1.1 Identify and Describe Vulnerabilities and Exploits CYBERSECURITY-APPRENTICE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is an example of an exploit?

   • AA script that sends a specially crafted input to a web application to execute arbitrary commands
   • BA user's password that is easy to guess
   • CA firewall rule that blocks unauthorized IP addresses
   • DA missing security patch on a server
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security team at a large enterprise discovers a critical vulnerability in a widely used third-party application. The vendor has not yet released a patch, and the team is aware that the flaw is being actively exploited in the wild. The team must decide how to respond. Which of the following is the most appropriate immediate action, considering the vulnerability lifecycle?

   • AImmediately uninstall the application from all systems.
   • BClassify the vulnerability as a zero-day and ignore it because it is not a known issue.
   • CImplement temporary mitigations, such as network rules or access controls, to reduce the attack surface.
   • DWait for the vendor to release a patch before taking any action.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is an example of a vulnerability?

   • AAn attacker using a phishing email to steal credentials
   • BA network intrusion detection system (IDS) alerting on suspicious traffic
   • CA security patch that fixes a known bug
   • DA firewall rule that allows all inbound traffic on port 22
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company runs a web application that allows users to upload profile pictures. The application stores the images on a server and displays them to other users. A security researcher reports that the application is vulnerable to a stored XSS attack. The development team is considering two fixes: (1) validating the file type and (2) encoding the output when displaying the images. Which fix is the most effective in preventing the XSS attack?

   • ANeither fix is needed because the vulnerability is not exploitable.
   • BOnly encode the output when displaying the images.
   • COnly validate the file type to ensure only image files are uploaded.
   • DBoth validate the file type and encode the output.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which category of exploit targets a user's application, such as a web browser or document reader, often requiring the user to open a malicious file or visit a malicious website?

   • ALocal exploit
   • BClient-side exploit
   • CRemote exploit
   • DDenial-of-service exploit
   Reveal Solution Discussion Select an answer first