CS0-004: CompTIA Cybersecurity Analyst (CySA+)Demo

By CompTIA · Question Mode

QuestionQ41

Vulnerability Management

A security team is reviewing a penetration testing report for a web application. The report identifies multiple cross-site scripting (XSS) and Structured Query Language injection (SQLi) vulnerabilities.

Which of the following is most likely causing these vulnerabilities to occur?

  • A Misconfigured web application firewall (WAF)
  • B Lack of secure input validation
  • C Lack of a Hypertext Transfer Protocol (HTTP) Strict Transport Security (HSTS) header
  • D Lack of endpoint protection in the environment
Explanation

Cross-site scripting and SQL injection are both classes of injection attacks that arise when an application accepts user-supplied input and processes it without properly validating, sanitizing, or encoding it before rendering it in a web page (leading to XSS) or embedding it in a database query (leading to SQLi). Secure coding practices such as input validation, output encoding, and parameterized queries/prepared statements are the primary defenses against these vulnerability classes. A misconfigured WAF, missing HSTS header, or lack of endpoint protection do not directly cause injection flaws in application code; they relate to network-layer filtering, transport security enforcement, and host-based malware protection, respectively.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!