Mitigation Controls CS0-003 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A web application accepts a user ID from a query string parameter and uses it to look up records in a database. A security analyst discovers that an attacker can modify the parameter to include SQL commands, causing the database to return unauthorized data. Which control should be implemented to prevent this injection vulnerability?

   • ADisable error messages on the web server.
   • BUse a stored procedure that concatenates the user input directly into the SQL string.
   • CUse parameterized queries or prepared statements for all database operations.
   • DEncode all output that is displayed to the user.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst is reviewing a web application that accepts user input for a search feature. The analyst is concerned about injection attacks that could manipulate the application's behavior. Which control should be implemented to ensure that user input is treated as data, not as executable code?

   • AInput sanitization that removes or encodes dangerous characters.
   • BInput validation that rejects any input containing special characters.
   • COutput encoding that escapes user input when it is displayed.
   • DEncryption of user input before it is processed.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which coding practice is most directly effective at preventing a classic stack-based buffer overflow?

   • AIncreasing the stack size
   • BPerforming bounds checking before writing to arrays
   • CUsing longer variable names
   • DAdding more comments to the code
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst is implementing a Content Security Policy for a web application that uses inline event handlers in some legacy pages. The analyst wants to mitigate XSS but does not want to break the existing functionality. Which CSP directive should be used to allow inline scripts while still restricting external script sources?

   • Ascript-src 'none'
   • Bscript-src 'self'
   • Cdefault-src 'self'
   • Dscript-src 'self' 'unsafe-inline'
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst is evaluating mitigations for a buffer overflow vulnerability in a Linux application. The analyst notes that the application loads shared libraries at predictable memory addresses, making it easier for an attacker to redirect execution to a useful gadget. Which control should be enabled to make these addresses unpredictable?

   • ASet the kernel parameter kernel.randomize_va_space to 0.
   • BEnable Address Space Layout Randomization (ASLR) in the kernel.
   • CEnable Data Execution Prevention (DEP) for the application.
   • DCompile the application with the -fno-stack-protector flag.
   Reveal Solution Discussion Select an answer first