A developer asks: what does OWASP A01 Broken Access Control mean in practice?
Broken Access Control (A01) is the top OWASP risk because it is ubiquitous. It covers IDOR (changing /users/123 to /users/124 to see another user's profile), privilege escalation (a regular user accessing admin endpoints), missing function-level access control, and CORS misconfiguration. The fix: enforce authorization server-side on every request, never trust client-supplied identifiers for access decisions. Always verify "does this authenticated user have permission for this specific resource?"
2 / 5
What is SQL injection and what is the correct prevention?
SQL injection: user input is concatenated into a SQL string, allowing the database to interpret it as SQL commands. Classic payload: ' OR '1'='1. Prevention: parameterized queries (the query structure is fixed, user input is a typed parameter). ORMs parameterize automatically but beware raw query escape hatches. Input validation is defense-in-depth, not the primary control. SQLi allows data exfiltration, destruction, and authentication bypass.
3 / 5
What is SSRF (Server-Side Request Forgery)?
SSRF: the server fetches a URL supplied by the attacker. In cloud environments (AWS, GCP, Azure), this exposes the instance metadata service at 169.254.169.254, leaking IAM credentials. Mitigation: validate and allowlist URLs, block private IP ranges after DNS resolution (rebinding attacks), enforce IMDSv2 (requires PUT token), and run fetch services in isolated network segments with no access to internal services.
4 / 5
What does XSS (Cross-Site Scripting) allow an attacker to do?
XSS: attacker-controlled script executes in the victim's browser under the application's domain, inheriting its cookies (if not HttpOnly), localStorage, and DOM access. Three types: stored (persisted in DB, widest impact), reflected (in URL, requires victim to click), DOM-based (client-side script writes untrusted data to DOM). Prevention: output encoding (HTML, JS, URL context), Content Security Policy, HttpOnly and Secure cookie flags.
5 / 5
In OWASP A06, what is a Software Bill of Materials (SBOM) used for?
SBOM: a formal inventory of all software components (libraries, frameworks, tools) and their versions. Formats: CycloneDX, SPDX. When Log4Shell (CVE-2021-44228) dropped, organizations with SBOMs identified affected systems in minutes; those without took days. Tools: Grype, Trivy, Snyk, OWASP Dependency-Check match SBOMs against the NVD (National Vulnerability Database). A06 also covers security in CI: sign artifacts, verify signatures at deploy time.
These modules build the same on-the-job skills as OWASP Security Vocabulary
— work through them together for a fuller vocabulary set.
Security— useful for CVE & advisory language (Cybersecurity)
OWASP Top 10— useful for OWASP vocabulary (Cybersecurity)
Frequently Asked Questions
What does the "OWASP Security Vocabulary" vocabulary exercise cover?
This exercise tests real IT vocabulary related to owasp security vocabulary through 5 multiple-choice questions, each built from realistic workplace sentences rather than abstract definitions.
Is this vocabulary exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is completely free — no account, sign-up, or payment required.
How many questions does this exercise have?
This exercise has 5 questions. Each one shows a real-world sentence or scenario with multiple-choice options and an explanation once you answer.
What happens after I answer a question?
You'll see immediate feedback showing whether your answer was correct, along with a short explanation of why — then a button to move to the next question, and a full results screen at the end.
Can I retry the exercise if I get questions wrong?
Yes. Once you reach the results screen, click "Try again" to reset your answers and go through the exercise from the start as many times as you like.
Do I need to create an account to take this exercise?
No account is needed. Your answers are scored in your browser during the session — nothing is saved to a server, so you can jump straight in.
Is my progress saved if I leave the page?
No — progress within an exercise resets if you navigate away or reload. Each exercise is short enough to complete in a few minutes in one sitting.
Are these vocabulary exercises connected to other topics?
Yes — this module shares real-world context with 2 other vocabulary modules. See "Related vocabulary" below to keep building a connected skill set.
How is this different from reading a glossary or blog article?
Exercises like this one are active recall drills — you have to choose the correct term or phrasing yourself, which builds retention faster than passively reading a definition.
Where can I find more vocabulary exercises?
Browse the full Vocabulary exercises hub for hundreds of modules covering Agile, DevOps, security, databases, architecture, and more — organised by IT role and skill.