1. Home
2. All questions
3. Question 51

CISSP study material · question 51 of 500

A penetration test of an internal staff portal reports that the administrative menu is hidden by JavaScript for standard users, but a command-line HTTP client calling the /admin/users endpoint with an ordinary user's session returns the full staff list. Which remediation addresses the underlying broken access control?

• Access management
• Software security

1. Move the administrative endpoints to a separate hostname that the browser reaches only after setting a role cookie
2. Enforce the authorisation check in server-side code on every request, denying by default except for genuinely public resources
3. Have the client inspect the role claim in the signed token and suppress the request when the role is insufficient
4. Obfuscate and minify the client bundle so the administrative endpoint paths stay hidden from an attacker

Challenge yourself on this topic → Study as cards