Identify Undocumented Functionality CSSLP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   During a security assessment, a test engineer discovers an undocumented 'backdoor' account in a web application that allows bypassing normal authentication. The account was created by a developer for troubleshooting and was never removed. What is the most appropriate remediation action?

   • ALeave the backdoor in place but restrict access to it via a firewall
   • BDisable the backdoor account and remove the associated code
   • CDocument the backdoor account in the system documentation
   • DChange the backdoor account's password to a strong value
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A financial services company discovers that a legacy application contains an undocumented 'test mode' that, when activated, disables transaction logging. The company is subject to PCI DSS compliance requirements. What is the most significant risk posed by this undocumented functionality?

   • AIt could cause the application to crash during normal operation
   • BIt could increase the application's performance overhead
   • CIt could allow unauthorized users to access administrative functions
   • DIt could violate PCI DSS compliance by disabling audit logging
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A software development team is using a third-party component that has an undocumented feature that can be enabled by setting a specific environment variable. The feature is not mentioned in the component's documentation. The team is concerned about the security implications of this feature. What is the most appropriate action for the team to take?

   • AContact the component's developer and ask them to remove the feature
   • BIgnore the feature because it is in a third-party component and not the team's responsibility
   • CSet the environment variable to disable the feature and document this in the deployment guide
   • DRemove the third-party component and rewrite the functionality in-house
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which technique is most effective for discovering undocumented functionality that is triggered by unexpected input?

   • AChecking the application's system requirements
   • BReviewing the application's marketing materials
   • CReading the user manual
   • DFuzzing the application with random or malformed inputs
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is reviewing a legacy web application and discovers that sending a request to '/admin/debug?enable=1' activates a hidden diagnostic page that exposes database connection strings. The page is not referenced anywhere in the application's documentation or user interface. Which type of issue does this represent?

   • AA denial-of-service vulnerability
   • BA cross-site scripting (XSS) vulnerability
   • CA configuration error in the web server
   • DUndocumented functionality in the application
   Reveal Solution Discussion Select an answer first