1.2 Describe Security Vulnerabilities and Exploits Such as Software Bugs, Weak And/or Hardcoded Passwords, OWASP Top Ten, Missing Encryption Ciphers, Buffer Overflow, Path Traversal, Cross-Site Scripting/forgery, SQL Injection, and Identification and Prioritization Using CVEs and CVSS Scores 350-701 Practice Questions (Page 3)

Questions 11–15

1. 11expert · medium

   A security team is reviewing a web application that uses dynamic SQL queries. They have identified a SQL injection vulnerability that could allow an attacker to extract data from the database. The team is considering mitigations. Which approach is most effective and should be implemented first?

   • AEncrypt the database to protect data at rest.
   • BDisable error messages to hide database details.
   • CUse a web application firewall to filter malicious input.
   • DUse parameterized queries or prepared statements.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Why are hardcoded passwords considered a significant security risk?

   • AThey are often weak and can be easily guessed by attackers.
   • BThey are automatically rotated by the system, causing authentication failures.
   • CThey are stored in plain text and can be read by anyone with access to the code.
   • DThey are always stored in encrypted form, making them difficult to manage.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which type of software bug is most directly associated with an attacker being able to execute arbitrary code by supplying crafted input that exceeds an allocated memory buffer?

   • AInteger overflow
   • BUse-after-free
   • CBuffer overflow
   • DRace condition
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   How is a CVSS score used in vulnerability prioritization?

   • AIt identifies the exact exploit code needed to attack the vulnerability.
   • BIt provides a numerical severity rating that helps prioritize which vulnerabilities to address first.
   • CIt determines the legal consequences of a vulnerability.
   • DIt automatically patches the vulnerability.
   Reveal Solution Discussion Select an answer first
6. 15expert · medium

   A developer is reviewing code for a web application that handles user input. The code uses a function that copies data into a buffer without checking the size, and also concatenates user input into a SQL query. Which vulnerabilities are present, and what is the best combined mitigation?

   • ABuffer overflow and XSS; use bounds checking and output encoding.
   • BSQL injection and CSRF; use parameterized queries and anti-CSRF tokens.
   • CBuffer overflow and path traversal; use bounds checking and input validation.
   • DBuffer overflow and SQL injection; use bounds checking and parameterized queries.
   Reveal Solution Discussion Select an answer first