Practice Test #1

Client-side processing is not a reliable security control because the attacker controls the browser and can modify requests (e.g., via proxy tools). Even if JavaScript validates ItemID, an attacker can send a malicious ItemID directly to the server. Server-side protections are required for injection flaws, so this does not address the root cause.

Data normalization improves database structure and reduces redundancy (e.g., splitting data into related tables). While important for integrity and performance, it does not prevent an attacker from injecting SQL through concatenated queries. Normalization addresses schema design, not secure query construction or input handling.

Escape character blocking (or escaping) is a weak and error-prone approach. Attackers can bypass filters using alternate encodings, DB-specific syntax, comment styles, or unexpected character sets. Escaping may be part of defense-in-depth in some contexts, but it is not the preferred control compared to parameterized queries.

URL encoding only changes how characters are represented in transit (e.g., spaces to %20). It does not neutralize SQL metacharacters once decoded by the server framework, and it is not intended as an injection defense. Attackers can still deliver payloads that decode into malicious SQL fragments.

Changing kubernetes.core.k8s to kubernetes.core.k8s_service is not a security fix. The generic k8s module is valid for managing Kubernetes objects from YAML definitions, including Service resources, so the issue is not the module name itself. This change would be a functional refactor at most and would not address insecure exposure, authentication, or control-plane hardening. Security questions should focus on reducing attack surface, not swapping equivalent automation modules.

Changing the hostname from COMPTIA001 to localhost would be operationally incorrect and would not remediate the security issue. Kubernetes nodes and automation systems rely on stable, unique host identity for certificates, networking, and management. Replacing a real hostname with localhost can break resolution and create ambiguity rather than improve security. The problem is not the hostname value but the insecure configuration choices around orchestration access.

Changing state: present to state: absent would simply remove the Kubernetes object instead of fixing the security weakness. Deleting a Service definition is not a targeted remediation for insecure control-plane or automation configuration. Security hardening should address how access is exposed and controlled, not arbitrarily remove resources that may be required for operations. This option confuses resource lifecycle management with actual security remediation.

Changing insecure-bind-address from localhost to COMPTIA001 would make an insecure endpoint more accessible from the network, which is the opposite of hardening. For any setting labeled insecure, best practice is to disable it entirely or keep it tightly restricted, not expose it to a broader interface. Binding to localhost limits exposure to the local machine, whereas binding to the host identity can allow remote access depending on name resolution and interface mapping. This option increases attack surface and is therefore not a valid security correction.

Incorrect. The CRM company’s customer can mandate requirements contractually and may audit or request evidence, but it does not operate the CRM company’s infrastructure or platform. The customer’s role is to define expectations and verify via governance mechanisms (e.g., due diligence, audits), not to implement configuration management, patching, or lifecycle management within the vendor’s environment.

Incorrect. In PaaS, the CSP is responsible for many underlying components (physical security, hypervisor, core platform services, and often platform patching). However, the CRM company remains accountable to its customer for compliance. The CSP may help satisfy requirements via certifications and SLAs, but it is not the party responsible for ensuring the CRM customer’s regulatory obligations are met overall.

Incorrect. Regulatory bodies define requirements, publish standards, and may enforce compliance through audits, penalties, or licensing actions. They do not manage a specific company’s configurations, patching schedules, or lifecycle processes. The regulated entity (here, the CRM company providing the SaaS) must implement and demonstrate compliance, including managing third-party providers like the CSP.

Incorrect for the stated issue. Increasing length to 12 generally improves entropy and resistance to brute force, but it does not prevent an employee from reusing a password that is already known to attackers. A longer password can still be compromised if it appears in breach corpuses; reuse controls are the primary need here.

Incorrect for the stated issue. Adding case sensitivity (requiring upper/lower) increases complexity and may marginally improve guessing resistance, but it does not stop reuse of a previously compromised password. Attackers commonly try case variants, and users often make predictable capitalization changes; this does not address reuse directly.

Incorrect. Reducing maximum age to 30 days forces more frequent changes. Modern guidance warns frequent forced changes can lead to weaker, more predictable passwords and reuse patterns (e.g., incrementing numbers). It still doesn’t prevent selecting a password from a compromised list, and it doesn’t stop history bypass if minimum age remains 0.

Incorrect and harmful. Removing complexity requirements would likely reduce password strength and increase risk. It also does nothing to prevent reuse of compromised passwords. Even though modern standards emphasize screening against compromised lists over arbitrary complexity rules, removing complexity without adding screening is a net negative.

Incorrect. Increasing maximum age to 120 days reduces how often passwords change, which can be beneficial for usability, but it does not address reuse of compromised passwords. If users are already reusing known-compromised passwords, extending the change interval could prolong exposure rather than mitigate it.

Incorrect. Automatic updates improve patch compliance, but the scenario already involves monthly patching and the issue is a newly migrated application with a reported overflow and improper exposure. Auto-updates do not directly address the immediate requirement to restrict access to internal users, nor do they guarantee a fix for an application-level overflow without a vendor/app patch.

Incorrect. Enabling external traffic contradicts the security policy requiring internal-only access and increases risk because the application is already publicly exposed. In cloud environments, opening security groups to the internet (0.0.0.0/0) is a common misconfiguration that expands the attack surface and makes exploitation of vulnerabilities like buffer overflows more likely.

Incorrect. DLP focuses on detecting/preventing sensitive data exfiltration (e.g., PII, PCI) after access to data paths exists. It does not mitigate the root issue of a buffer overflow vulnerability or the misconfiguration of public exposure. DLP can be valuable as a detective/compensating control, but it is not the best answer for immediate mitigation here.

Incorrect. Nightly vulnerability scans are a detective control that can help identify exposures and missing patches, but they do not prevent exploitation of a known buffer overflow or enforce internal-only access. Scanning is useful for ongoing assurance and compliance, yet the question asks what to implement to mitigate the reported issues, which requires preventive controls.

Digital rights management (DRM) enforces usage controls (view, print, copy, forward) and can apply encryption tied to identities. While DRM can be triggered after a document is classified, it does not help the DLP system discover or correctly label unlabeled documents containing cardholder data. DRM is a protection/enforcement mechanism, not a primary content detection method for PCI patterns.

Network traffic decryption enables inspection of encrypted traffic (TLS interception) so DLP can analyze data in transit. However, the scenario focuses on documents in a cloud document repository (data at rest) and the need to label them correctly in the future. Decrypting network traffic may help with uploads/downloads, but it does not provide the core content-identification logic needed to detect cardholder data within documents.

Watermarking adds visible or invisible markings (e.g., “Confidential”, user ID, timestamp) to deter leakage and support attribution. It is typically an output control applied after a document is already classified or labeled. Watermarking does not help the DLP system detect cardholder information inside unlabeled documents, so it won’t solve the root problem of correctly labeling documents based on their content.

Salted hashing strengthens password storage by preventing rainbow-table attacks and ensuring identical passwords hash differently. However, the vulnerability here is not weak hashing; it is that the code unconditionally jumps to the allow path before checking credentials. Even with salted hashing, the bypass remains because the verification step is skipped.

Input validation on USERID and PASS can prevent malformed input, injection, and unexpected parsing behavior. But the shown flaw is a direct logic/control-flow error: `JUMP TO :ALLOWUSER;` executes before validation. Validating inputs does not stop the unconditional jump from granting access.

TOCTOU remediation applies when a resource is checked and later used, and an attacker can change it between the check and the use. Here, the issue is not a race between checking and setting ACLs; it is that ACLs are set without any successful authentication due to the unconditional jump.

Encrypting the database connection (e.g., TLS) protects credentials and queries in transit and reduces eavesdropping/MITM risk. It does not fix the application logic that grants access without verifying credentials. The authentication bypass would still occur even with perfectly encrypted DB communications.

EAP-TLS is an 802.1X authentication method for network access (commonly enterprise Wi-Fi) using client certificates for strong mutual authentication. While it improves secure access to a Wi-Fi network, it does not encrypt or hide browsing destinations from upstream monitoring once connected. It addresses authentication and access control, not privacy of DNS queries or web browsing metadata.

Geofencing restricts or triggers actions based on geographic location (e.g., blocking logins from certain countries, limiting app functionality abroad). It is a policy control to reduce risk exposure, not a mechanism to protect browsing history from being monitored. In fact, geofencing could prevent access entirely rather than provide privacy while traveling.

Private browsing mode (incognito) primarily prevents the browser from saving local history, cookies, and cached data on the device after the session ends. It does not prevent network observers, ISPs, or government monitoring from seeing DNS queries, destination IPs, or traffic patterns. It is a local privacy feature, not a network privacy or anti-surveillance control.

Segmentation reduces the attack surface by limiting which networks can reach the vulnerable server and helps contain lateral movement if compromise occurs. However, if the web server must remain accessible to clients (often the case), segmentation alone does not prevent exploitation attempts from allowed paths. It is a strong compensating control for containment, but not the best single control to prevent successful RCE exploitation on the host.

A CASB (Cloud Access Security Broker) governs access to cloud services (SaaS) and enforces policies like DLP, tokenization, and conditional access for cloud apps. It does not provide host-level exploit prevention for a legacy on-prem web server OS vulnerability. CASB would be relevant if the risk involved unsanctioned cloud usage or protecting data in SaaS, not blocking RCE on a server.

UEBA (User and Entity Behavior Analytics) focuses on detecting anomalous behavior by users, hosts, or services using baselines and analytics. It is primarily a detective control that improves alerting and investigation, not a preventive control that blocks exploitation. UEBA might help identify that the server is behaving abnormally after compromise, but it typically will not prevent the initial RCE from succeeding.