Avoid Vulnerability CT-STE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security tester discovers a vulnerability in a web application that allows an attacker to bypass authentication. The tester needs to report this to the development team. Which approach is most effective for ensuring the vulnerability is understood and fixed?

   • AFixing the vulnerability directly in the code without informing the development team.
   • BCreating a detailed report that includes the steps to reproduce, the impact, and recommended fixes.
   • CSending a brief email to the development team stating that there is an authentication bypass vulnerability.
   • DReporting the vulnerability to the CEO and asking them to instruct the development team to fix it.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security architect is conducting a threat modeling session for a new e-commerce platform. The platform will integrate with a third-party payment gateway. The team has limited time for the session. Which threat modeling approach is most efficient for identifying vulnerabilities that could be introduced by the integration?

   • AConducting a penetration test on the payment gateway before integration.
   • BReviewing the payment gateway's documentation for known vulnerabilities.
   • CFocusing on the data flow between the platform and the payment gateway, and identifying trust boundaries.
   • DListing all possible threats to the entire platform, including those unrelated to the payment gateway.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which technique is commonly used in threat modeling to identify potential attack vectors?

   • AReviewing server logs for past attacks
   • BInterviewing end users about their preferences
   • CRunning a vulnerability scanner on the production system
   • DCreating data flow diagrams and analyzing entry points
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security tester is reviewing a web application that displays user-generated content. The application does not sanitize the content before rendering it in HTML pages. Which vulnerability is most likely present, and what is the most effective avoidance strategy?

   • AInsecure deserialization; validate input before deserializing.
   • BSQL injection; use parameterized queries.
   • CCross-site scripting; encode all output before rendering.
   • DBuffer overflow; use safer string functions.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A team is designing a new online forum where users can post messages that are visible to all registered users. During threat modeling, they identify that an attacker could post a message containing malicious JavaScript that would execute in other users' browsers. Which threat modeling technique would most directly help them address this vulnerability before implementation?

   • AListing all potential threat actors and their motivations.
   • BDrawing a data flow diagram that shows the path of a post from the user's browser to the server and then to other users' browsers, with trust boundaries.
   • CCreating an attack tree that breaks down the goal of executing JavaScript in another user's browser into sub-goals.
   • DAssigning a risk rating to each identified threat based on likelihood and impact.
   Reveal Solution Discussion Select an answer first