1.1 Identify and Describe Vulnerabilities and Exploits CYBERSECURITY-APPRENTICE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In the vulnerability lifecycle, what typically happens immediately after a vulnerability is discovered?

   • APatching
   • BMitigation
   • CExploitation
   • DDisclosure
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a common vulnerability type that occurs when an application does not properly validate user input, allowing an attacker to execute malicious SQL statements?

   • ABuffer overflow
   • BCross-site scripting (XSS)
   • CSQL injection
   • DMisconfiguration
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security analyst is evaluating the risk of a newly discovered zero-day vulnerability in a web server. The vulnerability allows remote code execution, but the exploit requires a specific configuration that is not present in the company's environment. The analyst must decide whether to treat this as a high risk. Which factor is most important in this decision?

   • AThe fact that it is a remote code execution vulnerability, so it is always a high risk.
   • BThe specific configuration required for the exploit and whether it is present in the environment.
   • CThe fact that it is a zero-day, so it is always a high risk.
   • DThe fact that the vendor has not released a patch, so the risk is high.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A small e-commerce company hosts its product catalog on a web server. During a routine security review, an analyst discovers that the search box on the website directly concatenates user input into a database query without any sanitization. An attacker could submit a crafted string to retrieve all customer records. Which vulnerability is present, and what would the crafted string be classified as?

   • AThe weakness is an SQL injection vulnerability, and the crafted string is an exploit that targets the server.
   • BThe weakness is a cross-site scripting (XSS) flaw, and the crafted string is a remote exploit.
   • CThe weakness is a buffer overflow, and the crafted string is a client-side exploit.
   • DThe weakness is a misconfiguration, and the crafted string is a denial-of-service exploit.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which statement best describes a zero-day vulnerability?

   • AA vulnerability that has been patched but not widely deployed
   • BA vulnerability that has been publicly disclosed for more than a day
   • CA vulnerability that is unknown to the vendor and has no available patch
   • DA vulnerability that only affects systems that are not updated
   Reveal Solution Discussion Select an answer first