Practice Exams:

View All

CompTIA CySA+ CS0-003 Controls To Mitigate Attacks And Software Vulnerabilities Practice Test

Objective 2.4 • 36 original questions

This CompTIA CySA+ CS0-003 practice test focuses on objective 2.4: controls to mitigate attacks and software vulnerabilities. All questions are original ExamSnap scenarios aligned to the official CS0-003 objective set; they are not copied from live CompTIA exam content. Review every option explanation to understand why a choice fits or does not fit the scenario. For broader exam preparation, review the CompTIA CySA+ CS0-003 Exam Dumps page.

Instructions: Select the best answer unless the question explicitly says Select TWO or Select THREE. Review the explanation and option review after answering.

Question 1

a security architect at Datum Fabrication is comparing several approaches. The deciding requirement is to mitigate script input that is immediately reflected into a response. Which option should be chosen? Base the decision on the primary security requirement, not on implementation convenience.

CSRF mitigation
Reflected cross-site scripting defense
Broken-access-control mitigation
Directory-traversal mitigation
Data-poisoning controls

Correct answer: B

Why: Reflected XSS defenses include contextual output encoding, input handling, and browser controls such as CSP where appropriate. It directly fits this scenario because the requirement is to mitigate script input that is immediately reflected into a response.

Option review:

A: Anti-CSRF tokens, SameSite cookies, reauthentication for sensitive actions, and origin checks reduce cross-site request forgery. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to mitigate script input that is immediately reflected into a response.

B: Reflected XSS defenses include contextual output encoding, input handling, and browser controls such as CSP where appropriate. It directly fits this scenario because the requirement is to mitigate script input that is immediately reflected into a response.

C: Server-side authorization must enforce least privilege on every request rather than trusting client-side controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to mitigate script input that is immediately reflected into a response.

D: Canonicalize paths, allow-list files or directories, avoid direct user-controlled paths, and enforce filesystem permissions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to mitigate script input that is immediately reflected into a response.

E: Input provenance, validation, anomaly detection, access control, and trusted training/data pipelines reduce data-poisoning risk. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to mitigate script input that is immediately reflected into a response.

Learning point: Use Reflected cross-site scripting defense when the key requirement is to mitigate script input that is immediately reflected into a response.

Question 2

While supporting an e-commerce platform, a SOC lead is asked to mitigate malicious script stored in application data and later rendered to users. Which concept or tool is the clearest match? The environment follows least privilege and preserves evidence where incident handling is involved.

Cryptographic-failure mitigation
Privilege-escalation mitigation
Directory-traversal mitigation
File-inclusion mitigation
Persistent cross-site scripting defense

Correct answer: E

Option review:

A: Use strong current algorithms, secure key management, correct certificate validation, and encryption for sensitive data in transit and at rest. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to mitigate malicious script stored in application data and later rendered to users.

B: Patch local flaws, enforce least privilege, harden permissions, and monitor privileged changes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to mitigate malicious script stored in application data and later rendered to users.

C: Canonicalize paths, allow-list files or directories, avoid direct user-controlled paths, and enforce filesystem permissions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to mitigate malicious script stored in application data and later rendered to users.

D: Avoid user-controlled include paths, use allow lists and canonicalization, disable remote inclusion, and constrain filesystem/network access. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to mitigate malicious script stored in application data and later rendered to users.

E: Stored XSS requires preventing unsafe stored content from being rendered as executable script through validation and contextual output encoding. It directly fits this scenario because the requirement is to mitigate malicious script stored in application data and later rendered to users.

Learning point: Use Persistent cross-site scripting defense when the key requirement is to mitigate malicious script stored in application data and later rendered to users.

Question 3

A new security procedure at Proseware Research must enable analysts to reduce memory-corruption risk from out-of-bounds or arithmetic errors. Which option is the BEST choice? Use the choice that most directly addresses the stated evidence rather than a broader control.

Memory-safety and overflow controls
Persistent cross-site scripting defense
Broken-access-control mitigation
Secure-design mitigation
SSRF mitigation

Correct answer: A

Why: Bounds checking, memory-safe languages, compiler protections, and secure coding reduce buffer, integer, heap, and stack overflow risk. It directly fits this scenario because the requirement is to reduce memory-corruption risk from out-of-bounds or arithmetic errors.

Option review:

A: Bounds checking, memory-safe languages, compiler protections, and secure coding reduce buffer, integer, heap, and stack overflow risk. It directly fits this scenario because the requirement is to reduce memory-corruption risk from out-of-bounds or arithmetic errors.

B: Stored XSS requires preventing unsafe stored content from being rendered as executable script through validation and contextual output encoding. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce memory-corruption risk from out-of-bounds or arithmetic errors.

C: Server-side authorization must enforce least privilege on every request rather than trusting client-side controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce memory-corruption risk from out-of-bounds or arithmetic errors.

D: Threat modeling, abuse-case analysis, least privilege, and architecture review address insecure design before implementation. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce memory-corruption risk from out-of-bounds or arithmetic errors.

E: Restrict server egress, validate destinations, block metadata endpoints, and use allow lists so server-side requests cannot reach arbitrary internal resources. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce memory-corruption risk from out-of-bounds or arithmetic errors.

Learning point: Use Memory-safety and overflow controls when the key requirement is to reduce memory-corruption risk from out-of-bounds or arithmetic errors.

Question 4

During a security review, a SOC analyst must address two separate needs: prevent untrusted data from corrupting an analytics or machine-learning data set, and address a vulnerable component that the vendor no longer patches. Select TWO. The team wants the most defensible analyst action before expanding the investigation.

Authentication-failure mitigation
Data-poisoning controls
Directory-traversal mitigation
Privilege-escalation mitigation
End-of-life component remediation

Correct answers: B, E

Why: Input provenance, validation, anomaly detection, access control, and trusted training/data pipelines reduce data-poisoning risk. It directly fits this scenario because the requirement is to prevent untrusted data from corrupting an analytics or machine-learning data set. Upgrade, replace, isolate, or apply compensating controls to components that no longer receive security fixes. It directly fits this scenario because the requirement is to address a vulnerable component that the vendor no longer patches.

Option review:

A: Strong authentication, rate limits, secure recovery, MFA, session controls, and correct identity checks reduce authentication failures. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent untrusted data from corrupting an analytics or machine-learning data set; address a vulnerable component that the vendor no longer patches.

B: Input provenance, validation, anomaly detection, access control, and trusted training/data pipelines reduce data-poisoning risk. It directly fits this scenario because the requirement is to prevent untrusted data from corrupting an analytics or machine-learning data set.

C: Canonicalize paths, allow-list files or directories, avoid direct user-controlled paths, and enforce filesystem permissions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent untrusted data from corrupting an analytics or machine-learning data set; address a vulnerable component that the vendor no longer patches.

D: Patch local flaws, enforce least privilege, harden permissions, and monitor privileged changes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent untrusted data from corrupting an analytics or machine-learning data set; address a vulnerable component that the vendor no longer patches.

E: Upgrade, replace, isolate, or apply compensating controls to components that no longer receive security fixes. It directly fits this scenario because the requirement is to address a vulnerable component that the vendor no longer patches.

Learning point: Use Data-poisoning controls, End-of-life component remediation when the key requirement is to prevent untrusted data from corrupting an analytics or machine-learning data set; address a vulnerable component that the vendor no longer patches.

Question 5

At Woodgrove Bank, a threat hunter has two simultaneous requirements: stop users from accessing records or functions outside their authorization, and reduce account compromise caused by weak login or recovery controls. Which TWO options should be selected? Select based on the scenario’s decisive constraint, not on which technology is newest.

Secure-design mitigation
Broken-access-control mitigation
Authentication-failure mitigation
Persistent cross-site scripting defense
Privilege-escalation mitigation

Correct answers: B, C

Option review:

A: Threat modeling, abuse-case analysis, least privilege, and architecture review address insecure design before implementation. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to stop users from accessing records or functions outside their authorization; reduce account compromise caused by weak login or recovery controls.

B: Server-side authorization must enforce least privilege on every request rather than trusting client-side controls. It directly fits this scenario because the requirement is to stop users from accessing records or functions outside their authorization.

C: Strong authentication, rate limits, secure recovery, MFA, session controls, and correct identity checks reduce authentication failures. It directly fits this scenario because the requirement is to reduce account compromise caused by weak login or recovery controls.

D: Stored XSS requires preventing unsafe stored content from being rendered as executable script through validation and contextual output encoding. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to stop users from accessing records or functions outside their authorization; reduce account compromise caused by weak login or recovery controls.

E: Patch local flaws, enforce least privilege, harden permissions, and monitor privileged changes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to stop users from accessing records or functions outside their authorization; reduce account compromise caused by weak login or recovery controls.

Learning point: Use Broken-access-control mitigation, Authentication-failure mitigation when the key requirement is to stop users from accessing records or functions outside their authorization; reduce account compromise caused by weak login or recovery controls.

Question 6

During an investigation at Humongous Insurance, the immediate requirement is to replace weak or incorrectly implemented protection of sensitive data. What should a risk analyst select? Assume the activity is authorized and must follow normal enterprise change control.

Secure-design mitigation
Directory-traversal mitigation
Cryptographic-failure mitigation
Broken-access-control mitigation
Persistent cross-site scripting defense

Correct answer: C

Why: Use strong current algorithms, secure key management, correct certificate validation, and encryption for sensitive data in transit and at rest. It directly fits this scenario because the requirement is to replace weak or incorrectly implemented protection of sensitive data.

Option review:

A: Threat modeling, abuse-case analysis, least privilege, and architecture review address insecure design before implementation. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to replace weak or incorrectly implemented protection of sensitive data.

B: Canonicalize paths, allow-list files or directories, avoid direct user-controlled paths, and enforce filesystem permissions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to replace weak or incorrectly implemented protection of sensitive data.

C: Use strong current algorithms, secure key management, correct certificate validation, and encryption for sensitive data in transit and at rest. It directly fits this scenario because the requirement is to replace weak or incorrectly implemented protection of sensitive data.

D: Server-side authorization must enforce least privilege on every request rather than trusting client-side controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to replace weak or incorrectly implemented protection of sensitive data.

E: Stored XSS requires preventing unsafe stored content from being rendered as executable script through validation and contextual output encoding. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to replace weak or incorrectly implemented protection of sensitive data.

Learning point: Use Cryptographic-failure mitigation when the key requirement is to replace weak or incorrectly implemented protection of sensitive data.

Question 7

Contoso Health is updating its security operations standard for a hospital network. Which option most directly helps the team prevent attacker-controlled input from changing a database or interpreter command? Assume no additional product-specific features are available beyond the concepts listed.

Secure-design mitigation
End-of-life component remediation
Data-poisoning controls
Persistent cross-site scripting defense
Injection mitigation

Correct answer: E

Why: Parameterized queries, allow-listed validation, safe APIs, and separation of code from data reduce injection flaws. It directly fits this scenario because the requirement is to prevent attacker-controlled input from changing a database or interpreter command.

Option review:

A: Threat modeling, abuse-case analysis, least privilege, and architecture review address insecure design before implementation. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent attacker-controlled input from changing a database or interpreter command.

B: Upgrade, replace, isolate, or apply compensating controls to components that no longer receive security fixes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent attacker-controlled input from changing a database or interpreter command.

C: Input provenance, validation, anomaly detection, access control, and trusted training/data pipelines reduce data-poisoning risk. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent attacker-controlled input from changing a database or interpreter command.

D: Stored XSS requires preventing unsafe stored content from being rendered as executable script through validation and contextual output encoding. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent attacker-controlled input from changing a database or interpreter command.

E: Parameterized queries, allow-listed validation, safe APIs, and separation of code from data reduce injection flaws. It directly fits this scenario because the requirement is to prevent attacker-controlled input from changing a database or interpreter command.

Learning point: Use Injection mitigation when the key requirement is to prevent attacker-controlled input from changing a database or interpreter command.

Question 8

During a security review, a security operations engineer must address two separate needs: stop a malicious site from causing a logged-in user browser to submit an unwanted action, and prevent a low-privilege foothold from becoming administrator or root access. Select TWO. The organization wants a vendor-neutral approach that can be explained during audit review.

SSRF mitigation
Privilege-escalation mitigation
Data-poisoning controls
CSRF mitigation
Security-misconfiguration mitigation

Correct answers: B, D

Why: Patch local flaws, enforce least privilege, harden permissions, and monitor privileged changes. It directly fits this scenario because the requirement is to prevent a low-privilege foothold from becoming administrator or root access. Anti-CSRF tokens, SameSite cookies, reauthentication for sensitive actions, and origin checks reduce cross-site request forgery. It directly fits this scenario because the requirement is to stop a malicious site from causing a logged-in user browser to submit an unwanted action.

Option review:

A: Restrict server egress, validate destinations, block metadata endpoints, and use allow lists so server-side requests cannot reach arbitrary internal resources. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to stop a malicious site from causing a logged-in user browser to submit an unwanted action; prevent a low-privilege foothold from becoming administrator or root access.

B: Patch local flaws, enforce least privilege, harden permissions, and monitor privileged changes. It directly fits this scenario because the requirement is to prevent a low-privilege foothold from becoming administrator or root access.

C: Input provenance, validation, anomaly detection, access control, and trusted training/data pipelines reduce data-poisoning risk. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to stop a malicious site from causing a logged-in user browser to submit an unwanted action; prevent a low-privilege foothold from becoming administrator or root access.

D: Anti-CSRF tokens, SameSite cookies, reauthentication for sensitive actions, and origin checks reduce cross-site request forgery. It directly fits this scenario because the requirement is to stop a malicious site from causing a logged-in user browser to submit an unwanted action.

E: Harden defaults, remove unnecessary features, protect secrets, set secure headers, and continuously check configuration drift. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to stop a malicious site from causing a logged-in user browser to submit an unwanted action; prevent a low-privilege foothold from becoming administrator or root access.

Learning point: Use CSRF mitigation, Privilege-escalation mitigation when the key requirement is to stop a malicious site from causing a logged-in user browser to submit an unwanted action; prevent a low-privilege foothold from becoming administrator or root access.

Question 9

At Lucerne Publishing, a detection engineer has two simultaneous requirements: prevent user input such as ../ from escaping an intended directory, and prevent local or remote files from being loaded through attacker-controlled include parameters. Which TWO options should be selected? Base the decision on the primary security requirement, not on implementation convenience.

File-inclusion mitigation
Memory-safety and overflow controls
Injection mitigation
Secure-design mitigation
Directory-traversal mitigation

Correct answers: A, E

Why: Avoid user-controlled include paths, use allow lists and canonicalization, disable remote inclusion, and constrain filesystem/network access. It directly fits this scenario because the requirement is to prevent local or remote files from being loaded through attacker-controlled include parameters. Canonicalize paths, allow-list files or directories, avoid direct user-controlled paths, and enforce filesystem permissions. It directly fits this scenario because the requirement is to prevent user input such as ../ from escaping an intended directory.

Option review:

A: Avoid user-controlled include paths, use allow lists and canonicalization, disable remote inclusion, and constrain filesystem/network access. It directly fits this scenario because the requirement is to prevent local or remote files from being loaded through attacker-controlled include parameters.

B: Bounds checking, memory-safe languages, compiler protections, and secure coding reduce buffer, integer, heap, and stack overflow risk. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent user input such as ../ from escaping an intended directory; prevent local or remote files from being loaded through attacker-controlled include parameters.

C: Parameterized queries, allow-listed validation, safe APIs, and separation of code from data reduce injection flaws. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent user input such as ../ from escaping an intended directory; prevent local or remote files from being loaded through attacker-controlled include parameters.

D: Threat modeling, abuse-case analysis, least privilege, and architecture review address insecure design before implementation. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent user input such as ../ from escaping an intended directory; prevent local or remote files from being loaded through attacker-controlled include parameters.

E: Canonicalize paths, allow-list files or directories, avoid direct user-controlled paths, and enforce filesystem permissions. It directly fits this scenario because the requirement is to prevent user input such as ../ from escaping an intended directory.

Learning point: Use Directory-traversal mitigation, File-inclusion mitigation when the key requirement is to prevent user input such as ../ from escaping an intended directory; prevent local or remote files from being loaded through attacker-controlled include parameters.

Question 10

For an online banking environment, the team must accomplish both of these goals: fix a security weakness caused by the system architecture rather than a coding bug, and mitigate script input that is immediately reflected into a response. Which TWO choices together provide the best match? The environment follows least privilege and preserves evidence where incident handling is involved.

Secure-design mitigation
CSRF mitigation
Cryptographic-failure mitigation
Reflected cross-site scripting defense
Remote-code-execution mitigation

Correct answers: A, D

Why: Threat modeling, abuse-case analysis, least privilege, and architecture review address insecure design before implementation. It directly fits this scenario because the requirement is to fix a security weakness caused by the system architecture rather than a coding bug. Reflected XSS defenses include contextual output encoding, input handling, and browser controls such as CSP where appropriate. It directly fits this scenario because the requirement is to mitigate script input that is immediately reflected into a response.

Option review:

A: Threat modeling, abuse-case analysis, least privilege, and architecture review address insecure design before implementation. It directly fits this scenario because the requirement is to fix a security weakness caused by the system architecture rather than a coding bug.

B: Anti-CSRF tokens, SameSite cookies, reauthentication for sensitive actions, and origin checks reduce cross-site request forgery. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to fix a security weakness caused by the system architecture rather than a coding bug; mitigate script input that is immediately reflected into a response.

C: Use strong current algorithms, secure key management, correct certificate validation, and encryption for sensitive data in transit and at rest. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to fix a security weakness caused by the system architecture rather than a coding bug; mitigate script input that is immediately reflected into a response.

D: Reflected XSS defenses include contextual output encoding, input handling, and browser controls such as CSP where appropriate. It directly fits this scenario because the requirement is to mitigate script input that is immediately reflected into a response.

E: Patch vulnerable components, validate inputs, reduce privileges, isolate services, and apply application controls to prevent arbitrary code execution. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to fix a security weakness caused by the system architecture rather than a coding bug; mitigate script input that is immediately reflected into a response.

Learning point: Use Secure-design mitigation, Reflected cross-site scripting defense when the key requirement is to fix a security weakness caused by the system architecture rather than a coding bug; mitigate script input that is immediately reflected into a response.

Question 11

City Power Utilities is designing a combined control. It must correct a service left with risky default or overly permissive settings, and mitigate malicious script stored in application data and later rendered to users. Which TWO options are most appropriate? Use the choice that most directly addresses the stated evidence rather than a broader control.

Privilege-escalation mitigation
End-of-life component remediation
SSRF mitigation
Persistent cross-site scripting defense
Security-misconfiguration mitigation

Correct answers: D, E

Why: Stored XSS requires preventing unsafe stored content from being rendered as executable script through validation and contextual output encoding. It directly fits this scenario because the requirement is to mitigate malicious script stored in application data and later rendered to users. Harden defaults, remove unnecessary features, protect secrets, set secure headers, and continuously check configuration drift. It directly fits this scenario because the requirement is to correct a service left with risky default or overly permissive settings.

Option review:

A: Patch local flaws, enforce least privilege, harden permissions, and monitor privileged changes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to correct a service left with risky default or overly permissive settings; mitigate malicious script stored in application data and later rendered to users.

B: Upgrade, replace, isolate, or apply compensating controls to components that no longer receive security fixes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to correct a service left with risky default or overly permissive settings; mitigate malicious script stored in application data and later rendered to users.

C: Restrict server egress, validate destinations, block metadata endpoints, and use allow lists so server-side requests cannot reach arbitrary internal resources. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to correct a service left with risky default or overly permissive settings; mitigate malicious script stored in application data and later rendered to users.

D: Stored XSS requires preventing unsafe stored content from being rendered as executable script through validation and contextual output encoding. It directly fits this scenario because the requirement is to mitigate malicious script stored in application data and later rendered to users.

E: Harden defaults, remove unnecessary features, protect secrets, set secure headers, and continuously check configuration drift. It directly fits this scenario because the requirement is to correct a service left with risky default or overly permissive settings.

Learning point: Use Security-misconfiguration mitigation, Persistent cross-site scripting defense when the key requirement is to correct a service left with risky default or overly permissive settings; mitigate malicious script stored in application data and later rendered to users.

Question 12

While supporting a newly acquired subsidiary, a security consultant is asked to address a vulnerable component that the vendor no longer patches. Which concept or tool is the clearest match? The team wants the most defensible analyst action before expanding the investigation.

Privilege-escalation mitigation
Broken-access-control mitigation
CSRF mitigation
End-of-life component remediation
Cryptographic-failure mitigation

Correct answer: D

Option review:

A: Patch local flaws, enforce least privilege, harden permissions, and monitor privileged changes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to address a vulnerable component that the vendor no longer patches.

B: Server-side authorization must enforce least privilege on every request rather than trusting client-side controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to address a vulnerable component that the vendor no longer patches.

C: Anti-CSRF tokens, SameSite cookies, reauthentication for sensitive actions, and origin checks reduce cross-site request forgery. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to address a vulnerable component that the vendor no longer patches.

D: Upgrade, replace, isolate, or apply compensating controls to components that no longer receive security fixes. It directly fits this scenario because the requirement is to address a vulnerable component that the vendor no longer patches.

E: Use strong current algorithms, secure key management, correct certificate validation, and encryption for sensitive data in transit and at rest. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to address a vulnerable component that the vendor no longer patches.

Learning point: Use End-of-life component remediation when the key requirement is to address a vulnerable component that the vendor no longer patches.

Question 13

At Northwind Traders, the response plan has three distinct requirements: reduce account compromise caused by weak login or recovery controls; mitigate script input that is immediately reflected into a response; and replace weak or incorrectly implemented protection of sensitive data. Which THREE options should be selected? Select based on the scenario’s decisive constraint, not on which technology is newest.

Authentication-failure mitigation
Cryptographic-failure mitigation
Data-poisoning controls
Injection mitigation
Reflected cross-site scripting defense

Correct answers: A, B, E

Why: Strong authentication, rate limits, secure recovery, MFA, session controls, and correct identity checks reduce authentication failures. It directly fits this scenario because the requirement is to reduce account compromise caused by weak login or recovery controls. Use strong current algorithms, secure key management, correct certificate validation, and encryption for sensitive data in transit and at rest. It directly fits this scenario because the requirement is to replace weak or incorrectly implemented protection of sensitive data. Reflected XSS defenses include contextual output encoding, input handling, and browser controls such as CSP where appropriate. It directly fits this scenario because the requirement is to mitigate script input that is immediately reflected into a response.

Option review:

A: Strong authentication, rate limits, secure recovery, MFA, session controls, and correct identity checks reduce authentication failures. It directly fits this scenario because the requirement is to reduce account compromise caused by weak login or recovery controls.

B: Use strong current algorithms, secure key management, correct certificate validation, and encryption for sensitive data in transit and at rest. It directly fits this scenario because the requirement is to replace weak or incorrectly implemented protection of sensitive data.

C: Input provenance, validation, anomaly detection, access control, and trusted training/data pipelines reduce data-poisoning risk. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce account compromise caused by weak login or recovery controls; mitigate script input that is immediately reflected into a response; replace weak or incorrectly implemented protection of sensitive data.

D: Parameterized queries, allow-listed validation, safe APIs, and separation of code from data reduce injection flaws. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce account compromise caused by weak login or recovery controls; mitigate script input that is immediately reflected into a response; replace weak or incorrectly implemented protection of sensitive data.

E: Reflected XSS defenses include contextual output encoding, input handling, and browser controls such as CSP where appropriate. It directly fits this scenario because the requirement is to mitigate script input that is immediately reflected into a response.

Learning point: Use Authentication-failure mitigation, Reflected cross-site scripting defense, Cryptographic-failure mitigation when the key requirement is to reduce account compromise caused by weak login or recovery controls; mitigate script input that is immediately reflected into a response; replace weak or incorrectly implemented protection of sensitive data.

Question 14

The primary objective for Alpine Ski House is to stop an attacker from making the application server fetch internal or cloud-metadata URLs. Which selection best satisfies that objective in a SaaS-heavy business? Assume the activity is authorized and must follow normal enterprise change control.

Reflected cross-site scripting defense
SSRF mitigation
Cryptographic-failure mitigation
Injection mitigation
Authentication-failure mitigation

Correct answer: B

Option review:

A: Reflected XSS defenses include contextual output encoding, input handling, and browser controls such as CSP where appropriate. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to stop an attacker from making the application server fetch internal or cloud-metadata URLs.

B: Restrict server egress, validate destinations, block metadata endpoints, and use allow lists so server-side requests cannot reach arbitrary internal resources. It directly fits this scenario because the requirement is to stop an attacker from making the application server fetch internal or cloud-metadata URLs.

C: Use strong current algorithms, secure key management, correct certificate validation, and encryption for sensitive data in transit and at rest. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to stop an attacker from making the application server fetch internal or cloud-metadata URLs.

D: Parameterized queries, allow-listed validation, safe APIs, and separation of code from data reduce injection flaws. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to stop an attacker from making the application server fetch internal or cloud-metadata URLs.

E: Strong authentication, rate limits, secure recovery, MFA, session controls, and correct identity checks reduce authentication failures. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to stop an attacker from making the application server fetch internal or cloud-metadata URLs.

Learning point: Use SSRF mitigation when the key requirement is to stop an attacker from making the application server fetch internal or cloud-metadata URLs.

Question 15

At Coho Winery, a systems security analyst needs to prevent untrusted input from causing arbitrary commands or code to run. Which option is the BEST fit for a branch-office network? Assume no additional product-specific features are available beyond the concepts listed.

Broken-access-control mitigation
File-inclusion mitigation
Remote-code-execution mitigation
End-of-life component remediation
Data-poisoning controls

Correct answer: C

Option review:

A: Server-side authorization must enforce least privilege on every request rather than trusting client-side controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent untrusted input from causing arbitrary commands or code to run.

C: Patch vulnerable components, validate inputs, reduce privileges, isolate services, and apply application controls to prevent arbitrary code execution. It directly fits this scenario because the requirement is to prevent untrusted input from causing arbitrary commands or code to run.

D: Upgrade, replace, isolate, or apply compensating controls to components that no longer receive security fixes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent untrusted input from causing arbitrary commands or code to run.

E: Input provenance, validation, anomaly detection, access control, and trusted training/data pipelines reduce data-poisoning risk. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent untrusted input from causing arbitrary commands or code to run.

Learning point: Use Remote-code-execution mitigation when the key requirement is to prevent untrusted input from causing arbitrary commands or code to run.

Question 16

During an investigation at Litware Manufacturing, the immediate requirement is to prevent a low-privilege foothold from becoming administrator or root access. What should an incident responder select? The organization wants a vendor-neutral approach that can be explained during audit review.

Persistent cross-site scripting defense
Privilege-escalation mitigation
Cryptographic-failure mitigation
Directory-traversal mitigation
Broken-access-control mitigation

Correct answer: B

Option review:

A: Stored XSS requires preventing unsafe stored content from being rendered as executable script through validation and contextual output encoding. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent a low-privilege foothold from becoming administrator or root access.

C: Use strong current algorithms, secure key management, correct certificate validation, and encryption for sensitive data in transit and at rest. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent a low-privilege foothold from becoming administrator or root access.

D: Canonicalize paths, allow-list files or directories, avoid direct user-controlled paths, and enforce filesystem permissions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent a low-privilege foothold from becoming administrator or root access.

E: Server-side authorization must enforce least privilege on every request rather than trusting client-side controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent a low-privilege foothold from becoming administrator or root access.

Learning point: Use Privilege-escalation mitigation when the key requirement is to prevent a low-privilege foothold from becoming administrator or root access.

Question 17

At Fourth Coffee, a security administrator has two simultaneous requirements: prevent local or remote files from being loaded through attacker-controlled include parameters, and stop a malicious site from causing a logged-in user browser to submit an unwanted action. Which TWO options should be selected? Base the decision on the primary security requirement, not on implementation convenience.

Data-poisoning controls
File-inclusion mitigation
CSRF mitigation
Broken-access-control mitigation
Reflected cross-site scripting defense

Correct answers: B, C

Why: Avoid user-controlled include paths, use allow lists and canonicalization, disable remote inclusion, and constrain filesystem/network access. It directly fits this scenario because the requirement is to prevent local or remote files from being loaded through attacker-controlled include parameters. Anti-CSRF tokens, SameSite cookies, reauthentication for sensitive actions, and origin checks reduce cross-site request forgery. It directly fits this scenario because the requirement is to stop a malicious site from causing a logged-in user browser to submit an unwanted action.

Option review:

A: Input provenance, validation, anomaly detection, access control, and trusted training/data pipelines reduce data-poisoning risk. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent local or remote files from being loaded through attacker-controlled include parameters; stop a malicious site from causing a logged-in user browser to submit an unwanted action.

B: Avoid user-controlled include paths, use allow lists and canonicalization, disable remote inclusion, and constrain filesystem/network access. It directly fits this scenario because the requirement is to prevent local or remote files from being loaded through attacker-controlled include parameters.

C: Anti-CSRF tokens, SameSite cookies, reauthentication for sensitive actions, and origin checks reduce cross-site request forgery. It directly fits this scenario because the requirement is to stop a malicious site from causing a logged-in user browser to submit an unwanted action.

D: Server-side authorization must enforce least privilege on every request rather than trusting client-side controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent local or remote files from being loaded through attacker-controlled include parameters; stop a malicious site from causing a logged-in user browser to submit an unwanted action.

E: Reflected XSS defenses include contextual output encoding, input handling, and browser controls such as CSP where appropriate. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent local or remote files from being loaded through attacker-controlled include parameters; stop a malicious site from causing a logged-in user browser to submit an unwanted action.

Learning point: Use File-inclusion mitigation, CSRF mitigation when the key requirement is to prevent local or remote files from being loaded through attacker-controlled include parameters; stop a malicious site from causing a logged-in user browser to submit an unwanted action.

Question 18

For a customer-facing messaging service, the team must accomplish both of these goals: mitigate script input that is immediately reflected into a response, and prevent user input such as ../ from escaping an intended directory. Which TWO choices together provide the best match? The environment follows least privilege and preserves evidence where incident handling is involved.

End-of-life component remediation
File-inclusion mitigation
Persistent cross-site scripting defense
Directory-traversal mitigation
Reflected cross-site scripting defense

Correct answers: D, E

Why: Canonicalize paths, allow-list files or directories, avoid direct user-controlled paths, and enforce filesystem permissions. It directly fits this scenario because the requirement is to prevent user input such as ../ from escaping an intended directory. Reflected XSS defenses include contextual output encoding, input handling, and browser controls such as CSP where appropriate. It directly fits this scenario because the requirement is to mitigate script input that is immediately reflected into a response.

Option review:

A: Upgrade, replace, isolate, or apply compensating controls to components that no longer receive security fixes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to mitigate script input that is immediately reflected into a response; prevent user input such as ../ from escaping an intended directory.

B: Avoid user-controlled include paths, use allow lists and canonicalization, disable remote inclusion, and constrain filesystem/network access. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to mitigate script input that is immediately reflected into a response; prevent user input such as ../ from escaping an intended directory.

C: Stored XSS requires preventing unsafe stored content from being rendered as executable script through validation and contextual output encoding. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to mitigate script input that is immediately reflected into a response; prevent user input such as ../ from escaping an intended directory.

D: Canonicalize paths, allow-list files or directories, avoid direct user-controlled paths, and enforce filesystem permissions. It directly fits this scenario because the requirement is to prevent user input such as ../ from escaping an intended directory.

Learning point: Use Reflected cross-site scripting defense, Directory-traversal mitigation when the key requirement is to mitigate script input that is immediately reflected into a response; prevent user input such as ../ from escaping an intended directory.

Question 19

In a hybrid-cloud workload, a blue-team analyst must mitigate malicious script stored in application data and later rendered to users. Which approach is MOST appropriate? Use the choice that most directly addresses the stated evidence rather than a broader control.

Persistent cross-site scripting defense
Broken-access-control mitigation
Privilege-escalation mitigation
Remote-code-execution mitigation
Reflected cross-site scripting defense

Correct answer: A

Option review:

A: Stored XSS requires preventing unsafe stored content from being rendered as executable script through validation and contextual output encoding. It directly fits this scenario because the requirement is to mitigate malicious script stored in application data and later rendered to users.

B: Server-side authorization must enforce least privilege on every request rather than trusting client-side controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to mitigate malicious script stored in application data and later rendered to users.

C: Patch local flaws, enforce least privilege, harden permissions, and monitor privileged changes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to mitigate malicious script stored in application data and later rendered to users.

D: Patch vulnerable components, validate inputs, reduce privileges, isolate services, and apply application controls to prevent arbitrary code execution. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to mitigate malicious script stored in application data and later rendered to users.

E: Reflected XSS defenses include contextual output encoding, input handling, and browser controls such as CSP where appropriate. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to mitigate malicious script stored in application data and later rendered to users.

Learning point: Use Persistent cross-site scripting defense when the key requirement is to mitigate malicious script stored in application data and later rendered to users.

Question 20

A review at Wide World Importers finds a gap: the team cannot reliably reduce memory-corruption risk from out-of-bounds or arithmetic errors. Which option best closes that gap? The team wants the most defensible analyst action before expanding the investigation.

Broken-access-control mitigation
Privilege-escalation mitigation
Security-misconfiguration mitigation
Remote-code-execution mitigation
Memory-safety and overflow controls

Correct answer: E

Option review:

A: Server-side authorization must enforce least privilege on every request rather than trusting client-side controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce memory-corruption risk from out-of-bounds or arithmetic errors.

B: Patch local flaws, enforce least privilege, harden permissions, and monitor privileged changes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce memory-corruption risk from out-of-bounds or arithmetic errors.

D: Patch vulnerable components, validate inputs, reduce privileges, isolate services, and apply application controls to prevent arbitrary code execution. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce memory-corruption risk from out-of-bounds or arithmetic errors.

E: Bounds checking, memory-safe languages, compiler protections, and secure coding reduce buffer, integer, heap, and stack overflow risk. It directly fits this scenario because the requirement is to reduce memory-corruption risk from out-of-bounds or arithmetic errors.

Learning point: Use Memory-safety and overflow controls when the key requirement is to reduce memory-corruption risk from out-of-bounds or arithmetic errors.

Question 21

At Datum Fabrication, a security architect has two simultaneous requirements: prevent untrusted data from corrupting an analytics or machine-learning data set, and address a vulnerable component that the vendor no longer patches. Which TWO options should be selected? Select based on the scenario’s decisive constraint, not on which technology is newest.

End-of-life component remediation
Reflected cross-site scripting defense
Data-poisoning controls
Memory-safety and overflow controls
File-inclusion mitigation

Correct answers: A, C

Why: Upgrade, replace, isolate, or apply compensating controls to components that no longer receive security fixes. It directly fits this scenario because the requirement is to address a vulnerable component that the vendor no longer patches. Input provenance, validation, anomaly detection, access control, and trusted training/data pipelines reduce data-poisoning risk. It directly fits this scenario because the requirement is to prevent untrusted data from corrupting an analytics or machine-learning data set.

Option review:

A: Upgrade, replace, isolate, or apply compensating controls to components that no longer receive security fixes. It directly fits this scenario because the requirement is to address a vulnerable component that the vendor no longer patches.

B: Reflected XSS defenses include contextual output encoding, input handling, and browser controls such as CSP where appropriate. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent untrusted data from corrupting an analytics or machine-learning data set; address a vulnerable component that the vendor no longer patches.

C: Input provenance, validation, anomaly detection, access control, and trusted training/data pipelines reduce data-poisoning risk. It directly fits this scenario because the requirement is to prevent untrusted data from corrupting an analytics or machine-learning data set.

D: Bounds checking, memory-safe languages, compiler protections, and secure coding reduce buffer, integer, heap, and stack overflow risk. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent untrusted data from corrupting an analytics or machine-learning data set; address a vulnerable component that the vendor no longer patches.

E: Avoid user-controlled include paths, use allow lists and canonicalization, disable remote inclusion, and constrain filesystem/network access. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent untrusted data from corrupting an analytics or machine-learning data set; address a vulnerable component that the vendor no longer patches.

Question 22

For an e-commerce platform, a SOC lead must satisfy all three needs: stop users from accessing records or functions outside their authorization; fix a security weakness caused by the system architecture rather than a coding bug; and prevent untrusted input from causing arbitrary commands or code to run. Select THREE. Assume the activity is authorized and must follow normal enterprise change control.

Broken-access-control mitigation
Secure-design mitigation
Injection mitigation
Remote-code-execution mitigation
Memory-safety and overflow controls

Correct answers: A, B, D

Why: Server-side authorization must enforce least privilege on every request rather than trusting client-side controls. It directly fits this scenario because the requirement is to stop users from accessing records or functions outside their authorization. Threat modeling, abuse-case analysis, least privilege, and architecture review address insecure design before implementation. It directly fits this scenario because the requirement is to fix a security weakness caused by the system architecture rather than a coding bug. Patch vulnerable components, validate inputs, reduce privileges, isolate services, and apply application controls to prevent arbitrary code execution. It directly fits this scenario because the requirement is to prevent untrusted input from causing arbitrary commands or code to run.

Option review:

A: Server-side authorization must enforce least privilege on every request rather than trusting client-side controls. It directly fits this scenario because the requirement is to stop users from accessing records or functions outside their authorization.

B: Threat modeling, abuse-case analysis, least privilege, and architecture review address insecure design before implementation. It directly fits this scenario because the requirement is to fix a security weakness caused by the system architecture rather than a coding bug.

C: Parameterized queries, allow-listed validation, safe APIs, and separation of code from data reduce injection flaws. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to stop users from accessing records or functions outside their authorization; fix a security weakness caused by the system architecture rather than a coding bug; prevent untrusted input from causing arbitrary commands or code to run.

D: Patch vulnerable components, validate inputs, reduce privileges, isolate services, and apply application controls to prevent arbitrary code execution. It directly fits this scenario because the requirement is to prevent untrusted input from causing arbitrary commands or code to run.

E: Bounds checking, memory-safe languages, compiler protections, and secure coding reduce buffer, integer, heap, and stack overflow risk. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to stop users from accessing records or functions outside their authorization; fix a security weakness caused by the system architecture rather than a coding bug; prevent untrusted input from causing arbitrary commands or code to run.

Learning point: Use Broken-access-control mitigation, Secure-design mitigation, Remote-code-execution mitigation when the key requirement is to stop users from accessing records or functions outside their authorization; fix a security weakness caused by the system architecture rather than a coding bug; prevent untrusted input from causing arbitrary commands or code to run.

Question 23

A new security procedure at Proseware Research must enable analysts to replace weak or incorrectly implemented protection of sensitive data. Which option is the BEST choice? Assume no additional product-specific features are available beyond the concepts listed.

Directory-traversal mitigation
Cryptographic-failure mitigation
Privilege-escalation mitigation
Persistent cross-site scripting defense
Authentication-failure mitigation

Correct answer: B

Option review:

A: Canonicalize paths, allow-list files or directories, avoid direct user-controlled paths, and enforce filesystem permissions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to replace weak or incorrectly implemented protection of sensitive data.

C: Patch local flaws, enforce least privilege, harden permissions, and monitor privileged changes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to replace weak or incorrectly implemented protection of sensitive data.

D: Stored XSS requires preventing unsafe stored content from being rendered as executable script through validation and contextual output encoding. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to replace weak or incorrectly implemented protection of sensitive data.

E: Strong authentication, rate limits, secure recovery, MFA, session controls, and correct identity checks reduce authentication failures. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to replace weak or incorrectly implemented protection of sensitive data.

Learning point: Use Cryptographic-failure mitigation when the key requirement is to replace weak or incorrectly implemented protection of sensitive data.

Question 24

The primary objective for Wingtip Services is to prevent attacker-controlled input from changing a database or interpreter command. Which selection best satisfies that objective in a managed cloud environment? The organization wants a vendor-neutral approach that can be explained during audit review.

Injection mitigation
Security-misconfiguration mitigation
Remote-code-execution mitigation
Authentication-failure mitigation
End-of-life component remediation

Correct answer: A

Option review:

A: Parameterized queries, allow-listed validation, safe APIs, and separation of code from data reduce injection flaws. It directly fits this scenario because the requirement is to prevent attacker-controlled input from changing a database or interpreter command.

B: Harden defaults, remove unnecessary features, protect secrets, set secure headers, and continuously check configuration drift. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent attacker-controlled input from changing a database or interpreter command.

C: Patch vulnerable components, validate inputs, reduce privileges, isolate services, and apply application controls to prevent arbitrary code execution. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent attacker-controlled input from changing a database or interpreter command.

D: Strong authentication, rate limits, secure recovery, MFA, session controls, and correct identity checks reduce authentication failures. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent attacker-controlled input from changing a database or interpreter command.

E: Upgrade, replace, isolate, or apply compensating controls to components that no longer receive security fixes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent attacker-controlled input from changing a database or interpreter command.

Learning point: Use Injection mitigation when the key requirement is to prevent attacker-controlled input from changing a database or interpreter command.

Question 25

At Woodgrove Bank, a threat hunter needs to stop a malicious site from causing a logged-in user browser to submit an unwanted action. Which option is the BEST fit for a high-value payment environment? Base the decision on the primary security requirement, not on implementation convenience.

SSRF mitigation
CSRF mitigation
Reflected cross-site scripting defense
Cryptographic-failure mitigation
Security-misconfiguration mitigation

Correct answer: B

Why: Anti-CSRF tokens, SameSite cookies, reauthentication for sensitive actions, and origin checks reduce cross-site request forgery. It directly fits this scenario because the requirement is to stop a malicious site from causing a logged-in user browser to submit an unwanted action.

Option review:

B: Anti-CSRF tokens, SameSite cookies, reauthentication for sensitive actions, and origin checks reduce cross-site request forgery. It directly fits this scenario because the requirement is to stop a malicious site from causing a logged-in user browser to submit an unwanted action.

C: Reflected XSS defenses include contextual output encoding, input handling, and browser controls such as CSP where appropriate. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to stop a malicious site from causing a logged-in user browser to submit an unwanted action.

D: Use strong current algorithms, secure key management, correct certificate validation, and encryption for sensitive data in transit and at rest. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to stop a malicious site from causing a logged-in user browser to submit an unwanted action.

Learning point: Use CSRF mitigation when the key requirement is to stop a malicious site from causing a logged-in user browser to submit an unwanted action.

Question 26

During an investigation at Humongous Insurance, the immediate requirement is to prevent user input such as ../ from escaping an intended directory. What should a risk analyst select? The environment follows least privilege and preserves evidence where incident handling is involved.

Memory-safety and overflow controls
Persistent cross-site scripting defense
Broken-access-control mitigation
CSRF mitigation
Directory-traversal mitigation

Correct answer: E

Option review:

A: Bounds checking, memory-safe languages, compiler protections, and secure coding reduce buffer, integer, heap, and stack overflow risk. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent user input such as ../ from escaping an intended directory.

B: Stored XSS requires preventing unsafe stored content from being rendered as executable script through validation and contextual output encoding. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent user input such as ../ from escaping an intended directory.

C: Server-side authorization must enforce least privilege on every request rather than trusting client-side controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent user input such as ../ from escaping an intended directory.

D: Anti-CSRF tokens, SameSite cookies, reauthentication for sensitive actions, and origin checks reduce cross-site request forgery. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent user input such as ../ from escaping an intended directory.

Learning point: Use Directory-traversal mitigation when the key requirement is to prevent user input such as ../ from escaping an intended directory.

Question 27

At Contoso Health, the response plan has three distinct requirements: fix a security weakness caused by the system architecture rather than a coding bug; prevent untrusted input from causing arbitrary commands or code to run; and reduce memory-corruption risk from out-of-bounds or arithmetic errors. Which THREE options should be selected? Use the choice that most directly addresses the stated evidence rather than a broader control.

Remote-code-execution mitigation
File-inclusion mitigation
Security-misconfiguration mitigation
Secure-design mitigation
Memory-safety and overflow controls

Correct answers: A, D, E

Why: Patch vulnerable components, validate inputs, reduce privileges, isolate services, and apply application controls to prevent arbitrary code execution. It directly fits this scenario because the requirement is to prevent untrusted input from causing arbitrary commands or code to run. Threat modeling, abuse-case analysis, least privilege, and architecture review address insecure design before implementation. It directly fits this scenario because the requirement is to fix a security weakness caused by the system architecture rather than a coding bug. Bounds checking, memory-safe languages, compiler protections, and secure coding reduce buffer, integer, heap, and stack overflow risk. It directly fits this scenario because the requirement is to reduce memory-corruption risk from out-of-bounds or arithmetic errors.

Option review:

A: Patch vulnerable components, validate inputs, reduce privileges, isolate services, and apply application controls to prevent arbitrary code execution. It directly fits this scenario because the requirement is to prevent untrusted input from causing arbitrary commands or code to run.

B: Avoid user-controlled include paths, use allow lists and canonicalization, disable remote inclusion, and constrain filesystem/network access. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to fix a security weakness caused by the system architecture rather than a coding bug; prevent untrusted input from causing arbitrary commands or code to run; reduce memory-corruption risk from out-of-bounds or arithmetic errors.

C: Harden defaults, remove unnecessary features, protect secrets, set secure headers, and continuously check configuration drift. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to fix a security weakness caused by the system architecture rather than a coding bug; prevent untrusted input from causing arbitrary commands or code to run; reduce memory-corruption risk from out-of-bounds or arithmetic errors.

D: Threat modeling, abuse-case analysis, least privilege, and architecture review address insecure design before implementation. It directly fits this scenario because the requirement is to fix a security weakness caused by the system architecture rather than a coding bug.

Learning point: Use Secure-design mitigation, Remote-code-execution mitigation, Memory-safety and overflow controls when the key requirement is to fix a security weakness caused by the system architecture rather than a coding bug; prevent untrusted input from causing arbitrary commands or code to run; reduce memory-corruption risk from out-of-bounds or arithmetic errors.

Question 28

A ticket at Blue Yonder Airlines asks a security operations engineer to correct a service left with risky default or overly permissive settings. Which choice addresses the requirement most directly? The team wants the most defensible analyst action before expanding the investigation.

Persistent cross-site scripting defense
Security-misconfiguration mitigation
Remote-code-execution mitigation
Data-poisoning controls
Authentication-failure mitigation

Correct answer: B

Why: Harden defaults, remove unnecessary features, protect secrets, set secure headers, and continuously check configuration drift. It directly fits this scenario because the requirement is to correct a service left with risky default or overly permissive settings.

Option review:

A: Stored XSS requires preventing unsafe stored content from being rendered as executable script through validation and contextual output encoding. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to correct a service left with risky default or overly permissive settings.

B: Harden defaults, remove unnecessary features, protect secrets, set secure headers, and continuously check configuration drift. It directly fits this scenario because the requirement is to correct a service left with risky default or overly permissive settings.

C: Patch vulnerable components, validate inputs, reduce privileges, isolate services, and apply application controls to prevent arbitrary code execution. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to correct a service left with risky default or overly permissive settings.

D: Input provenance, validation, anomaly detection, access control, and trusted training/data pipelines reduce data-poisoning risk. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to correct a service left with risky default or overly permissive settings.

E: Strong authentication, rate limits, secure recovery, MFA, session controls, and correct identity checks reduce authentication failures. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to correct a service left with risky default or overly permissive settings.

Learning point: Use Security-misconfiguration mitigation when the key requirement is to correct a service left with risky default or overly permissive settings.

Question 29

In a remote-work environment, a detection engineer must address a vulnerable component that the vendor no longer patches. Which approach is MOST appropriate? Select based on the scenario’s decisive constraint, not on which technology is newest.

Broken-access-control mitigation
Directory-traversal mitigation
Authentication-failure mitigation
Security-misconfiguration mitigation
End-of-life component remediation

Correct answer: E

Option review:

A: Server-side authorization must enforce least privilege on every request rather than trusting client-side controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to address a vulnerable component that the vendor no longer patches.

B: Canonicalize paths, allow-list files or directories, avoid direct user-controlled paths, and enforce filesystem permissions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to address a vulnerable component that the vendor no longer patches.

C: Strong authentication, rate limits, secure recovery, MFA, session controls, and correct identity checks reduce authentication failures. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to address a vulnerable component that the vendor no longer patches.

D: Harden defaults, remove unnecessary features, protect secrets, set secure headers, and continuously check configuration drift. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to address a vulnerable component that the vendor no longer patches.

Learning point: Use End-of-life component remediation when the key requirement is to address a vulnerable component that the vendor no longer patches.

Question 30

A review at Fabrikam Finance finds a gap: the team cannot reliably reduce account compromise caused by weak login or recovery controls. Which option best closes that gap? Assume the activity is authorized and must follow normal enterprise change control.

SSRF mitigation
Data-poisoning controls
Privilege-escalation mitigation
File-inclusion mitigation
Authentication-failure mitigation

Correct answer: E

Option review:

A: Restrict server egress, validate destinations, block metadata endpoints, and use allow lists so server-side requests cannot reach arbitrary internal resources. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce account compromise caused by weak login or recovery controls.

B: Input provenance, validation, anomaly detection, access control, and trusted training/data pipelines reduce data-poisoning risk. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce account compromise caused by weak login or recovery controls.

C: Patch local flaws, enforce least privilege, harden permissions, and monitor privileged changes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce account compromise caused by weak login or recovery controls.

D: Avoid user-controlled include paths, use allow lists and canonicalization, disable remote inclusion, and constrain filesystem/network access. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce account compromise caused by weak login or recovery controls.

E: Strong authentication, rate limits, secure recovery, MFA, session controls, and correct identity checks reduce authentication failures. It directly fits this scenario because the requirement is to reduce account compromise caused by weak login or recovery controls.

Learning point: Use Authentication-failure mitigation when the key requirement is to reduce account compromise caused by weak login or recovery controls.

Question 31

City Power Utilities is designing a combined control. It must stop an attacker from making the application server fetch internal or cloud-metadata URLs, and stop users from accessing records or functions outside their authorization. Which TWO options are most appropriate? Assume no additional product-specific features are available beyond the concepts listed.

Authentication-failure mitigation
Security-misconfiguration mitigation
Remote-code-execution mitigation
SSRF mitigation
Broken-access-control mitigation

Correct answers: D, E

Why: Restrict server egress, validate destinations, block metadata endpoints, and use allow lists so server-side requests cannot reach arbitrary internal resources. It directly fits this scenario because the requirement is to stop an attacker from making the application server fetch internal or cloud-metadata URLs. Server-side authorization must enforce least privilege on every request rather than trusting client-side controls. It directly fits this scenario because the requirement is to stop users from accessing records or functions outside their authorization.

Option review:

A: Strong authentication, rate limits, secure recovery, MFA, session controls, and correct identity checks reduce authentication failures. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to stop an attacker from making the application server fetch internal or cloud-metadata URLs; stop users from accessing records or functions outside their authorization.

B: Harden defaults, remove unnecessary features, protect secrets, set secure headers, and continuously check configuration drift. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to stop an attacker from making the application server fetch internal or cloud-metadata URLs; stop users from accessing records or functions outside their authorization.

C: Patch vulnerable components, validate inputs, reduce privileges, isolate services, and apply application controls to prevent arbitrary code execution. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to stop an attacker from making the application server fetch internal or cloud-metadata URLs; stop users from accessing records or functions outside their authorization.

D: Restrict server egress, validate destinations, block metadata endpoints, and use allow lists so server-side requests cannot reach arbitrary internal resources. It directly fits this scenario because the requirement is to stop an attacker from making the application server fetch internal or cloud-metadata URLs.

E: Server-side authorization must enforce least privilege on every request rather than trusting client-side controls. It directly fits this scenario because the requirement is to stop users from accessing records or functions outside their authorization.

Learning point: Use SSRF mitigation, Broken-access-control mitigation when the key requirement is to stop an attacker from making the application server fetch internal or cloud-metadata URLs; stop users from accessing records or functions outside their authorization.

Question 32

During a security review, a security consultant must address two separate needs: prevent untrusted input from causing arbitrary commands or code to run, and replace weak or incorrectly implemented protection of sensitive data. Select TWO. The organization wants a vendor-neutral approach that can be explained during audit review.

Remote-code-execution mitigation
Cryptographic-failure mitigation
Secure-design mitigation
Memory-safety and overflow controls
Security-misconfiguration mitigation

Correct answers: A, B

Option review:

C: Threat modeling, abuse-case analysis, least privilege, and architecture review address insecure design before implementation. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent untrusted input from causing arbitrary commands or code to run; replace weak or incorrectly implemented protection of sensitive data.

D: Bounds checking, memory-safe languages, compiler protections, and secure coding reduce buffer, integer, heap, and stack overflow risk. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent untrusted input from causing arbitrary commands or code to run; replace weak or incorrectly implemented protection of sensitive data.

E: Harden defaults, remove unnecessary features, protect secrets, set secure headers, and continuously check configuration drift. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent untrusted input from causing arbitrary commands or code to run; replace weak or incorrectly implemented protection of sensitive data.

Learning point: Use Remote-code-execution mitigation, Cryptographic-failure mitigation when the key requirement is to prevent untrusted input from causing arbitrary commands or code to run; replace weak or incorrectly implemented protection of sensitive data.

Question 33

At Northwind Traders, a security engineer has two simultaneous requirements: prevent a low-privilege foothold from becoming administrator or root access, and prevent attacker-controlled input from changing a database or interpreter command. Which TWO options should be selected? Base the decision on the primary security requirement, not on implementation convenience.

End-of-life component remediation
File-inclusion mitigation
Privilege-escalation mitigation
Memory-safety and overflow controls
Injection mitigation

Correct answers: C, E

Why: Patch local flaws, enforce least privilege, harden permissions, and monitor privileged changes. It directly fits this scenario because the requirement is to prevent a low-privilege foothold from becoming administrator or root access. Parameterized queries, allow-listed validation, safe APIs, and separation of code from data reduce injection flaws. It directly fits this scenario because the requirement is to prevent attacker-controlled input from changing a database or interpreter command.

Option review:

A: Upgrade, replace, isolate, or apply compensating controls to components that no longer receive security fixes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent a low-privilege foothold from becoming administrator or root access; prevent attacker-controlled input from changing a database or interpreter command.

B: Avoid user-controlled include paths, use allow lists and canonicalization, disable remote inclusion, and constrain filesystem/network access. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent a low-privilege foothold from becoming administrator or root access; prevent attacker-controlled input from changing a database or interpreter command.

C: Patch local flaws, enforce least privilege, harden permissions, and monitor privileged changes. It directly fits this scenario because the requirement is to prevent a low-privilege foothold from becoming administrator or root access.

D: Bounds checking, memory-safe languages, compiler protections, and secure coding reduce buffer, integer, heap, and stack overflow risk. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent a low-privilege foothold from becoming administrator or root access; prevent attacker-controlled input from changing a database or interpreter command.

Learning point: Use Privilege-escalation mitigation, Injection mitigation when the key requirement is to prevent a low-privilege foothold from becoming administrator or root access; prevent attacker-controlled input from changing a database or interpreter command.

Question 34

The primary objective for Alpine Ski House is to prevent local or remote files from being loaded through attacker-controlled include parameters. Which selection best satisfies that objective in a SaaS-heavy business? The environment follows least privilege and preserves evidence where incident handling is involved.

File-inclusion mitigation
Remote-code-execution mitigation
Data-poisoning controls
SSRF mitigation
Privilege-escalation mitigation

Correct answer: A

Option review:

B: Patch vulnerable components, validate inputs, reduce privileges, isolate services, and apply application controls to prevent arbitrary code execution. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent local or remote files from being loaded through attacker-controlled include parameters.

C: Input provenance, validation, anomaly detection, access control, and trusted training/data pipelines reduce data-poisoning risk. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent local or remote files from being loaded through attacker-controlled include parameters.

D: Restrict server egress, validate destinations, block metadata endpoints, and use allow lists so server-side requests cannot reach arbitrary internal resources. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent local or remote files from being loaded through attacker-controlled include parameters.

E: Patch local flaws, enforce least privilege, harden permissions, and monitor privileged changes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent local or remote files from being loaded through attacker-controlled include parameters.

Learning point: Use File-inclusion mitigation when the key requirement is to prevent local or remote files from being loaded through attacker-controlled include parameters.

Question 35

At Coho Winery, a systems security analyst needs to mitigate script input that is immediately reflected into a response. Which option is the BEST fit for a branch-office network? Use the choice that most directly addresses the stated evidence rather than a broader control.

Authentication-failure mitigation
Reflected cross-site scripting defense
Security-misconfiguration mitigation
Memory-safety and overflow controls
File-inclusion mitigation

Correct answer: B

Option review:

A: Strong authentication, rate limits, secure recovery, MFA, session controls, and correct identity checks reduce authentication failures. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to mitigate script input that is immediately reflected into a response.

D: Bounds checking, memory-safe languages, compiler protections, and secure coding reduce buffer, integer, heap, and stack overflow risk. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to mitigate script input that is immediately reflected into a response.

E: Avoid user-controlled include paths, use allow lists and canonicalization, disable remote inclusion, and constrain filesystem/network access. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to mitigate script input that is immediately reflected into a response.

Learning point: Use Reflected cross-site scripting defense when the key requirement is to mitigate script input that is immediately reflected into a response.

Question 36

During an investigation at Litware Manufacturing, the immediate requirement is to mitigate malicious script stored in application data and later rendered to users. What should an incident responder select? The team wants the most defensible analyst action before expanding the investigation.

Remote-code-execution mitigation
Broken-access-control mitigation
Secure-design mitigation
File-inclusion mitigation
Persistent cross-site scripting defense

Correct answer: E

Option review:

A: Patch vulnerable components, validate inputs, reduce privileges, isolate services, and apply application controls to prevent arbitrary code execution. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to mitigate malicious script stored in application data and later rendered to users.

B: Server-side authorization must enforce least privilege on every request rather than trusting client-side controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to mitigate malicious script stored in application data and later rendered to users.

C: Threat modeling, abuse-case analysis, least privilege, and architecture review address insecure design before implementation. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to mitigate malicious script stored in application data and later rendered to users.

Learning point: Use Persistent cross-site scripting defense when the key requirement is to mitigate malicious script stored in application data and later rendered to users.

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25

Question 26

Question 27

Question 28

Question 29

Question 30

Question 31

Question 32

Question 33

Question 34

Question 35

Question 36

Related posts: