Assessment Tool Output CS0-003 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A web application scanner reports a finding with the description: 'The application reflects user-supplied input in the HTTP response without proper sanitization.' Which vulnerability is this most likely describing?

   • AInsecure deserialization
   • BCross-site request forgery (CSRF)
   • CCross-site scripting (XSS)
   • DSQL injection
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A developer uses a debugger to analyze a crash in a C++ application. The debugger shows a 'segmentation fault' occurring when the program tries to access memory at address 0x00000000. What is the most likely cause of this crash?

   • AA buffer overflow.
   • BA null pointer dereference.
   • CAn integer overflow.
   • DA stack overflow.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   While analyzing a debugger output, an analyst sees a stack trace that includes a function call to `strcpy`. What vulnerability is this most likely related to?

   • ACross-site scripting
   • BSQL injection
   • CDenial of service
   • DBuffer overflow
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An analyst is reviewing a network scan and sees that a host has port 3389/tcp open. The host is a Windows Server 2019 machine that is not part of a domain. The analyst also notices that the 'Network Level Authentication (NLA)' is disabled on the host. What is the most significant risk?

   • AThe host is exposed to the internet.
   • BThe host is not receiving security updates.
   • CThe host is more vulnerable to brute-force attacks on the RDP service.
   • DThe host is vulnerable to a remote code execution vulnerability.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A web application scanner reports a 'SQL Injection' vulnerability in the login form of a customer portal. The report also shows a 'Low' severity 'Information Disclosure' finding for a verbose error message on a different page. The development team has limited resources. What should the analyst recommend as the next step?

   • AAsk the developer to fix both issues immediately, as all vulnerabilities must be remediated at the same time.
   • BFix the information disclosure first because it is easier to resolve and can be done quickly.
   • CImmediately patch the SQL injection vulnerability and schedule the information disclosure fix for the next sprint.
   • DIgnore both findings because the scanner is known to produce false positives.
   Reveal Solution Discussion Select an answer first