Avoid Vulnerability CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is a common characteristic of an SQL injection vulnerability?

   • AThe application stores passwords in plain text without encryption
   • BThe application fails to validate or sanitize user input before using it in a database query
   • CThe application allows users to upload executable files without restrictions
   • DThe application uses outdated encryption algorithms
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   During a security review, a tester identifies that a web application does not validate the length of user input before storing it in a database. The tester notes that an attacker could exploit this to cause a denial-of-service condition by submitting extremely long strings. How should the tester classify this finding?

   • AAs an exploit, because it can be used to cause a denial of service.
   • BAs a threat, because it represents a potential attacker action.
   • CAs a vulnerability, because it is a weakness in the system that could be exploited to cause harm.
   • DAs a risk, because it involves the likelihood and impact of an attack.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A development team is using a DevOps model with frequent releases. They want to ensure that security testing is integrated early and continuously. Which approach best achieves this?

   • AIntegrating SAST and software composition analysis (SCA) tools into the CI/CD pipeline.
   • BPerforming a manual code review for security issues at the end of each sprint.
   • CConducting a security audit only when a major feature is released.
   • DRunning a dynamic application security testing (DAST) tool against the production environment after each release.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of security requirements analysis in the context of vulnerability avoidance?

   • ATo test the system after implementation to find vulnerabilities
   • BTo identify and document security needs early so that vulnerabilities are not designed into the system
   • CTo select the most cost-effective security tools
   • DTo comply with legal regulations only
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security tester finds a vulnerability in a web application that allows an attacker to read arbitrary files on the server. The tester needs to document this finding so that developers can reproduce and fix it. Which information is most critical to include in the vulnerability report?

   • AThe version of the web server software.
   • BThe name of the developer who wrote the affected code.
   • CThe estimated cost of fixing the vulnerability.
   • DThe exact HTTP request that triggers the vulnerability, including the URL and parameters.
   Reveal Solution Discussion Select an answer first