CompTIA Security+ SY0-701 Vulnerability Types Practice Test

 

Topic 07 focuses on Vulnerability Types for the CompTIA Security+ certification and the SY0-701 exam, using practical cybersecurity scenarios aligned to the published Security+ objectives. For broader exam preparation, review the CompTIA Security+ SY0-701 Exam Dumps page. Each question includes a concise explanation of the correct answer and the technical reason the other choices are incorrect.

Question 1

Which term describes placing malicious code or data into the memory space of a running process?

1. Security misconfiguration
2. Cryptographic vulnerability
3. Resource reuse
4. Memory injection

Correct Answer: D

 

Correct Answer

Answer D is correct because Memory injection means placing malicious code or data into the memory space of a running process.

Incorrect Answers

Answer A is incorrect because Security misconfiguration would fit a different scenario. Security misconfiguration refers to an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults.

Answer B is incorrect because Cryptographic vulnerability represents a different security function. Cryptographic vulnerability refers to a weakness caused by broken algorithms, poor key handling, weak parameters, or incorrect cryptographic implementation.

Answer C is incorrect because Resource reuse addresses a different requirement. Resource reuse refers to risk that residual data from a previous user or workload remains accessible when memory or storage resources are reassigned.

 

Question 2

To cause crashes or redirect execution by exceeding memory boundaries, which security approach should be selected?

1. Race condition
2. Jailbreaking
3. Buffer overflow
4. Malicious update

Correct Answer: C

 

Correct Answer

Answer C is correct because Buffer overflow means writing more data to a memory buffer than it can safely hold, potentially overwriting adjacent memory.

Incorrect Answers

Answer A is incorrect because Race condition addresses a different requirement. Race condition refers to a flaw in which security depends on the timing or ordering of concurrent operations.

Answer B is incorrect because Jailbreaking would fit a different scenario. Jailbreaking refers to removing vendor-imposed restrictions on a mobile device or operating system.

Answer D is incorrect because Malicious update addresses a different security requirement. Malicious update refers to a compromised or intentionally harmful software or firmware update delivered through a trusted update mechanism.

 

Question 3

What is a flaw in which security depends on the timing or ordering of concurrent operations?

1. Cloud-specific vulnerability
2. Operating-system vulnerability
3. Race condition
4. End-of-life vulnerability

Correct Answer: C

 

Correct Answer

Answer C is correct because Race condition means a flaw in which security depends on the timing or ordering of concurrent operations.

Incorrect Answers

Answer A is incorrect because Cloud-specific vulnerability represents a different security function. Cloud-specific vulnerability refers to a weakness tied to cloud design, permissions, exposed services, shared responsibility, or service configuration.

Answer B is incorrect because Operating-system vulnerability addresses a different requirement. Operating-system vulnerability refers to a weakness in the operating system kernel, service, driver, or security configuration.

Answer D is incorrect because End-of-life vulnerability would fit a different scenario. End-of-life vulnerability refers to risk created when a product has reached the end of vendor support and no longer receives security fixes.

 

Question 4

To change the resource after validation but before the protected operation, which security approach should be selected?

1. TOCTOU vulnerability
2. SQL injection
3. Jailbreaking
4. Sideloading

Correct Answer: A

 

Correct Answer

Answer A is correct because TOCTOU vulnerability means a race condition caused by a gap between checking a resource and later using it.

Incorrect Answers

Answer B is incorrect because SQL injection addresses a different requirement. SQL injection refers to injection of attacker-controlled SQL syntax into an application’s database query.

Answer C is incorrect because Jailbreaking would fit a different scenario. Jailbreaking refers to removing vendor-imposed restrictions on a mobile device or operating system.

Answer D is incorrect because Sideloading addresses a different security requirement. Sideloading refers to installation of software from a source outside the approved application distribution mechanism.

 

Question 5

What is a compromised or intentionally harmful software or firmware update delivered through a trusted update mechanism?

1. Operating-system vulnerability
2. Malicious update
3. Buffer overflow
4. Security misconfiguration

Correct Answer: B

 

Correct Answer

Answer B is correct because Malicious update means a compromised or intentionally harmful software or firmware update delivered through a trusted update mechanism.

Incorrect Answers

Answer A is incorrect because Operating-system vulnerability addresses a different requirement. Operating-system vulnerability refers to a weakness in the operating system kernel, service, driver, or security configuration.

Answer C is incorrect because Buffer overflow represents a different security function. Buffer overflow refers to writing more data to a memory buffer than it can safely hold, potentially overwriting adjacent memory.

Answer D is incorrect because Security misconfiguration would fit a different scenario. Security misconfiguration refers to an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults.

 

Question 6

To gain privileges or execute code through a flaw in core platform software, which security approach should be selected?

1. Cross-site scripting (XSS)
2. VM escape
3. Sideloading
4. Operating-system vulnerability

Correct Answer: D

 

Correct Answer

Answer D is correct because Operating-system vulnerability means a weakness in the operating system kernel, service, driver, or security configuration.

Incorrect Answers

Answer A is incorrect because Cross-site scripting (XSS) addresses a different security requirement. Cross-site scripting (XSS) refers to injection of active client-side content that executes in another user’s browser under the context of a trusted site.

Answer B is incorrect because VM escape would fit a different scenario. VM escape refers to a virtualization flaw that allows code in a guest virtual machine to affect the hypervisor or another isolation boundary.

Answer C is incorrect because Sideloading addresses a different requirement. Sideloading refers to installation of software from a source outside the approved application distribution mechanism.

 

Question 7

Which term describes injection of attacker-controlled SQL syntax into an application’s database query?

1. Firmware vulnerability
2. Cryptographic vulnerability
3. TOCTOU vulnerability
4. SQL injection

Correct Answer: D

 

Correct Answer

Answer D is correct because SQL injection means injection of attacker-controlled SQL syntax into an application’s database query.

Incorrect Answers

Answer A is incorrect because Firmware vulnerability would fit a different scenario. Firmware vulnerability refers to a weakness in low-level device software that controls hardware operation.

Answer B is incorrect because Cryptographic vulnerability represents a different security function. Cryptographic vulnerability refers to a weakness caused by broken algorithms, poor key handling, weak parameters, or incorrect cryptographic implementation.

Answer C is incorrect because TOCTOU vulnerability addresses a different requirement. TOCTOU vulnerability refers to a race condition caused by a gap between checking a resource and later using it.

 

Question 8

To steal session data or manipulate browser behavior through unsafe output handling, which security approach should be selected?

1. Cross-site scripting (XSS)
2. Sideloading
3. VM escape
4. Memory injection

Correct Answer: A

 

Correct Answer

Answer A is correct because Cross-site scripting (XSS) means injection of active client-side content that executes in another user’s browser under the context of a trusted site.

Incorrect Answers

Answer B is incorrect because Sideloading addresses a different requirement. Sideloading refers to installation of software from a source outside the approved application distribution mechanism.

Answer C is incorrect because VM escape would fit a different scenario. VM escape refers to a virtualization flaw that allows code in a guest virtual machine to affect the hypervisor or another isolation boundary.

Answer D is incorrect because Memory injection addresses a different security requirement. Memory injection refers to placing malicious code or data into the memory space of a running process.

 

Question 9

Which weakness in low-level device software controls hardware operation?

1. Firmware vulnerability
2. SQL injection
3. Security misconfiguration
4. TOCTOU vulnerability

Correct Answer: A

 

Correct Answer

Answer A is correct because Firmware vulnerability means a weakness in low-level device software that controls hardware operation.

Incorrect Answers

Answer B is incorrect because SQL injection represents a different security function. SQL injection refers to injection of attacker-controlled SQL syntax into an application’s database query.

Answer C is incorrect because Security misconfiguration would fit a different scenario. Security misconfiguration refers to an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults.

Answer D is incorrect because TOCTOU vulnerability addresses a different requirement. TOCTOU vulnerability refers to a race condition caused by a gap between checking a resource and later using it.

 

Question 10

To leave known flaws permanently unpatched because vendor remediation is unavailable, which security approach should be selected?

1. End-of-life vulnerability
2. Jailbreaking
3. Malicious update
4. Buffer overflow

Correct Answer: A

 

Correct Answer

Answer A is correct because End-of-life vulnerability means risk created when a product has reached the end of vendor support and no longer receives security fixes.

Incorrect Answers

Answer B is incorrect because Jailbreaking addresses a different security requirement. Jailbreaking refers to removing vendor-imposed restrictions on a mobile device or operating system.

Answer C is incorrect because Malicious update would fit a different scenario. Malicious update refers to a compromised or intentionally harmful software or firmware update delivered through a trusted update mechanism.

Answer D is incorrect because Buffer overflow addresses a different requirement. Buffer overflow refers to writing more data to a memory buffer than it can safely hold, potentially overwriting adjacent memory.

 

Question 11

Which term describes risk introduced by old technology that must remain in service despite outdated security capabilities?

1. VM escape
2. Legacy-system vulnerability
3. Malicious update
4. Firmware vulnerability

Correct Answer: B

 

Correct Answer

Answer B is correct because Legacy-system vulnerability means risk introduced by old technology that must remain in service despite outdated security capabilities.

Incorrect Answers

Answer A is incorrect because VM escape would fit a different scenario. VM escape refers to a virtualization flaw that allows code in a guest virtual machine to affect the hypervisor or another isolation boundary.

Answer C is incorrect because Malicious update represents a different security function. Malicious update refers to a compromised or intentionally harmful software or firmware update delivered through a trusted update mechanism.

Answer D is incorrect because Firmware vulnerability addresses a different requirement. Firmware vulnerability refers to a weakness in low-level device software that controls hardware operation.

 

Question 12

To break out of a guest and compromise a more privileged virtualization layer, which security approach should be selected?

1. Sideloading
2. Cryptographic vulnerability
3. VM escape
4. Security misconfiguration

Correct Answer: C

 

Correct Answer

Answer C is correct because VM escape means a virtualization flaw that allows code in a guest virtual machine to affect the hypervisor or another isolation boundary.

Incorrect Answers

Answer A is incorrect because Sideloading would fit a different scenario. Sideloading refers to installation of software from a source outside the approved application distribution mechanism.

Answer B is incorrect because Cryptographic vulnerability addresses a different security requirement. Cryptographic vulnerability refers to a weakness caused by broken algorithms, poor key handling, weak parameters, or incorrect cryptographic implementation.

Answer D is incorrect because Security misconfiguration addresses a different requirement. Security misconfiguration refers to an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults.

 

Question 13

Which term describes risk that residual data from a previous user or workload remains accessible when memory or storage resources are reassigned?

1. TOCTOU vulnerability
2. Resource reuse
3. Cross-site scripting (XSS)
4. End-of-life vulnerability

Correct Answer: B

 

Correct Answer

Answer B is correct because Resource reuse means risk that residual data from a previous user or workload remains accessible when memory or storage resources are reassigned.

Incorrect Answers

Answer A is incorrect because TOCTOU vulnerability represents a different security function. TOCTOU vulnerability refers to a race condition caused by a gap between checking a resource and later using it.

Answer C is incorrect because Cross-site scripting (XSS) would fit a different scenario. Cross-site scripting (XSS) refers to injection of active client-side content that executes in another user’s browser under the context of a trusted site.

Answer D is incorrect because End-of-life vulnerability addresses a different requirement. End-of-life vulnerability refers to risk created when a product has reached the end of vendor support and no longer receives security fixes.

 

Question 14

To compromise cloud resources through cloud-specific misconfiguration or control gaps, which security approach should be selected?

1. Race condition
2. Security misconfiguration
3. Cloud-specific vulnerability
4. VM escape

Correct Answer: C

 

Correct Answer

Answer C is correct because Cloud-specific vulnerability means a weakness tied to cloud design, permissions, exposed services, shared responsibility, or service configuration.

Incorrect Answers

Answer A is incorrect because Race condition addresses a different security requirement. Race condition refers to a flaw in which security depends on the timing or ordering of concurrent operations.

Answer B is incorrect because Security misconfiguration addresses a different requirement. Security misconfiguration refers to an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults.

Answer D is incorrect because VM escape would fit a different scenario. VM escape refers to a virtualization flaw that allows code in a guest virtual machine to affect the hypervisor or another isolation boundary.

 

Question 15

What is a weakness introduced through software dependencies, service providers, vendors, or hardware components?

1. Cryptographic vulnerability
2. Cross-site scripting (XSS)
3. Malicious update
4. Supply-chain vulnerability

Correct Answer: D

 

Correct Answer

Answer D is correct because Supply-chain vulnerability means a weakness introduced through software dependencies, service providers, vendors, or hardware components.

Incorrect Answers

Answer A is incorrect because Cryptographic vulnerability would fit a different scenario. Cryptographic vulnerability refers to a weakness caused by broken algorithms, poor key handling, weak parameters, or incorrect cryptographic implementation.

Answer B is incorrect because Cross-site scripting (XSS) represents a different security function. Cross-site scripting (XSS) refers to injection of active client-side content that executes in another user’s browser under the context of a trusted site.

Answer C is incorrect because Malicious update addresses a different requirement. Malicious update refers to a compromised or intentionally harmful software or firmware update delivered through a trusted update mechanism.

 

Question 16

To defeat intended confidentiality, integrity, or authentication protections, which security approach should be selected?

1. Malicious update
2. Cross-site scripting (XSS)
3. Cryptographic vulnerability
4. Race condition

Correct Answer: C

 

Correct Answer

Answer C is correct because Cryptographic vulnerability means a weakness caused by broken algorithms, poor key handling, weak parameters, or incorrect cryptographic implementation.

Incorrect Answers

Answer A is incorrect because Malicious update addresses a different security requirement. Malicious update refers to a compromised or intentionally harmful software or firmware update delivered through a trusted update mechanism.

Answer B is incorrect because Cross-site scripting (XSS) would fit a different scenario. Cross-site scripting (XSS) refers to injection of active client-side content that executes in another user’s browser under the context of a trusted site.

Answer D is incorrect because Race condition addresses a different requirement. Race condition refers to a flaw in which security depends on the timing or ordering of concurrent operations.

 

Question 17

What is an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults?

1. Operating-system vulnerability
2. Security misconfiguration
3. Sideloading
4. Supply-chain vulnerability

Correct Answer: B

 

Correct Answer

Answer B is correct because Security misconfiguration means an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults.

Incorrect Answers

Answer A is incorrect because Operating-system vulnerability addresses a different requirement. Operating-system vulnerability refers to a weakness in the operating system kernel, service, driver, or security configuration.

Answer C is incorrect because Sideloading would fit a different scenario. Sideloading refers to installation of software from a source outside the approved application distribution mechanism.

Answer D is incorrect because Supply-chain vulnerability represents a different security function. Supply-chain vulnerability refers to a weakness introduced through software dependencies, service providers, vendors, or hardware components.

 

Question 18

To bypass normal application vetting and introduce untrusted mobile software, which security approach should be selected?

1. Cryptographic vulnerability
2. Jailbreaking
3. Sideloading
4. SQL injection

Correct Answer: C

 

Correct Answer

Answer C is correct because Sideloading means installation of software from a source outside the approved application distribution mechanism.

Incorrect Answers

Answer A is incorrect because Cryptographic vulnerability would fit a different scenario. Cryptographic vulnerability refers to a weakness caused by broken algorithms, poor key handling, weak parameters, or incorrect cryptographic implementation.

Answer B is incorrect because Jailbreaking addresses a different requirement. Jailbreaking refers to removing vendor-imposed restrictions on a mobile device or operating system.

Answer D is incorrect because SQL injection addresses a different security requirement. SQL injection refers to injection of attacker-controlled SQL syntax into an application’s database query.

 

Question 19

Which term describes removing vendor-imposed restrictions on a mobile device or operating system?

1. Jailbreaking
2. Malicious update
3. Security misconfiguration
4. VM escape

Correct Answer: A

 

Correct Answer

Answer A is correct because Jailbreaking means removing vendor-imposed restrictions on a mobile device or operating system.

Incorrect Answers

Answer B is incorrect because Malicious update addresses a different requirement. Malicious update refers to a compromised or intentionally harmful software or firmware update delivered through a trusted update mechanism.

Answer C is incorrect because Security misconfiguration would fit a different scenario. Security misconfiguration refers to an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults.

Answer D is incorrect because VM escape represents a different security function. VM escape refers to a virtualization flaw that allows code in a guest virtual machine to affect the hypervisor or another isolation boundary.

 

Question 20

To exploit a newly discovered weakness before standard remediation is available, which security approach should be selected?

1. TOCTOU vulnerability
2. Zero-day vulnerability
3. SQL injection
4. Cross-site scripting (XSS)

Correct Answer: B

 

Correct Answer

Answer B is correct because Zero-day vulnerability means a vulnerability for which defenders do not yet have a broadly available fix or may have little warning before exploitation.

Incorrect Answers

Answer A is incorrect because TOCTOU vulnerability would fit a different scenario. TOCTOU vulnerability refers to a race condition caused by a gap between checking a resource and later using it.

Answer C is incorrect because SQL injection addresses a different requirement. SQL injection refers to injection of attacker-controlled SQL syntax into an application’s database query.

Answer D is incorrect because Cross-site scripting (XSS) addresses a different security requirement. Cross-site scripting (XSS) refers to injection of active client-side content that executes in another user’s browser under the context of a trusted site.

 

Question 21

To execute attacker-controlled behavior inside an existing process, which security approach should be selected?

1. Race condition
2. Sideloading
3. VM escape
4. Memory injection

Correct Answer: D

 

Correct Answer

Answer D is correct because Memory injection means placing malicious code or data into the memory space of a running process.

Incorrect Answers

Answer A is incorrect because Race condition would fit a different scenario. Race condition refers to a flaw in which security depends on the timing or ordering of concurrent operations.

Answer B is incorrect because Sideloading represents a different security function. Sideloading refers to installation of software from a source outside the approved application distribution mechanism.

Answer C is incorrect because VM escape addresses a different security requirement. VM escape refers to a virtualization flaw that allows code in a guest virtual machine to affect the hypervisor or another isolation boundary.

 

Question 22

Which term describes writing more data to a memory buffer than it can safely hold, potentially overwriting adjacent memory?

1. Race condition
2. Buffer overflow
3. End-of-life vulnerability
4. VM escape

Correct Answer: B

 

Correct Answer

Answer B is correct because Buffer overflow means writing more data to a memory buffer than it can safely hold, potentially overwriting adjacent memory.

Incorrect Answers

Answer A is incorrect because Race condition addresses a different requirement. Race condition refers to a flaw in which security depends on the timing or ordering of concurrent operations.

Answer C is incorrect because End-of-life vulnerability addresses a different security requirement. End-of-life vulnerability refers to risk created when a product has reached the end of vendor support and no longer receives security fixes.

Answer D is incorrect because VM escape represents a different security function. VM escape refers to a virtualization flaw that allows code in a guest virtual machine to affect the hypervisor or another isolation boundary.

 

Question 23

To exploit an unexpected sequence between checks and actions, which security approach should be selected?

1. Race condition
2. Legacy-system vulnerability
3. Malicious update
4. SQL injection

Correct Answer: A

 

Correct Answer

Answer A is correct because Race condition means a flaw in which security depends on the timing or ordering of concurrent operations.

Incorrect Answers

Answer B is incorrect because Legacy-system vulnerability represents a different security function. Legacy-system vulnerability refers to risk introduced by old technology that must remain in service despite outdated security capabilities.

Answer C is incorrect because Malicious update would fit a different scenario. Malicious update refers to a compromised or intentionally harmful software or firmware update delivered through a trusted update mechanism.

Answer D is incorrect because SQL injection addresses a different security requirement. SQL injection refers to injection of attacker-controlled SQL syntax into an application’s database query.

 

Question 24

Which race condition is caused by a gap between checking a resource and later using it?

1. Supply-chain vulnerability
2. TOCTOU vulnerability
3. Cryptographic vulnerability
4. Zero-day vulnerability

Correct Answer: B

 

Correct Answer

Answer B is correct because TOCTOU vulnerability means a race condition caused by a gap between checking a resource and later using it.

Incorrect Answers

Answer A is incorrect because Supply-chain vulnerability addresses a different security requirement. Supply-chain vulnerability refers to a weakness introduced through software dependencies, service providers, vendors, or hardware components.

Answer C is incorrect because Cryptographic vulnerability represents a different security function. Cryptographic vulnerability refers to a weakness caused by broken algorithms, poor key handling, weak parameters, or incorrect cryptographic implementation.

Answer D is incorrect because Zero-day vulnerability addresses a different requirement. Zero-day vulnerability refers to a vulnerability for which defenders do not yet have a broadly available fix or may have little warning before exploitation.

 

Question 25

To abuse the update process to distribute malicious code, which security approach should be selected?

1. Malicious update
2. Operating-system vulnerability
3. Legacy-system vulnerability
4. VM escape

Correct Answer: A

 

Correct Answer

Answer A is correct because Malicious update means a compromised or intentionally harmful software or firmware update delivered through a trusted update mechanism.

Incorrect Answers

Answer B is incorrect because Operating-system vulnerability would fit a different scenario. Operating-system vulnerability refers to a weakness in the operating system kernel, service, driver, or security configuration.

Answer C is incorrect because Legacy-system vulnerability addresses a different security requirement. Legacy-system vulnerability refers to risk introduced by old technology that must remain in service despite outdated security capabilities.

Answer D is incorrect because VM escape represents a different security function. VM escape refers to a virtualization flaw that allows code in a guest virtual machine to affect the hypervisor or another isolation boundary.

 

Question 26

What is a weakness in the operating system kernel, service, driver, or security configuration?

1. SQL injection
2. Operating-system vulnerability
3. Security misconfiguration
4. Cloud-specific vulnerability

Correct Answer: B

 

Correct Answer

Answer B is correct because Operating-system vulnerability means a weakness in the operating system kernel, service, driver, or security configuration.

Incorrect Answers

Answer A is incorrect because SQL injection represents a different security function. SQL injection refers to injection of attacker-controlled SQL syntax into an application’s database query.

Answer C is incorrect because Security misconfiguration addresses a different requirement. Security misconfiguration refers to an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults.

Answer D is incorrect because Cloud-specific vulnerability addresses a different security requirement. Cloud-specific vulnerability refers to a weakness tied to cloud design, permissions, exposed services, shared responsibility, or service configuration.

 

Question 27

To read or manipulate database data when input is not handled safely, which security approach should be selected?

1. SQL injection
2. Memory injection
3. Supply-chain vulnerability
4. Cryptographic vulnerability

Correct Answer: A

 

Correct Answer

Answer A is correct because SQL injection means injection of attacker-controlled SQL syntax into an application’s database query.

Incorrect Answers

Answer B is incorrect because Memory injection addresses a different security requirement. Memory injection refers to placing malicious code or data into the memory space of a running process.

Answer C is incorrect because Supply-chain vulnerability represents a different security function. Supply-chain vulnerability refers to a weakness introduced through software dependencies, service providers, vendors, or hardware components.

Answer D is incorrect because Cryptographic vulnerability would fit a different scenario. Cryptographic vulnerability refers to a weakness caused by broken algorithms, poor key handling, weak parameters, or incorrect cryptographic implementation.

 

Question 28

Which term describes injection of active client-side content that executes in another user’s browser under the context of a trusted site?

1. SQL injection
2. Buffer overflow
3. Cross-site scripting (XSS)
4. Resource reuse

Correct Answer: C

 

Correct Answer

Answer C is correct because Cross-site scripting (XSS) means injection of active client-side content that executes in another user’s browser under the context of a trusted site.

Incorrect Answers

Answer A is incorrect because SQL injection addresses a different security requirement. SQL injection refers to injection of attacker-controlled SQL syntax into an application’s database query.

Answer B is incorrect because Buffer overflow represents a different security function. Buffer overflow refers to writing more data to a memory buffer than it can safely hold, potentially overwriting adjacent memory.

Answer D is incorrect because Resource reuse addresses a different requirement. Resource reuse refers to risk that residual data from a previous user or workload remains accessible when memory or storage resources are reassigned.

 

Question 29

To compromise a device below the operating-system layer, which security approach should be selected?

1. Buffer overflow
2. TOCTOU vulnerability
3. Firmware vulnerability
4. Operating-system vulnerability

Correct Answer: C

 

Correct Answer

Answer C is correct because Firmware vulnerability means a weakness in low-level device software that controls hardware operation.

Incorrect Answers

Answer A is incorrect because Buffer overflow would fit a different scenario. Buffer overflow refers to writing more data to a memory buffer than it can safely hold, potentially overwriting adjacent memory.

Answer B is incorrect because TOCTOU vulnerability represents a different security function. TOCTOU vulnerability refers to a race condition caused by a gap between checking a resource and later using it.

Answer D is incorrect because Operating-system vulnerability addresses a different security requirement. Operating-system vulnerability refers to a weakness in the operating system kernel, service, driver, or security configuration.

 

Question 30

Which term describes risk created when a product has reached the end of vendor support and no longer receives security fixes?

1. Resource reuse
2. Zero-day vulnerability
3. Firmware vulnerability
4. End-of-life vulnerability

Correct Answer: D

 

Correct Answer

Answer D is correct because End-of-life vulnerability means risk created when a product has reached the end of vendor support and no longer receives security fixes.

Incorrect Answers

Answer A is incorrect because Resource reuse addresses a different requirement. Resource reuse refers to risk that residual data from a previous user or workload remains accessible when memory or storage resources are reassigned.

Answer B is incorrect because Zero-day vulnerability addresses a different security requirement. Zero-day vulnerability refers to a vulnerability for which defenders do not yet have a broadly available fix or may have little warning before exploitation.

Answer C is incorrect because Firmware vulnerability represents a different security function. Firmware vulnerability refers to a weakness in low-level device software that controls hardware operation.

 

Question 31

To expose weak protocols, unsupported dependencies, or limited hardening options, which security approach should be selected?

1. Cross-site scripting (XSS)
2. Firmware vulnerability
3. Legacy-system vulnerability
4. Sideloading

Correct Answer: C

 

Correct Answer

Answer C is correct because Legacy-system vulnerability means risk introduced by old technology that must remain in service despite outdated security capabilities.

Incorrect Answers

Answer A is incorrect because Cross-site scripting (XSS) represents a different security function. Cross-site scripting (XSS) refers to injection of active client-side content that executes in another user’s browser under the context of a trusted site.

Answer B is incorrect because Firmware vulnerability would fit a different scenario. Firmware vulnerability refers to a weakness in low-level device software that controls hardware operation.

Answer D is incorrect because Sideloading addresses a different security requirement. Sideloading refers to installation of software from a source outside the approved application distribution mechanism.

 

Question 32

Which virtualization flaw allows code in a guest virtual machine to affect the hypervisor or another isolation boundary?

1. TOCTOU vulnerability
2. VM escape
3. Race condition
4. Security misconfiguration

Correct Answer: B

 

Correct Answer

Answer B is correct because VM escape means a virtualization flaw that allows code in a guest virtual machine to affect the hypervisor or another isolation boundary.

Incorrect Answers

Answer A is incorrect because TOCTOU vulnerability addresses a different security requirement. TOCTOU vulnerability refers to a race condition caused by a gap between checking a resource and later using it.

Answer C is incorrect because Race condition addresses a different requirement. Race condition refers to a flaw in which security depends on the timing or ordering of concurrent operations.

Answer D is incorrect because Security misconfiguration represents a different security function. Security misconfiguration refers to an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults.

 

Question 33

To expose information because reused resources were not properly cleared, which security approach should be selected?

1. Operating-system vulnerability
2. Cross-site scripting (XSS)
3. Firmware vulnerability
4. Resource reuse

Correct Answer: D

 

Correct Answer

Answer D is correct because Resource reuse means risk that residual data from a previous user or workload remains accessible when memory or storage resources are reassigned.

Incorrect Answers

Answer A is incorrect because Operating-system vulnerability represents a different security function. Operating-system vulnerability refers to a weakness in the operating system kernel, service, driver, or security configuration.

Answer B is incorrect because Cross-site scripting (XSS) would fit a different scenario. Cross-site scripting (XSS) refers to injection of active client-side content that executes in another user’s browser under the context of a trusted site.

Answer C is incorrect because Firmware vulnerability addresses a different security requirement. Firmware vulnerability refers to a weakness in low-level device software that controls hardware operation.

 

Question 34

What is a weakness tied to cloud design, permissions, exposed services, shared responsibility, or service configuration?

1. Cloud-specific vulnerability
2. Legacy-system vulnerability
3. Buffer overflow
4. Sideloading

Correct Answer: A

 

Correct Answer

Answer A is correct because Cloud-specific vulnerability means a weakness tied to cloud design, permissions, exposed services, shared responsibility, or service configuration.

Incorrect Answers

Answer B is incorrect because Legacy-system vulnerability addresses a different requirement. Legacy-system vulnerability refers to risk introduced by old technology that must remain in service despite outdated security capabilities.

Answer C is incorrect because Buffer overflow represents a different security function. Buffer overflow refers to writing more data to a memory buffer than it can safely hold, potentially overwriting adjacent memory.

Answer D is incorrect because Sideloading addresses a different security requirement. Sideloading refers to installation of software from a source outside the approved application distribution mechanism.

 

Question 35

To inherit risk from a trusted upstream component or partner, which security approach should be selected?

1. Operating-system vulnerability
2. Sideloading
3. Race condition
4. Supply-chain vulnerability

Correct Answer: D

 

Correct Answer

Answer D is correct because Supply-chain vulnerability means a weakness introduced through software dependencies, service providers, vendors, or hardware components.

Incorrect Answers

Answer A is incorrect because Operating-system vulnerability would fit a different scenario. Operating-system vulnerability refers to a weakness in the operating system kernel, service, driver, or security configuration.

Answer B is incorrect because Sideloading addresses a different security requirement. Sideloading refers to installation of software from a source outside the approved application distribution mechanism.

Answer C is incorrect because Race condition represents a different security function. Race condition refers to a flaw in which security depends on the timing or ordering of concurrent operations.