Identify Undocumented Functionality CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A healthcare organization is deploying a new patient portal. During testing, they discover an undocumented feature that allows users to view other patients' medical records by manipulating a URL parameter. The organization is subject to HIPAA regulations. What is the most critical risk associated with this undocumented functionality?

   • AIt could lead to a HIPAA violation and unauthorized disclosure of protected health information
   • BIt could increase the application's storage requirements
   • CIt could make the application slower for legitimate users
   • DIt could cause the application to become unresponsive
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst is reviewing a mobile application and finds that pressing the volume button five times quickly triggers a hidden debug menu that displays sensitive user data. The menu is not accessible through the normal user interface. What is this an example of?

   • AA hidden feature that is not documented
   • BA denial-of-service vulnerability
   • CA cross-site scripting (XSS) vulnerability
   • DA user interface design flaw
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   During a code review, a developer notices that a legacy module contains a commented-out block of code that, when uncommented, allows a user to bypass authentication by setting a specific cookie value. The comment says 'TODO: remove before release'. What is the most likely origin of this undocumented functionality?

   • AAn unintended behavior caused by a compiler optimization
   • BA developer shortcut or leftover debug code
   • CA third-party library that was integrated into the module
   • DA deliberate backdoor inserted by a malicious insider
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security analyst discovers an undocumented feature in a web application that allows users to escalate their privileges to administrator by sending a specific HTTP request. The feature is not documented and was likely left over from development. The application is used by a government agency and is subject to strict security requirements. What is the most significant risk posed by this undocumented functionality?

   • AIt could allow unauthorized users to gain administrative access to the system
   • BIt could increase the application's storage requirements
   • CIt could cause the application to crash during normal operation
   • DIt could make the application slower for legitimate users
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a common example of undocumented functionality that could be left in a production application?

   • AA well-documented feature that is used by a small percentage of users
   • BA database table that is not referenced by any application code
   • CA debug backdoor that allows bypassing authentication when a special parameter is supplied
   • DA standard login page that uses HTTPS for secure communication
   Reveal Solution Discussion Select an answer first