OWASP-TOP10-2025 Practice Test

OWASP-TOP10-2025 practice test: what's covered

• Access Control - Misconfiguration - Supply Chain - Crypto - Injection - Design - Auth - Integrity - Logging - Exceptions

Free OWASP-TOP10-2025 sample questions

1. A claims portal accepts /claims/{id} from any authenticated user and returns another policyholder record when the id is changed. Which response best matches Access Control risk treatment under OWASP Top 10:2025?

   • A. enforce object and tenant authorization in the service before returning the claim
   • B. hide claim identifiers in the front end
   • C. add a banner telling users not to alter URLs
   • D. rename the endpoint without changing authorization logic
   Show answer

   Correct: A. A01:2025 Broken Access Control is about object ownership, tenant boundaries, role checks, deny-by-default rules, and server-side enforcement. The correct response changes the trusted control path and can be tested. The other options are wrong because they rely on obscurity, user behavior, cosmetic changes, or after-the-fact observation instead of fixing the unsafe design or implementation.

2. An admin link is hidden in the React menu, but a standard user can call POST /admin/users directly with curl. Which response best matches Access Control risk treatment under OWASP Top 10:2025?

   • A. keep the link hidden and rely on normal users not using curl
   • B. enforce function-level authorization on the server for every privileged endpoint
   • C. add a stronger color to the admin menu item
   • D. move admin routes lower in the JavaScript bundle
   Show answer

   Correct: B. A01:2025 Broken Access Control is about object ownership, tenant boundaries, role checks, deny-by-default rules, and server-side enforcement. The correct response changes the trusted control path and can be tested. The other options are wrong because they rely on obscurity, user behavior, cosmetic changes, or after-the-fact observation instead of fixing the unsafe design or implementation.

3. A GraphQL resolver lets a caller pass any accountId and receives subscription details across tenants. Which response best matches Access Control risk treatment under OWASP Top 10:2025?

   • A. switch GraphQL field names to shorter aliases
   • B. disable introspection in production and keep the resolver unchanged
   • C. reuse the same tenant authorization policy in every resolver before loading account data
   • D. require HTTPS only and assume authorization is covered
   Show answer

   Correct: C. A01:2025 Broken Access Control is about object ownership, tenant boundaries, role checks, deny-by-default rules, and server-side enforcement. The correct response changes the trusted control path and can be tested. The other options are wrong because they rely on obscurity, user behavior, cosmetic changes, or after-the-fact observation instead of fixing the unsafe design or implementation.

4. A file download route validates login, then streams /reports/{fileName} from a folder that contains all customer exports. Which response best matches Access Control risk treatment under OWASP Top 10:2025?

   • A. compress all exported reports into a single archive
   • B. make report names longer and harder to guess
   • C. move the reports folder to a deeper directory path
   • D. bind each requested file to the caller account and reject path or ownership mismatches
   Show answer

   Correct: D. A01:2025 Broken Access Control is about object ownership, tenant boundaries, role checks, deny-by-default rules, and server-side enforcement. The correct response changes the trusted control path and can be tested. The other options are wrong because they rely on obscurity, user behavior, cosmetic changes, or after-the-fact observation instead of fixing the unsafe design or implementation.

5. A tester reviews the access-control test plan for a multi-tenant SaaS application. For broken access control, which TWO actions best reduce real production risk? (Choose TWO)

   • A. use two test tenants and attempt read, update, delete, and function access across tenant boundaries
   • B. automate negative tests for unauthorized cross-object and cross-tenant access attempts
   • C. only test that the login page rejects bad passwords
   • D. only scan response headers for missing CSP
   Show answer

   Correct: A and B. A01:2025 Broken Access Control focuses on object ownership, tenant boundaries, role checks, deny-by-default rules, and server-side enforcement. The two correct actions enforce that control in the server, pipeline, or operating process. The other options are cosmetic or incomplete because they do not prevent the vulnerable behavior, prove trust, or create useful evidence.

Last updated: 2026-10-19

OWASP-TOP10-2025 practice test FAQ