1.2 Describe Security Vulnerabilities and Exploits Such as Software Bugs, Weak And/or Hardcoded Passwords, OWASP Top Ten, Missing Encryption Ciphers, Buffer Overflow, Path Traversal, Cross-Site Scripting/forgery, SQL Injection, and Identification and Prioritization Using CVEs and CVSS Scores 350-701 Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the primary impact of a successful SQL injection attack?

   • AThe attacker can cause a buffer overflow in the application.
   • BThe attacker can bypass network firewalls.
   • CThe attacker can execute arbitrary code on the client's browser.
   • DAn attacker can read, modify, or delete data in the database.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security analyst is investigating a report that a user's session cookie was stolen after visiting a malicious website. The malicious website displayed a comment that contained a script that sent the cookie to an attacker's server. Which type of XSS attack is this, and what is the primary defense?

   • ASQL injection; use parameterized queries.
   • BDOM-based XSS; use a web application firewall.
   • CReflected XSS; use HTTP-only cookies.
   • DStored XSS; implement input validation and output encoding.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the purpose of a CVE identifier?

   • ATo provide a unique, standardized identifier for a specific security vulnerability.
   • BTo list all affected software versions.
   • CTo automatically patch vulnerabilities.
   • DTo assign a severity score to a vulnerability.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A penetration tester is assessing a web application and finds that user-supplied data is reflected in the response without proper encoding, allowing an attacker to inject scripts. The tester also finds that the application is vulnerable to SQL injection. According to the OWASP Top Ten, which two categories do these findings belong to?

   • AInjection and Cross-Site Scripting (XSS)
   • BSensitive Data Exposure and XML External Entities
   • CBroken Access Control and Security Misconfiguration
   • DInsecure Deserialization and Insufficient Logging
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security analyst is reviewing a vulnerability scan report for a web application. The report lists a critical SQL injection vulnerability with a CVSS v3.1 base score of 9.8, and a moderate XSS vulnerability with a score of 6.1. The organization has limited patching resources and must prioritize remediation. Which action should the analyst take?

   • APatch the SQL injection vulnerability first because it has a higher CVSS score and likely poses a greater risk.
   • BIgnore the CVSS scores and patch based on the ease of exploitation.
   • CPatch the XSS vulnerability first because it is more common in web applications.
   • DPatch both vulnerabilities simultaneously to ensure complete remediation.
   Reveal Solution Discussion Select an answer first