OWASP Top 10: multiple-choice review
Multiple-choice synthesis across the OWASP Top 10 (2021) — access control, crypto, injection, insecure design, SSRF, and misconfiguration as decisions you make in a real review.
Six questions that cut across the whole Top 10. Each one mirrors a call you make in a real security review — not a definition to recite, but a root cause to name and the fix a senior would reach for first.
Confirm you can connect the 2021 categories to the way apps actually break: which root cause a finding maps to, why the ranking moved, and what the durable fix is rather than the bolt-on.
An endpoint runs SELECT * FROM invoices WHERE id = ? with the id taken from the URL and bound as a parameter. A user edits the id and reads a stranger's invoice. Which category is this, and why is it NOT injection?
Why did the 2021 list rename 'Sensitive Data Exposure' to 'Cryptographic Failures', and what does that reframing change in practice?
A checkout flow accepts the item price from the client and charges that amount. There is no injection, no auth bug, and TLS is on. A reviewer still flags it. Which category, and why can't you patch your way out?
SSRF (A10) maps to roughly a single CWE and had almost no historical incidence data, yet it ranked in 2021. What does its inclusion tell you about how to read the Top 10?
A non-admin sends POST /api/admin/users/7/promote directly with curl and it succeeds — the only 'check' was that the admin button is hidden in their UI. Category and fix?
A service ships a known-vulnerable version of a logging library (a Log4Shell-class CVE) and returns stack traces to clients with full framework versions. Which two categories are in play, and which is the higher-leverage fix?
The through-line is reading a finding back to its root cause: a parameterized query that still leaks rows is access control, not injection; a renamed category points at cause over symptom; a trusted client price is insecure design no filter can fix; SSRF earned its slot by practitioner vote, not data; hidden UI is never authorization; and a vulnerable dependency plus verbose errors are two categories where the patch outranks the hardening. Now when you spot a finding in a review, the first move is naming the root cause — then the right fix becomes obvious and the bolt-on impulse easy to resist. Now when you face an unfamiliar finding, ask: what class of thing went wrong, and what would have to change at the design level so this couldn’t happen again?
Something unclear?
Ask a question about this lesson. Questions are anonymous and go straight to the author to make the lesson better.