A library application behaves differently when the same parameter name appears twice in a request and authorization checks flip unexpectedly. What technique class is the tester observing?
Select an answer to reveal the explanation.
Short Explanation
When two clerks read the same form field differently, chaos follows. Duplicate parameters that change which value the app trusts are HTTP parameter pollution — parsers disagree, and authz can slip. That is not BGP drama or a Kerberos cipher debate.
Full Explanation
When a library application behaves differently because the same parameter name appears twice and authorization checks flip, the tester is observing HTTP parameter pollution: divergent parsers (proxies, frameworks, app code) may honor the first, last, or concatenated value, producing inconsistent access decisions.
Certificate pinning failure on a mobile companion app is a separate mobile-trust theme. BGP route hijacking between branches is a network routing threat, not an HTTP parameter-parsing issue. Kerberos encryption-type downgrade belongs to authentication-protocol assessments, not web parameter confusion.
Exam caveat: pollution findings depend on how each tier parses duplicates; evidence should show which value the security decision used.
Operational check: submit duplicate parameter names with conflicting identifiers or roles in authorized tests, compare resulting authorization outcomes, and document parser disagreement. Recommend canonicalization—reject duplicates or define a single authoritative parse—for civic request handling. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services.