, with no victim browser, session hijacking, or cross-site request forwarding taking place, so it doesn't fit the CSRF pattern.
- ✓
Server-side request forgery (SSRF)
Why this is correct
SSRF is exactly this pattern: the API accepts a user-supplied URL or parameter and the server-side code then fetches that resource on the caller's behalf. Because the request originates from the server, it inherits the server's network position and often bypasses firewall rules that would block a direct external request. Attackers abuse this to reach internal-only services, cloud metadata endpoints, or other systems that were never intended to be reachable from outside the network perimeter.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.