A web application filters requests that contain '../' in the file parameter. A tester submits /download?file=%2e%2e%2f%2e%2e%2fetc%2fpasswd and successfully accesses the password file. Which technique is being used to bypass the filter?

Base64 encoding to bypass the filter

URL encoding to obfuscate the path traversal payload

Double encoding to bypass the filter

Unicode encoding to bypass the filter

A web form only validates input on the client side using JavaScript. Which weakness does this present?

Client-side validation prevents SQL injection

Client-side validation encrypts the data

Client-side validation can be bypassed by sending requests directly to the server

Client-side validation is sufficient for security

A web application allows users to download files by specifying a filename in the URL parameter: /download?file=report.pdf. A tester submits /download?file=../../../../etc/passwd and receives the contents of the password file. Which vulnerability is being exploited?

Command injection because the file parameter is used in a shell command

Remote file inclusion because the file parameter can be a URL

Local file inclusion because the file parameter includes a local file

Path traversal because the file parameter is used to access files outside the web root

Which vulnerability occurs when a web form does not properly validate user input, allowing an attacker to submit unexpected data types or values?

Cross-Site Request Forgery (CSRF)

Server-Side Request Forgery (SSRF)

CertNexusCyberSec First Responder (CFR)

Domain 1Objective 4

Objective 1.4 Exploit Web-Application Vulnerabilities. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 4)

Part of the 1.0 Attack Computing Environments to Test Cybersecurity domain, which accounts for 52% of the CYBERSEC-FIRST-RESPONDER exam.

35questions here

7free pages

14concepts

52%of the exam

14 Concepts in This Objective

Cross-Site Scripting (XSS)
Cross-Site Request Forgery (CSRF)
Server-Side Request Forgery (SSRF)
XML External Entity (XXE) Injection
SQL Injection (SQLi)
Path Traversal
File Inclusion (Local and Remote)
Unrestricted File Uploads
Information Disclosure via Web Proxies
Vulnerable Forms and Fields
URL Encoding
Inadequate Input Validation
Malicious Code Injection
Web Shells

Questions 16–20

16application · medium
A web application filters requests that contain '../' in the file parameter. A tester submits /download?file=%2e%2e%2f%2e%2e%2fetc%2fpasswd and successfully accesses the password file. Which technique is being used to bypass the filter?
Select an answer first
17foundation · easy
An attacker submits the following input to a search field: ; ls -la. The server executes the command and returns the directory listing. Which vulnerability is being exploited?
Select an answer first
18foundation · easy
A web form only validates input on the client side using JavaScript. Which weakness does this present?
Select an answer first
19application · medium
A web application allows users to download files by specifying a filename in the URL parameter: /download?file=report.pdf. A tester submits /download?file=../../../../etc/passwd and receives the contents of the password file. Which vulnerability is being exploited?
Select an answer first
20foundation · easy
Which vulnerability occurs when a web form does not properly validate user input, allowing an attacker to submit unexpected data types or values?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSEC-FIRST-RESPONDER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CertNexus. “CYBERSEC-FIRST-RESPONDER” is a trademark of its owner, used for identification only.