A security specialist is reviewing code and application layer security controls for a publ… — CompTIA Security+

A security specialist is reviewing code and application layer security controls for a public web portal. Which of the following vulnerabilities occur directly due to insufficient input validation and sanitization of user-supplied data? (Select TWO).

SQL InjectionCevap
Cross-Site ScriptingCevap
C
Hardware Hypervisor Escape
D
Insecure Password Complexity Requirements

Cevap

The correct options are SQL Injection and Cross-Site Scripting.

SQL Injection and Cross-Site Scripting (XSS) are classic application vulnerabilities caused when input parameters are accepted and processed without adequate sanitization, escaping, or parameterized filtering.

Adım Adım Çözüm

Analyze input-dependent software vulnerabilities

SQL Injection and Cross-Site Scripting both stem from failure to validate, escape, or parameterize user-supplied inputs.

Web application vulnerabilities at the code level frequently involve untrusted data being passed straight to database engines or web browsers.

Differentiate software flaws from policy and hardware virtualization issues

Hypervisor escapes deal with virtualization boundaries, while password complexity rules relate to authentication policies.

Input validation mitigates flaws where untrusted input changes command execution context, which applies specifically to SQLi and XSS.

Anahtar Kavram

Application Input Validation Flaws

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru