Objective 3.3 Protect Software. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A company runs a legacy customer relationship management (CRM) application on Windows Server 2016. The vendor releases a critical security patch, but the patch requires a newer version of the .NET Framework than is currently installed. The IT team is concerned about breaking the application. What should the team do first?

   • ARoll back the application to an older version that does not require the .NET Framework update, then apply the patch.
   • BUpgrade the .NET Framework on all production servers first, then apply the security patch without additional testing.
   • CInstall the patch directly on a test server that mirrors production, then run the application's core workflows before deploying to production.
   • DDeploy the patch to production immediately because the vulnerability is critical and the risk of exploitation outweighs potential application downtime.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   How is an anti-CSRF token typically generated?

   • AAs the user's password hashed with MD5
   • BAs a random value unique to the user's session
   • CAs a fixed value stored in the HTML source
   • DAs the current timestamp
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   What is the purpose of checking the Content-Type header of an uploaded file?

   • ATo encrypt the file during upload
   • BTo determine the file's size
   • CTo compress the file for storage
   • DTo ensure the file matches the expected type
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A web application accepts PDF uploads. The security team is concerned about attackers uploading malicious files with a .pdf extension but a different MIME type. What should the application do to ensure the file is actually a PDF?

   • ACheck the Content-Type header sent by the client and reject if it does not match 'application/pdf'.
   • BRely on the file extension and assume the file is a PDF if it ends with '.pdf'.
   • CInspect the file's magic bytes (e.g., '%PDF') to verify the file signature matches the expected format.
   • DStore the file in a separate directory and serve it with a 'Content-Disposition: attachment' header.
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   What does server-side validation of anti-CSRF tokens accomplish?

   • AIt encrypts the form data before submission
   • BIt verifies that the request is legitimate and not forged
   • CIt logs all form submissions
   • DIt checks the user's password strength
   Reveal Solution Discussion Select an answer first