Certified Incident Handler (CIH) Practice Ecam

Which of the following practices will not help incident responders eradicate broken access control attacks?

1. Permit using client-side caching mechanism

2. Implement strict session management

3. Apply role-based access control

4. Regularly audit access control mechanisms

The correct answer is: Permit using client-side caching mechanism

The correct choice is the option related to the client-side caching mechanism, as it does not contribute to the eradication of broken access control attacks. Client-side caching typically involves storing parts of web applications in a browser's cache to reduce load times and improve user experience. While this can be useful for performance, it does not fundamentally strengthen access control mechanisms. On the other hand, implementing strict session management, applying role-based access control, and regularly auditing access control mechanisms are all critical practices that directly enhance security against access control vulnerabilities. Strict session management ensures that user sessions are handled securely, minimizing risks of session hijacking or unauthorized access. Role-based access control establishes clear access rights based on user roles, effectively limiting what users can do based on their authenticated identity. Regular audits of access control mechanisms help identify and rectify gaps or weaknesses in the current access control policies, ensuring they remain effective against potential threats.