Objective 3.3 Protect Software. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What can happen if sanitization is applied only to some user inputs?

   • AThe application will automatically block all attacks
   • BAttackers can exploit the unsanitized inputs to launch XSS attacks
   • CThe application will run faster
   • DThe database will encrypt all data automatically
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary purpose of prepared statements and parameterized queries?

   • ATo make SQL queries run faster
   • BTo separate SQL logic from data, preventing injection
   • CTo encrypt data in the database
   • DTo allow multiple users to access the database simultaneously
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A web application has multiple input fields, including a search box and a contact form. The developer sanitizes the search box input but forgets to sanitize the contact form's message field. What is the most likely security consequence?

   • AAn attacker can inject a malicious script through the contact form, leading to stored XSS when the message is displayed to administrators.
   • BThe contact form will reject all legitimate messages because sanitization is not applied.
   • CThe application will crash because the contact form input is not sanitized.
   • DThe search box will stop working because sanitization is applied inconsistently.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company allows employees to upload documents to an internal knowledge base. The security team discovers that uploaded documents contain hidden metadata, such as author names and internal file paths. What should the team do to reduce this information leakage?

   • AScrub the metadata from all uploaded files before storing them.
   • BConvert all files to a plain text format.
   • CRename the files with random names before storing them.
   • DStore the files in a password-protected directory.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   How can stored procedures help mitigate SQL injection attacks?

   • ABy hiding the database schema from developers
   • BBy encapsulating database operations and using parameters
   • CBy encrypting all data in the database
   • DBy allowing dynamic SQL to be built inside the procedure
   Reveal Solution Discussion Select an answer first