Threats, Threat Sources, and Vulnerabilities EHE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team is prioritizing remediation for a web application. They find two issues: (1) a missing input validation that could allow SQL injection, and (2) a misconfigured CORS policy that allows any origin. Both are exploitable, but the SQL injection could lead to full database compromise, while the CORS issue could allow cross-site requests. Which vulnerability category should be addressed first, and why?

   • AHuman factor vulnerability first, because users are the weakest link.
   • BTechnical vulnerability (SQL injection) first, because it has higher potential impact.
   • CBoth equally, because they are the same category.
   • DConfiguration vulnerability (CORS) first, because it is easier to fix.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security analyst is evaluating two risks: (1) a critical SQL injection flaw in an internal HR application that is only accessible by 10 employees, and (2) a low-severity misconfiguration in a public-facing web server that exposes server version information. Which risk should be prioritized for remediation, and why?

   • AThe SQL injection flaw, because it has high exploitability and potential impact, even though the attack surface is limited to internal users.
   • BBoth should be addressed simultaneously because they are equally critical.
   • CNeither should be prioritized because the organization has no compliance requirements.
   • DThe web server misconfiguration, because it is public-facing and more likely to be exploited by external attackers.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is classified as a physical threat?

   • AA denial-of-service attack that overwhelms a web server
   • BA ransomware attack that encrypts files and demands payment
   • CAn unauthorized person gaining physical access to a server room and stealing hardware
   • DA phishing email that tricks a user into clicking a malicious link
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is an example of a technical vulnerability?

   • AA lack of security awareness training for staff
   • BA firewall rule that allows unnecessary inbound traffic
   • CA server running outdated software with known security flaws
   • DAn employee who writes their password on a sticky note
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company's office is hit by a tornado that destroys the server room and all on-site backups. Which threat type and source combination is this, and what vulnerability made the impact worse?

   • AMalware threat; insider; the vulnerability is a misconfigured firewall
   • BSocial engineering threat; external hacker; the vulnerability is weak passwords
   • CPhysical threat; natural disaster; the vulnerability is the lack of off-site backups
   • DTechnical threat; human error; the vulnerability is outdated software
   Reveal Solution Discussion Select an answer first