Exam Bundle

Altering the hidden field cannot approve an invoice and authorized approvers continue working. That observation would verify another scenario: A web application uses a hidden HTML form field to decide whether a requester may approve an invoice. The corrective step for that other scenario is: Enforce the authorization decision on the server using the caller's identity and object rights. But Brookside Manufacturing is evaluating: An application uses an unbounded password reset token and never expires outstanding reset links after a successful reset. The necessary outcome is: A completed reset consumes the token and attempts to reuse or expire it fail safely.

An ordinary user's attempted role change is ignored or rejected and administrative role updates remain auditable. That observation would verify another scenario: A public API accepts a client-provided role value and writes it to a user profile without server-side field restrictions. The corrective step for that other scenario is: Use explicit allowlists for writable fields and maintain role assignment through privileged backend workflows. But Brookside Manufacturing is evaluating: An application uses an unbounded password reset token and never expires outstanding reset links after a successful reset. The necessary outcome is: A completed reset consumes the token and attempts to reuse or expire it fail safely.

A crafted external redirect is rejected while safe application routes work as intended. That observation would verify another scenario: An API trusts a client-provided redirect URL and sends authenticated users to an unapproved external site after login. The corrective step for that other scenario is: Validate post-login destinations against a trusted relative-path or allowed-origin policy. But Brookside Manufacturing is evaluating: An application uses an unbounded password reset token and never expires outstanding reset links after a successful reset. The necessary outcome is: A completed reset consumes the token and attempts to reuse or expire it fail safely.

Add a server-validated anti-CSRF mechanism and appropriate SameSite cookie policy for the session model. This is an appropriate control for a different issue: A state-changing account setting endpoint accepts authenticated cross-site requests without checking request origin or CSRF defenses. The Juniper Media finding instead concerns: An application uses an unbounded password reset token and never expires outstanding reset links after a successful reset. It does not demonstrate the required correction. The decisive test remains: A completed reset consumes the token and attempts to reuse or expire it fail safely.

Resolve download resources through scoped identifiers and a fixed allowlisted storage location. This is an appropriate control for a different issue: A report download endpoint accepts an arbitrary server path and returns files outside the approved reports directory. The Juniper Media finding instead concerns: An application uses an unbounded password reset token and never expires outstanding reset links after a successful reset. It does not demonstrate the required correction. The decisive test remains: A completed reset consumes the token and attempts to reuse or expire it fail safely.

Enforce the authorization decision on the server using the caller's identity and object rights. This is an appropriate control for a different issue: A web application uses a hidden HTML form field to decide whether a requester may approve an invoice. The Juniper Media finding instead concerns: An application uses an unbounded password reset token and never expires outstanding reset links after a successful reset. It does not demonstrate the required correction. The decisive test remains: A completed reset consumes the token and attempts to reuse or expire it fail safely.

A harmless disallowed file-type test cannot execute as server code and approved uploads remain accessible only to their owners. That observation would verify another scenario: A file upload service stores user files in a web-executable directory and trusts the client-supplied MIME header. The corrective step for that other scenario is: Validate file content and size, isolate storage, and serve uploads with safe content handling and permissions. But Juniper Media is evaluating: An application uses an unbounded password reset token and never expires outstanding reset links after a successful reset. The necessary outcome is: A completed reset consumes the token and attempts to reuse or expire it fail safely.

A crafted external redirect is rejected while safe application routes work as intended. That observation would verify another scenario: An API trusts a client-provided redirect URL and sends authenticated users to an unapproved external site after login. The corrective step for that other scenario is: Validate post-login destinations against a trusted relative-path or allowed-origin policy. But Juniper Media is evaluating: An application uses an unbounded password reset token and never expires outstanding reset links after a successful reset. The necessary outcome is: A completed reset consumes the token and attempts to reuse or expire it fail safely.

An ordinary user's attempted role change is ignored or rejected and administrative role updates remain auditable. That observation would verify another scenario: A public API accepts a client-provided role value and writes it to a user profile without server-side field restrictions. The corrective step for that other scenario is: Use explicit allowlists for writable fields and maintain role assignment through privileged backend workflows. But Juniper Media is evaluating: An application uses an unbounded password reset token and never expires outstanding reset links after a successful reset. The necessary outcome is: A completed reset consumes the token and attempts to reuse or expire it fail safely.

Encode untrusted content for the output context and use reviewed templates and browser controls. This is an appropriate control for a different issue: A browser application reflects user-submitted comments into HTML without context-appropriate output encoding. The Highland Education finding instead concerns: An API trusts a client-provided redirect URL and sends authenticated users to an unapproved external site after login. It does not demonstrate the required correction. The decisive test remains: A crafted external redirect is rejected while safe application routes work as intended.

Add a server-validated anti-CSRF mechanism and appropriate SameSite cookie policy for the session model. This is an appropriate control for a different issue: A state-changing account setting endpoint accepts authenticated cross-site requests without checking request origin or CSRF defenses. The Highland Education finding instead concerns: An API trusts a client-provided redirect URL and sends authenticated users to an unapproved external site after login. It does not demonstrate the required correction. The decisive test remains: A crafted external redirect is rejected while safe application routes work as intended.

Use explicit allowlists for writable fields and maintain role assignment through privileged backend workflows. This is an appropriate control for a different issue: A public API accepts a client-provided role value and writes it to a user profile without server-side field restrictions. The Highland Education finding instead concerns: An API trusts a client-provided redirect URL and sends authenticated users to an unapproved external site after login. It does not demonstrate the required correction. The decisive test remains: A crafted external redirect is rejected while safe application routes work as intended.

A user cannot retrieve or modify another customer's order by substituting the identifier. That observation would verify another scenario: A customer portal fetches an order by numeric identifier but fails to check whether the current user owns that order. The corrective step for that other scenario is: Apply object-level authorization checks on every read and mutation endpoint. But Highland Education is evaluating: An API trusts a client-provided redirect URL and sends authenticated users to an unapproved external site after login. The necessary outcome is: A crafted external redirect is rejected while safe application routes work as intended.

A harmless test string containing HTML metacharacters renders as text instead of creating executable markup. That observation would verify another scenario: A browser application reflects user-submitted comments into HTML without context-appropriate output encoding. The corrective step for that other scenario is: Encode untrusted content for the output context and use reviewed templates and browser controls. But Highland Education is evaluating: An API trusts a client-provided redirect URL and sends authenticated users to an unapproved external site after login. The necessary outcome is: A crafted external redirect is rejected while safe application routes work as intended.

Tampered browser totals are rejected and approved purchases retain correct server-calculated charges. That observation would verify another scenario: A shopping application applies a discount only in browser JavaScript and trusts the client-submitted final payment amount. The corrective step for that other scenario is: Recalculate totals server-side from authoritative prices and validated discounts rather than client-controlled arithmetic. But Highland Education is evaluating: An API trusts a client-provided redirect URL and sends authenticated users to an unapproved external site after login. The necessary outcome is: A crafted external redirect is rejected while safe application routes work as intended.

Use short-lived single-use reset tokens, securely verify ownership, and invalidate prior tokens on password change. This is an appropriate control for a different issue: An application uses an unbounded password reset token and never expires outstanding reset links after a successful reset. The Eastshore Energy finding instead concerns: An API trusts a client-provided redirect URL and sends authenticated users to an unapproved external site after login. It does not demonstrate the required correction. The decisive test remains: A crafted external redirect is rejected while safe application routes work as intended.

Use explicit allowlists for writable fields and maintain role assignment through privileged backend workflows. This is an appropriate control for a different issue: A public API accepts a client-provided role value and writes it to a user profile without server-side field restrictions. The Eastshore Energy finding instead concerns: An API trusts a client-provided redirect URL and sends authenticated users to an unapproved external site after login. It does not demonstrate the required correction. The decisive test remains: A crafted external redirect is rejected while safe application routes work as intended.

Validate file content and size, isolate storage, and serve uploads with safe content handling and permissions. This is an appropriate control for a different issue: A file upload service stores user files in a web-executable directory and trusts the client-supplied MIME header. The Eastshore Energy finding instead concerns: An API trusts a client-provided redirect URL and sends authenticated users to an unapproved external site after login. It does not demonstrate the required correction. The decisive test remains: A crafted external redirect is rejected while safe application routes work as intended.

Attempts to request unrelated files return an authorization error while approved reports remain downloadable. That observation would verify another scenario: A report download endpoint accepts an arbitrary server path and returns files outside the approved reports directory. The corrective step for that other scenario is: Resolve download resources through scoped identifiers and a fixed allowlisted storage location. But Eastshore Energy is evaluating: An API trusts a client-provided redirect URL and sends authenticated users to an unapproved external site after login. The necessary outcome is: A crafted external redirect is rejected while safe application routes work as intended.

A harmless test string containing HTML metacharacters renders as text instead of creating executable markup. That observation would verify another scenario: A browser application reflects user-submitted comments into HTML without context-appropriate output encoding. The corrective step for that other scenario is: Encode untrusted content for the output context and use reviewed templates and browser controls. But Eastshore Energy is evaluating: An API trusts a client-provided redirect URL and sends authenticated users to an unapproved external site after login. The necessary outcome is: A crafted external redirect is rejected while safe application routes work as intended.

Tampered browser totals are rejected and approved purchases retain correct server-calculated charges. That observation would verify another scenario: A shopping application applies a discount only in browser JavaScript and trusts the client-submitted final payment amount. The corrective step for that other scenario is: Recalculate totals server-side from authoritative prices and validated discounts rather than client-controlled arithmetic. But Eastshore Energy is evaluating: An API trusts a client-provided redirect URL and sends authenticated users to an unapproved external site after login. The necessary outcome is: A crafted external redirect is rejected while safe application routes work as intended.

Enforce the authorization decision on the server using the caller's identity and object rights. This is an appropriate control for a different issue: A web application uses a hidden HTML form field to decide whether a requester may approve an invoice. The Maplewood Schools finding instead concerns: A file upload service stores user files in a web-executable directory and trusts the client-supplied MIME header. It does not demonstrate the required correction. The decisive test remains: A harmless disallowed file-type test cannot execute as server code and approved uploads remain accessible only to their owners.

Validate post-login destinations against a trusted relative-path or allowed-origin policy. This is an appropriate control for a different issue: An API trusts a client-provided redirect URL and sends authenticated users to an unapproved external site after login. The Maplewood Schools finding instead concerns: A file upload service stores user files in a web-executable directory and trusts the client-supplied MIME header. It does not demonstrate the required correction. The decisive test remains: A harmless disallowed file-type test cannot execute as server code and approved uploads remain accessible only to their owners.

Use explicit allowlists for writable fields and maintain role assignment through privileged backend workflows. This is an appropriate control for a different issue: A public API accepts a client-provided role value and writes it to a user profile without server-side field restrictions. The Maplewood Schools finding instead concerns: A file upload service stores user files in a web-executable directory and trusts the client-supplied MIME header. It does not demonstrate the required correction. The decisive test remains: A harmless disallowed file-type test cannot execute as server code and approved uploads remain accessible only to their owners.

Attempts to request unrelated files return an authorization error while approved reports remain downloadable. That observation would verify another scenario: A report download endpoint accepts an arbitrary server path and returns files outside the approved reports directory. The corrective step for that other scenario is: Resolve download resources through scoped identifiers and a fixed allowlisted storage location. But Maplewood Schools is evaluating: A file upload service stores user files in a web-executable directory and trusts the client-supplied MIME header. The necessary outcome is: A harmless disallowed file-type test cannot execute as server code and approved uploads remain accessible only to their owners.

A harmless test string containing HTML metacharacters renders as text instead of creating executable markup. That observation would verify another scenario: A browser application reflects user-submitted comments into HTML without context-appropriate output encoding. The corrective step for that other scenario is: Encode untrusted content for the output context and use reviewed templates and browser controls. But Maplewood Schools is evaluating: A file upload service stores user files in a web-executable directory and trusts the client-supplied MIME header. The necessary outcome is: A harmless disallowed file-type test cannot execute as server code and approved uploads remain accessible only to their owners.

A cross-origin test cannot change account settings, but an authorized first-party request succeeds. That observation would verify another scenario: A state-changing account setting endpoint accepts authenticated cross-site requests without checking request origin or CSRF defenses. The corrective step for that other scenario is: Add a server-validated anti-CSRF mechanism and appropriate SameSite cookie policy for the session model. But Maplewood Schools is evaluating: A file upload service stores user files in a web-executable directory and trusts the client-supplied MIME header. The necessary outcome is: A harmless disallowed file-type test cannot execute as server code and approved uploads remain accessible only to their owners.

Resolve download resources through scoped identifiers and a fixed allowlisted storage location. This is an appropriate control for a different issue: A report download endpoint accepts an arbitrary server path and returns files outside the approved reports directory. The Brookside Manufacturing finding instead concerns: A file upload service stores user files in a web-executable directory and trusts the client-supplied MIME header. It does not demonstrate the required correction. The decisive test remains: A harmless disallowed file-type test cannot execute as server code and approved uploads remain accessible only to their owners.

Use explicit allowlists for writable fields and maintain role assignment through privileged backend workflows. This is an appropriate control for a different issue: A public API accepts a client-provided role value and writes it to a user profile without server-side field restrictions. The Brookside Manufacturing finding instead concerns: A file upload service stores user files in a web-executable directory and trusts the client-supplied MIME header. It does not demonstrate the required correction. The decisive test remains: A harmless disallowed file-type test cannot execute as server code and approved uploads remain accessible only to their owners.

Encode untrusted content for the output context and use reviewed templates and browser controls. This is an appropriate control for a different issue: A browser application reflects user-submitted comments into HTML without context-appropriate output encoding. The Brookside Manufacturing finding instead concerns: A file upload service stores user files in a web-executable directory and trusts the client-supplied MIME header. It does not demonstrate the required correction. The decisive test remains: A harmless disallowed file-type test cannot execute as server code and approved uploads remain accessible only to their owners.

A user cannot retrieve or modify another customer's order by substituting the identifier. That observation would verify another scenario: A customer portal fetches an order by numeric identifier but fails to check whether the current user owns that order. The corrective step for that other scenario is: Apply object-level authorization checks on every read and mutation endpoint. But Brookside Manufacturing is evaluating: A file upload service stores user files in a web-executable directory and trusts the client-supplied MIME header. The necessary outcome is: A harmless disallowed file-type test cannot execute as server code and approved uploads remain accessible only to their owners.

An ordinary user's attempted role change is ignored or rejected and administrative role updates remain auditable. That observation would verify another scenario: A public API accepts a client-provided role value and writes it to a user profile without server-side field restrictions. The corrective step for that other scenario is: Use explicit allowlists for writable fields and maintain role assignment through privileged backend workflows. But Brookside Manufacturing is evaluating: A file upload service stores user files in a web-executable directory and trusts the client-supplied MIME header. The necessary outcome is: A harmless disallowed file-type test cannot execute as server code and approved uploads remain accessible only to their owners.

A crafted external redirect is rejected while safe application routes work as intended. That observation would verify another scenario: An API trusts a client-provided redirect URL and sends authenticated users to an unapproved external site after login. The corrective step for that other scenario is: Validate post-login destinations against a trusted relative-path or allowed-origin policy. But Brookside Manufacturing is evaluating: A file upload service stores user files in a web-executable directory and trusts the client-supplied MIME header. The necessary outcome is: A harmless disallowed file-type test cannot execute as server code and approved uploads remain accessible only to their owners.