CompTIA Security+ SY0-701 Practice Test 8 By Mr. B

Which of the answers listed below refers to a security vulnerability that enables inserting malicious code into input fields, such as search bars or login forms, to execute unauthorized commands on a database?

• RCE

• SQLi

• XSS

• CSRF

Answer explanation

SQLi, or SQL Injection, is a security vulnerability that allows attackers to insert malicious SQL code into input fields, enabling them to execute unauthorized commands on a database. This makes SQLi the correct answer.

Which of the following indicates an SQL injection attack attempt?

• DELETE FROM itemDB WHERE itemID = '1';

• SELECT * FROM users WHERE userName = 'Alice' AND password = '' OR '1' = '1';

• DROP TABLE itemDB;

• SELECT * FROM users WHERE email = '[e-mail]' AND password = '';

Answer explanation

The correct choice indicates an SQL injection attempt by using 'OR '1' = '1'', which can bypass authentication. This technique exploits vulnerabilities in SQL queries to manipulate database access.

Which of the answers listed below describe the characteristics of a cross-site scripting attack? (Select 3 answers)

• Exploits the trust a user's web browser has in a website

• A malicious script is injected into a trusted website

• User's browser executes attacker's script

• Exploits the trust a website has in the user's web browser

• A user is tricked by an attacker into submitting unauthorized web requests

Answer explanation

Cross-site scripting (XSS) attacks exploit the trust a user's browser has in a website by injecting a malicious script into a trusted site, which the browser then executes, allowing attackers to manipulate user data.

Which of the following answers refers to a type of software embedded into a hardware chip?

• Firmware

• Middleware

• Device driver

• Machine code

Answer explanation

Firmware is a type of software specifically designed to be embedded into hardware chips, providing low-level control for the device. Unlike middleware or device drivers, firmware operates closely with the hardware.

Which of the terms listed below refers to a situation in which a product or service may no longer receive security patches or other updates, making it more vulnerable to attack?

• EOL

• ALM

• EOS

• SDLC

Answer explanation

EOL stands for 'End of Life', indicating that a product or service will no longer receive updates or security patches, increasing its vulnerability to attacks. This makes EOL the correct choice for the question.

What is the main vulnerability related to legacy hardware?

• Compatibility issues

• Lack of security updates and patches

• Worn-out physical components

• Lack of skilled personnel to run it and maintain it

Answer explanation

The main vulnerability of legacy hardware is the lack of security updates and patches, making it susceptible to cyber threats. Without regular updates, these systems cannot defend against new vulnerabilities.

Which of the following answers refers to a virtualization-related vulnerability where virtualized assets allocated to one VM are improperly isolated and can be accessed or compromised by another VM?

• Resource reuse

• Privilege escalation

• Resource exhaustion

• Concurrent session usage

Answer explanation

Resource reuse refers to a vulnerability in virtualization where resources allocated to one VM can be accessed by another VM due to improper isolation, leading to potential data breaches or compromises.

Which of the following terms is used to describe the process of removing software restrictions imposed by Apple on its iOS operating system?

• Sideloading

• Carrier unlocking

• Rooting

• Jailbreaking

Answer explanation

Jailbreaking is the term used to describe the process of removing software restrictions on iOS, allowing users to install unauthorized apps and customize their devices beyond Apple's limitations.

A type of attack aimed at exploiting vulnerability that is present in already released software but unknown to the software developer is known as:

• On-path attack

• IV attack

• Zero-day attack

• Replay attack

Answer explanation

A zero-day attack targets vulnerabilities in software that are unknown to the developers. Since the developers have not yet released a fix, these attacks can be particularly damaging, making 'zero-day attack' the correct choice.

Which type of Trojan enables unauthorized remote access to a compromised system?

• APT

• RAT

• MaaS

• PUP

Answer explanation

A RAT (Remote Access Trojan) allows unauthorized remote access to a compromised system, enabling attackers to control it from afar. APT (Advanced Persistent Threat) refers to a broader strategy, while MaaS (Malware as a Service) and PUP (Potentially Unwanted Program) do not specifically provide remote access.