SSCP Systems and Application Security Practice Question
During an application security review, a penetration tester discovers that a web application allows users to view other users' profiles by changing an ID parameter in the URL (e.g., /profile?id=123). Which OWASP Top 10 vulnerability does this represent?
⚠ Common exam trap
SSCP often tests the confusion between Broken Authentication and Broken Access Control, so candidates who see 'changing an ID' and pick Broken Authentication miss that authentication is about identity, while IDOR is about authorization to access a specific object.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Insecure Direct Object References (IDOR)
Insecure Direct Object Reference (IDOR) occurs when an application exposes an internal object identifier (like a user ID in a URL) and fails to verify that the requesting user is authorized to access that object. Changing /profile?id=123 to another ID to view another user's profile is the classic IDOR pattern. It falls under OWASP's Broken Access Control category (A01:2021).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Broken Authentication
Why it's wrong here
The tester is already authenticated and simply alters an object identifier, so no credential or session weakness is exploited. Broken authentication concerns credential stuffing, weak session tokens or missing MFA; it would apply if the attacker bypassed login entirely to reach the profiles.
- ✗
Security Misconfiguration
Why it's wrong here
Changing an ID parameter to reach another user's profile is an access-control failure, not a configuration weakness. Security misconfiguration covers insecure defaults, verbose errors or unnecessary features enabled; it would be the answer if, say, directory listing or default credentials exposed the profiles.
- ✓
Insecure Direct Object References (IDOR)
Why this is correct
Manipulating the id parameter grants access to another user's profile because the application trusts client-supplied input without verifying ownership. This is IDOR: an authorisation flaw where the object reference is exposed and no access control check confirms the requester's entitlement to that record.
- ✗
Injection
Why it's wrong here
No untrusted data is interpreted as code or commands here; the id parameter is used directly as a record reference. Injection covers SQL, LDAP or OS command payloads altering query logic, and would be correct if the parameter accepted crafted syntax that the backend executed.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst is reviewing an OWASP Top 10 vulnerability report. Which vulnerability involves an attacker accessing unauthorized data by modifying URLs or API parameters?
medium- ✓ A.Insecure Direct Object References (IDOR)
- B.Cross-Site Scripting (XSS)
- C.Injection
- D.Security Misconfiguration
Why A: Insecure Direct Object References (IDOR) occur when an application exposes internal object references without proper authorization checks, allowing attackers to manipulate parameters to access other objects.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.