SSCP Systems and Application Security Practice Question
During an application security review, a penetration tester discovers that a web application allows users to view other users' profiles by changing an ID parameter in the URL (e.g., /profile?id=123). Which OWASP Top 10 vulnerability does this represent?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Insecure Direct Object References (IDOR)
Insecure Direct Object References (IDOR) occur when an application exposes internal object references without proper access control checks. Injection involves sending malicious data. Broken Authentication relates to authentication flaws. Security Misconfiguration involves improper setup.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Broken Authentication
Why it's wrong here
Broken Authentication involves flaws in authentication mechanisms.
- ✗
Security Misconfiguration
Why it's wrong here
Misconfiguration is about default settings, not direct object exposure.
- ✓
Insecure Direct Object References (IDOR)
Why this is correct
IDOR allows unauthorized access by manipulating object IDs.
- ✗
Injection
Why it's wrong here
Injection involves untrusted data sent to an interpreter, not direct object reference.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst is reviewing an OWASP Top 10 vulnerability report. Which vulnerability involves an attacker accessing unauthorized data by modifying URLs or API parameters?
medium- ✓ A.Insecure Direct Object References (IDOR)
- B.Cross-Site Scripting (XSS)
- C.Injection
- D.Security Misconfiguration
Why A: Insecure Direct Object References (IDOR) occur when an application exposes internal object references without proper authorization checks, allowing attackers to manipulate parameters to access other objects.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.