Vulnerabilities and Attack Surface CAS-005 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A security administrator is developing a patch management strategy. Which step is the most important to perform before deploying a new patch to production systems?

   • ATest the patch in a non-production environment
   • BDisable automatic updates to maintain control
   • COnly patch systems that are publicly accessible
   • DImmediately deploy the patch to all systems to reduce risk
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A developer is building a web form that accepts a user's age. Which input validation technique is most appropriate to ensure the value is a valid integer between 1 and 120?

   • AWhitelist validation using a regular expression that matches only digits and a range check
   • BEncoding the input as HTML entities
   • CTruncating the input to 10 characters
   • DBlacklist validation that blocks the string 'DROP'
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security audit reveals that a web server is running with directory listing enabled, default error pages that expose stack traces, and an outdated TLS configuration. The server is internet-facing. Which action should be taken first to reduce the attack surface?

   • AMove the server to a private subnet and restrict access.
   • BDisable directory listing and customize error pages.
   • CUpgrade to the latest TLS version and disable weak ciphers.
   • DImplement a Web Application Firewall (WAF) in front of the server.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company wants to protect its web application from SQL injection attacks. The application is developed in-house and is hosted on a single server. Which set of controls represents a defense-in-depth approach?

   • AA Web Application Firewall (WAF) only.
   • BParameterized queries only.
   • CNetwork segmentation and a host-based firewall.
   • DParameterized queries, a Web Application Firewall (WAF), and regular security code reviews.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company's web application allows users to post comments that are displayed to other users. A security tester found that a user can submit a comment containing <script>alert('xss')</script> and it executes in other users' browsers. The application does not use any client-side frameworks. Which combination of controls should the development team implement to mitigate this vulnerability?

   • ASanitize input using a client-side JavaScript library only.
   • BValidate input on the server and encode output before rendering.
   • CDisable JavaScript in the users' browsers via a response header.
   • DUse a Content Security Policy (CSP) that blocks inline scripts.
   Reveal Solution Discussion Select an answer first