Objective 3.3 Protect Software. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which file extension should be blocked in a typical web application upload?

   • A.png
   • B.php
   • C.jpg
   • D.txt
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Why is scrubbing metadata from uploaded files important?

   • ATo speed up the upload process
   • BTo make the file smaller
   • CTo improve image quality
   • DTo reduce the risk of information leakage
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of applying security patches to software?

   • ATo improve the user interface of the application
   • BTo add new features requested by users
   • CTo fix known vulnerabilities and reduce attack surface
   • DTo replace the software with a newer version entirely
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A web application uses anti-CSRF tokens to protect forms. The tokens are generated per session and stored in the user's session. An attacker discovers that the token is not being rotated after login, and the same token is used for the entire session. What is the primary security risk of this implementation?

   • AThe token will be stored in the browser's history, exposing it to other users.
   • BThe token will be invalidated after a short time, causing legitimate users to be locked out.
   • CIf an attacker obtains the token, they can reuse it for the entire session, increasing the window for CSRF attacks.
   • DThe token will be sent to the server in the URL, making it visible in logs.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A development team is building a search feature that queries a database. The team wants to prevent SQL injection while allowing users to search for partial matches (e.g., 'prod%' for products starting with 'prod'). Which combination of techniques should be used?

   • AUse a parameterized query with a wildcard character appended to the user input, and validate that the input does not contain SQL metacharacters.
   • BEscape the user input using a custom function and then concatenate it into the query.
   • CConcatenate the user input directly into the query and rely on the database to reject malicious input.
   • DUse a stored procedure that builds the query dynamically based on the input.
   Reveal Solution Discussion Select an answer first