CCOA: Certified Cybersecurity Operations AnalystDemo

By Isaca · Question Mode

QuestionQ40

Cybersecurity Principles and Risks

Exposing a session identifier in a URL is an example of which web-application-specific risk?

  • A Identification and authentication failures
  • B Insecure design and implementation
  • C Broken access control
  • D Cryptographic failures
Explanation

A session identifier is an authentication credential. Including it in a URL can disclose it through logs, browser history, referrer headers, bookmarks, or shared links, potentially allowing session hijacking or fixation. OWASP identifies session IDs in URLs as an authentication/session-management failure.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!