1.2 Describe Security Vulnerabilities and Exploits Such as Software Bugs, Weak And/or Hardcoded Passwords, OWASP Top Ten, Missing Encryption Ciphers, Buffer Overflow, Path Traversal, Cross-Site Scripting/forgery, SQL Injection, and Identification and Prioritization Using CVEs and CVSS Scores 350-701 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst is reviewing the configuration of a web server that supports TLS 1.0 and uses RC4 for encryption. The analyst is concerned about the security of data in transit. Which vulnerability is present, and what is the recommended action?

   • APath traversal; sanitize input.
   • BMissing or weak encryption ciphers; disable weak protocols and ciphers, and enable strong ones like TLS 1.2/1.3 with AES.
   • CSQL injection; use parameterized queries.
   • DBuffer overflow; apply a patch.
   Reveal Solution Discussion Select an answer first
2. 17expert · medium

   A web application uses cookies for session management but does not include anti-CSRF tokens in its forms. An attacker crafts a malicious page that, when visited by an authenticated user, submits a form to the application to change the user's email address. The application processes the request without verifying the origin. Which mitigation would be most effective to prevent this attack?

   • AUse HTTPS for all communications.
   • BImplement anti-CSRF tokens in all state-changing forms.
   • CSet the HttpOnly flag on cookies.
   • DValidate the Referer header.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary risk of using a weak or missing encryption cipher in a web application?

   • AThe application will be vulnerable to SQL injection.
   • BThe application will crash due to unsupported cipher suites.
   • CSensitive data can be intercepted and read by an attacker.
   • DThe server will be unable to authenticate users.
   Reveal Solution Discussion Select an answer first
5. 19expert · medium

   A security auditor is reviewing a network device that has a password policy allowing weak passwords. The auditor also finds that the device has a hardcoded backdoor account. The organization wants to improve security without disrupting operations. Which action should be prioritized?

   • AImplement multi-factor authentication for all users.
   • BDisable the hardcoded backdoor account and enforce a strong password policy.
   • COnly disable the hardcoded backdoor account.
   • DOnly enforce a strong password policy.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the key characteristic of a cross-site request forgery (CSRF) attack?

   • AThe attacker directly accesses the server's database.
   • BThe attacker injects malicious scripts into the web page.
   • CThe attacker exploits a buffer overflow in the server.
   • DThe attacker tricks the user's browser into sending an unintended request to a trusted site.
   Reveal Solution Discussion Select an answer first