hardMultiple Choice
CISSP Practice Question: During a penetration test, a tester discovers…
During a penetration test, a tester discovers that the target web application responds to HTTP requests with a "200 OK" status for both valid and invalid session tokens on a particular API endpoint. The application uses JSON Web Tokens (JWT) for authentication. Which of the following vulnerabilities is MOST likely present?
⚠ Common exam trap
ISC2 exams often include scenarios with complex technologies like JWT to distract candidates. The trap is focusing too much on the JWT aspect and choosing a complex cryptographic flaw (like weak signing algorithms) when the actual behavior—accepting completely invalid tokens—demonstrates a simple lack of authentication enforcement (Missing authentication).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Missing authentication
If an API endpoint returns a '200 OK' status regardless of whether the session token is valid or invalid, it indicates that the endpoint does not actually enforce authentication. Therefore, 'Missing authentication' is the most likely vulnerability. If the issue were a weak JWT signing algorithm, the server would still reject tokens that do not conform to its expected validation rules (such as completely malformed or random invalid tokens). Accepting any invalid token means authentication is entirely bypassed or missing on this endpoint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Weak JWT signing algorithm
Why it's wrong here
A weak JWT signing algorithm, such as allowing `alg: none` or using a trivially guessable secret key, fundamentally compromises the token's integrity and authenticity. If the server either fails to verify the signature or uses an algorithm easily bypassed by an attacker, it will accept forged or tampered tokens. This vulnerability allows an attacker to craft arbitrary JWTs, potentially leading to privilege escalation or unauthorized access by impersonating users, as the server trusts the unverified claims within the token.
- ✗
Session fixation
Why it's wrong here
Session fixation is an attack where an attacker establishes a valid session ID with a server and then tricks a legitimate user into logging in with that pre-determined session ID. This allows the attacker to hijack the user's authenticated session once the user logs in, as the attacker already possesses the session identifier. This vulnerability primarily concerns session management and hijacking, not the server's acceptance of invalid or forged authentication tokens based on their cryptographic signature.
- ✓
Missing authentication
Why this is correct
Missing authentication implies that the application allows access to protected resources without requiring any form of user identity verification whatsoever. In this scenario, the application does perform an authentication step, evidenced by its acceptance of valid tokens and returning a 200 status. The problem isn't a complete absence of authentication, but rather a critical flaw in the validation process of the authentication tokens, allowing invalid ones to bypass security checks.
- ✗
Insecure direct object reference
Why it's wrong here
Insecure Direct Object Reference (IDOR) is a vulnerability where an application exposes a direct reference to an internal implementation object, such as a file, directory, or database record, and fails to perform proper authorization checks when a user attempts to access it. This allows an attacker to manipulate these references to access resources they are not authorized for. This issue is distinct from the problem of accepting invalid authentication tokens, which concerns the integrity and authenticity of the user's identity proof itself.
Go deeper
Related to this question
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Access token
A digital key that a computer system gives you to prove your identity and grant you permission to access specific resources or perform actions.
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.