Skip to content

CS KAIROS · LEARNING LIBRARY

M14 · Hacking Web Applications · Q&A

Check understanding with original scenarios and a reason for every option. These answers do not establish exam or practical readiness.

Scenario questions

ceh-m14-access-q1 · Original practice

Can UUID report IDs replace authorization?

JavaScript is off: read the answer and explanation

B

An ID can become known through other routes.
Identification and authorization have different roles.
Hiding a link does not control direct requests.
UUIDs can be useful identifiers, but not substitutes for authorization.

ceh-m14-access-q2 · Original practice

User B has the same role as A and requests A’s private report without sharing. What should happen?

JavaScript is off: read the answer and explanation

A

This follows the stated object boundary.
The same role does not imply the same object access.
A valid URL only identifies a resource.
The data is already disclosed; a warning cannot retract it.

Continue to safe practice →