Security Test Evaluation CT-SEC Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security test reveals that a web application is vulnerable to Server-Side Request Forgery (SSRF). The tester traces the vulnerability to a feature that fetches URLs provided by users. The application has a firewall that blocks requests to internal IP addresses. However, the tester successfully exploits the SSRF by using a redirect from an external URL to an internal IP. What is the root cause of the vulnerability?

   • AThe firewall is misconfigured and does not block all internal IP addresses.
   • BThe root cause is the use of a URL fetching feature, which is inherently insecure.
   • CThe SSRF vulnerability is a false positive because the firewall blocks direct requests to internal IPs.
   • DThe application does not validate the final URL after following redirects, allowing the SSRF to bypass the firewall.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company has a web application protected by a Web Application Firewall (WAF) that blocks common SQL injection patterns. A penetration test finds that the WAF can be bypassed using a specific encoding technique, and the tester successfully extracts data from the database. The WAF is the only security control for this application. What should the evaluation conclude about the effectiveness of the WAF?

   • AThe WAF is fully effective because the tester had to use a complex technique to bypass it.
   • BThe WAF is partially effective, but the application has a residual vulnerability that requires additional controls like parameterized queries.
   • CThe WAF is ineffective and should be removed because it provides a false sense of security.
   • DThe WAF is effective because it blocks common attack patterns, and the bypass is a rare edge case.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security tester completes a web application scan and finds a 'SQL Injection in login parameter' alert. The tester manually verifies the payload and confirms the database error message appears, but the application uses parameterized queries and the error is a generic custom message. The tester also notices the scanner flagged the same issue on 15 other parameters with identical evidence. What should the tester do with these findings?

   • AMark all 16 findings as false positives because parameterized queries are in use, and remove them from the report.
   • BDowngrade all findings to informational because the application uses parameterized queries, which mitigate the vulnerability.
   • CReport all 16 findings as confirmed SQL injection with high priority because the scanner evidence is consistent.
   • DConfirm the one manually verified finding as a true positive, and re-test the other 15 to determine if they share the same root cause.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security test evaluation is being conducted for a new application. The evaluation team has a limited budget and must decide whether to use an automated scanner, manual testing, or a combination. The application is a small internal tool with limited functionality, but it handles sensitive data. The team wants to minimize false positives while ensuring thorough coverage. What is the most appropriate approach?

   • AUse only manual testing to ensure accuracy and minimize false positives.
   • BUse an automated scanner for initial coverage and manual testing to verify and investigate the findings.
   • CSkip testing because the application is small and internal, and the risk is low.
   • DUse only an automated scanner to save time and budget, and rely on the scanner's reporting.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary purpose of prioritizing security findings?

   • ATo focus remediation efforts on the findings that pose the greatest risk to the organization
   • BTo increase the total number of findings in the final report
   • CTo assign each finding to a different tester for verification
   • DTo list all findings in alphabetical order for the report
   Reveal Solution Discussion Select an answer first