Vulnerabilities SY0-701 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A web application allows users to post comments that are displayed to other users. A security tester submits a comment containing <script>alert('XSS')</script>. The script executes in the browsers of other users. Which of the following is the MOST effective mitigation?

   • ADisable JavaScript in the browser.
   • BUse a web application firewall (WAF) to block malicious requests.
   • CEncode all user-generated content before displaying it.
   • DLimit the length of comments to 100 characters.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which type of hardware vulnerability involves an attacker gaining physical access to a device to modify or extract data from its firmware or components?

   • ABuffer overflow
   • BSQL injection
   • CCross-site scripting
   • DPhysical tampering
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company allows employees to use personal smartphones for work (BYOD). The MDM solution can enforce a passcode and remote wipe, but it cannot enforce full-disk encryption on all devices because some older devices do not support it. Which of the following is the BEST approach to mitigate the risk of data exposure from lost devices?

   • AImplement a policy that prohibits storing work data on personal devices.
   • BRely on the remote wipe capability to erase the device if lost.
   • CRequire that work data be stored only in a containerized app that uses its own encryption.
   • DDisallow BYOD and issue company-owned devices that support encryption.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A web application allows users to upload profile pictures. The application stores the files in a cloud storage bucket and later serves them by embedding the file name in an HTML <img> tag. A security tester discovers that by uploading a file named "><script>alert(document.cookie)</script>.jpg, the script executes in other users' browsers. Which of the following is the MOST effective mitigation?

   • AUse a parameterized query when storing the file name in the database.
   • BImplement a Content Security Policy that disallows inline scripts.
   • CSanitize the file name by stripping HTML tags and encoding special characters before embedding it in the response.
   • DRestrict file uploads to only allow image file extensions such as .jpg and .png.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A developer is writing a web application that accepts user input for a search feature. The input is used in a SQL query. Which of the following is the BEST way to prevent SQL injection?

   • AValidate that the input contains only alphanumeric characters.
   • BUse a stored procedure that concatenates the input.
   • CEscape single quotes in user input.
   • DUse parameterized queries with prepared statements.
   Reveal Solution Discussion Select an answer first