CA1-005: CompTIA SecurityXDemo

By CompTIA · Question Mode

QuestionQ36

Security Engineering

A security engineer is reviewing the following code in an internally developed web application that enables employees to manipulate documents from several internal servers. Users can identify the document to parse by supplying its URL to the application as a parameter. The application then runs the following Python call:

response = requests.get(url)

Before deployment, the engineer wants to improve the application's security. Which of the following is the best control to implement?

  • A Indexing
  • B Output encoding
  • C A code scanner
  • D A WAF
Explanation

Passing an untrusted URL directly to a server-side HTTP client can enable SSRF, allowing an attacker to induce requests to unintended internal resources. A WAF can provide a compensating, perimeter-layer control by inspecting and blocking malicious request parameters before they reach the application. Robust SSRF prevention should also enforce a positive allowlist of permitted URL schemes, ports, and destinations.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!