A security review of a network automation web application identifies that user-supplied data is reflected in error pages without encoding, and that login credentials are sent in the URL query string. Which two OWASP Top 10 risk categories are most directly exemplified by these findings?

Insecure Deserialization and XXE

SQL Injection and Broken Access Control

XSS and Sensitive Data Exposure

CSRF and Security Misconfiguration

What is the primary purpose of the OWASP Top 10 list?

To provide a comprehensive list of all known vulnerabilities in every web application framework.

To serve as a legal compliance standard that all web applications must meet.

To rank the most critical security risks to web applications based on prevalence and impact.

To provide a step-by-step guide for penetration testing web applications.

A user reports that when they visit a network status page, an alert box appears and the page displays content from a URL parameter. The alert only appears when the parameter contains a script tag. Which type of XSS is this, and which mitigation is most directly effective?

Stored XSS; sanitize the parameter before saving it to a database

Reflected XSS; encode the URL parameter before rendering it in the page

DOM-based XSS; disable JavaScript in the browser

A developer is writing a function that looks up a user by ID. The ID is taken from a query parameter and used in a SQL statement. Which code pattern is the safest?

Escape the ID using a database-specific escape function

Cast the ID to an integer before concatenating it into the query

Use a prepared statement with a parameter placeholder for the ID

Use a stored procedure that accepts the ID as a string and concatenates it

A web application builds a SQL query by concatenating user input directly into the WHERE clause. An attacker submits a value that alters the query to return all records from the table. What is the primary impact of this type of attack?

Unauthorized disclosure of data

Denial of service to the web server

Cross-site scripting in the browser

CiscoCertified Network Associate Automation (CCNA Automation)

Domain 4Objective 10

10. Describe Top OWASP Threats (such as XSS, SQL Injections, and CSRF) 200-901 Practice Questions (Page 7)

Part of the 4.0 Application Deployment and Security domain, which accounts for 15% of the 200-901 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

5concepts

15%of the exam

Questions 31–35

31application · medium
A security review of a network automation web application identifies that user-supplied data is reflected in error pages without encoding, and that login credentials are sent in the URL query string. Which two OWASP Top 10 risk categories are most directly exemplified by these findings?
Select an answer first
32foundation · easy
What is the primary purpose of the OWASP Top 10 list?
Select an answer first
33application · medium
A user reports that when they visit a network status page, an alert box appears and the page displays content from a URL parameter. The alert only appears when the parameter contains a script tag. Which type of XSS is this, and which mitigation is most directly effective?
Select an answer first
34application · medium
A developer is writing a function that looks up a user by ID. The ID is taken from a query parameter and used in a SQL statement. Which code pattern is the safest?
Select an answer first
35foundation · easy
A web application builds a SQL query by concatenating user input directly into the WHERE clause. An attacker submits a value that alters the query to return all records from the table. What is the primary impact of this type of attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-901

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-901” is a trademark of its owner, used for identification only.