1.2 Describe Security Vulnerabilities and Exploits Such as Software Bugs, Weak And/or Hardcoded Passwords, OWASP Top Ten, Missing Encryption Ciphers, Buffer Overflow, Path Traversal, Cross-Site Scripting/forgery, SQL Injection, and Identification and Prioritization Using CVEs and CVSS Scores 350-701 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary goal of a path traversal attack?

   • ATo inject malicious scripts into web pages.
   • BTo access files outside the intended directory.
   • CTo perform a denial-of-service attack.
   • DTo execute arbitrary code on the server.
   Reveal Solution Discussion Select an answer first
2. 7expert · medium

   A developer is reviewing code for a network service that processes incoming packets. The code uses a function that copies data into a buffer without checking the size. The developer is considering mitigations. Which combination of mitigations is most effective to prevent exploitation?

   • AUse a web application firewall and input validation.
   • BUse encryption for all network traffic.
   • CUse a strong password policy.
   • DUse bounds checking and compile with stack canaries and ASLR.
   Reveal Solution Discussion Select an answer first
4. 8application · medium · select all that apply

   A security analyst is reviewing a web application for OWASP Top Ten risks. The analyst finds that the application is vulnerable to SQL injection and stored XSS. Which of the following are appropriate mitigations? (Select all that apply.)

   • AUse a web application firewall to filter all input.
   • BDisable error messages to hide database details.
   • CUse parameterized queries for database access.
   • DImplement output encoding for user-supplied data.
   Check answers Discussion Select an answer first
5. 9expert · medium

   A security team is using CVSS scores to prioritize vulnerabilities. They have a vulnerability with a CVSS v3.1 base score of 9.8 in a public-facing web server, and another with a score of 7.5 in an internal application. The team has limited resources. Which vulnerability should be remediated first?

   • AThe 9.8 vulnerability because it has a higher score and is publicly exposed.
   • BThe 7.5 vulnerability because it is internal and may be more critical to operations.
   • CThe 7.5 vulnerability because it is easier to patch.
   • DBoth simultaneously to ensure complete security.
   Reveal Solution Discussion Select an answer first
6. 10expert · medium

   A security team is triaging vulnerabilities in a mixed environment. They have a critical CVSS 9.8 vulnerability in a public-facing web server, a CVSS 7.5 vulnerability in an internal database, and a CVSS 5.3 vulnerability in a legacy application that is not exposed to the internet. The team has limited resources and must decide which to remediate first. Which approach should they take?

   • APrioritize the CVSS 7.5 vulnerability because it is in an internal database.
   • BRemediate all three simultaneously to ensure complete security.
   • CPrioritize the CVSS 5.3 vulnerability because it is in a legacy application.
   • DPrioritize the CVSS 9.8 vulnerability because it has the highest score and is publicly exposed.
   Reveal Solution Discussion Select an answer first