Mitigation Controls CS0-003 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security analyst is hardening a web application that allows users to upload profile pictures. The application already uses output encoding for user-generated content, but the analyst wants to add a Content Security Policy to further reduce the risk of XSS. The application also loads images from a third-party CDN. Which CSP directive should be configured to allow images from the CDN while still preventing script injection?

   • Aimg-src 'self' https://cdn.example.com; script-src 'self'
   • Bdefault-src 'none'; img-src 'self'
   • Cscript-src 'self' https://cdn.example.com; img-src 'self'
   • DContent-Security-Policy: allow all
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security analyst is responsible for a machine learning system that classifies emails as spam or not spam. An attacker has been submitting carefully crafted emails that are misclassified, causing the model to learn incorrect patterns. The analyst needs to implement a control that will prevent the attacker from influencing the model's training data. Which approach is most effective?

   • AEncrypt the training data to prevent the attacker from viewing it.
   • BIncrease the model's complexity so it can better distinguish between legitimate and malicious emails.
   • CUse a larger training dataset from a public source to dilute the impact of the attacker's samples.
   • DImplement a data validation pipeline that checks for anomalies and quarantines suspicious samples before they are used in training.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security analyst is reviewing a web application that allows users to submit HTML content that is later displayed to other users. The application currently uses a rich text editor that allows some HTML tags. The analyst is concerned about stored XSS attacks. Which combination of controls should be implemented to provide the most robust protection while still allowing the rich text functionality?

   • ADisable all HTML tags and display the content as plain text.
   • BUse a blacklist to remove dangerous tags like <script> and <iframe>.
   • CUse a whitelist-based input validation that allows only safe HTML tags and attributes, and apply output encoding in the context where the content is rendered.
   • DStore the content in a database and use a web application firewall to block requests containing script tags.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company's web application has been the target of multiple reflected XSS attacks. The development team has already implemented output encoding, but the security team wants an additional control that will stop the browser from executing any script that is not explicitly allowed by the application. Which control should be implemented?

   • AAdd a Content-Security-Policy header that specifies 'script-src' with a list of trusted sources.
   • BSet the 'X-Frame-Options' header to DENY.
   • CConfigure the web server to reject any request containing a '<script>' string.
   • DEnable HTTP Strict Transport Security (HSTS) on the web server.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which practice is most directly aimed at preventing data poisoning in a data collection pipeline?

   • AUsing a load balancer
   • BEnabling multi-factor authentication
   • CSanitizing data inputs
   • DBacking up the data regularly
   Reveal Solution Discussion Select an answer first