Which item is an example of improper access control?

Which item is an example of improper access control?

• A. Insecure cryptographic storage
• B. Buffer overflows
• C. Insecure direct object references
• D. Insecure communications

Answer: (C)

Access control means every request to view or manipulate a resource should be allowed only if the user is authorized for that specific resource. Insecure direct object references shows improper access control because the application uses a user-supplied reference to access an object directly without verifying that the user has permission to access that exact object. This lets someone alter a parameter (like an ID in a URL) to reach data or resources they shouldn’t be able to view, which is the essence of weak access control. The other options aren’t about who can access a resource: insecure cryptographic storage is about protecting data at rest through encryption and key management; buffer overflows are about memory safety and can lead to exploits unrelated to access permissions; insecure communications concerns protecting data in transit.

Access control means every request to view or manipulate a resource should be allowed only if the user is authorized for that specific resource. Insecure direct object references shows improper access control because the application uses a user-supplied reference to access an object directly without verifying that the user has permission to access that exact object. This lets someone alter a parameter (like an ID in a URL) to reach data or resources they shouldn’t be able to view, which is the essence of weak access control.

The other options aren’t about who can access a resource: insecure cryptographic storage is about protecting data at rest through encryption and key management; buffer overflows are about memory safety and can lead to exploits unrelated to access permissions; insecure communications concerns protecting data in transit.