CompTIA Security+ Certification Exam SY0-701 Practice Test 8

Which of the following refers to a security vulnerability that allows insertion of malicious code into input fields?

• RCE

• SQLi

• XSS

• CSRF

Answer explanation

SQLi, or SQL Injection, is a security vulnerability that allows attackers to insert malicious SQL code into input fields, potentially compromising the database. This makes it the correct choice for the question.

Which of the following indicates an SQL injection attack attempt?

• DELETE FROM itemDB WHERE itemID = '1';

• SELECT * FROM users WHERE userName = 'Alice' AND password = '' OR '1' = '1';

• DROP TABLE itemDB;

• SELECT * FROM users WHERE email = '[e-mail]' AND password = '';

Answer explanation

The correct choice indicates an SQL injection attempt by using 'OR '1' = '1'', which can bypass authentication. This technique exploits vulnerabilities in SQL queries to manipulate database access.

What are characteristics of a cross-site scripting (XSS) attack? (Select 3)

• Exploits trust a user's browser has in a website

• Malicious script is injected into a trusted website

• User's browser executes attacker's script

• Website executes attacker's request

• Exploits trust a website has in the user

Answer explanation

XSS attacks exploit the trust a user's browser has in a website by injecting malicious scripts into trusted sites. The user's browser then executes these scripts, allowing attackers to manipulate user data or sessions.

Which of the following refers to software embedded in a hardware chip?

• Firmware

• Middleware

• Device driver

• Machine code

Answer explanation

Firmware refers to the specialized software that is embedded directly into hardware chips, enabling them to perform specific functions. It is distinct from middleware, device drivers, and machine code, which serve different purposes.

Which term refers to a product's lifecycle phase when it's no longer sold or maintained?

• EOS

• EOF

• EOL

• EOA

Answer explanation

EOL stands for 'End of Life', which refers to the phase in a product's lifecycle when it is no longer sold or maintained. This distinguishes it from EOS (End of Sale) and EOF (End of Functionality), which have different meanings.

What is the primary vulnerability of legacy hardware?

• Compatibility issues

• Lack of security updates and patches

• Worn-out components

• Shortage of skilled personnel

Answer explanation

The primary vulnerability of legacy hardware is the lack of security updates and patches, which leaves it exposed to new threats and exploits, making it less secure compared to modern systems.

"VM escape" refers to a technique where a guest OS breaks out and accesses the host machine.

• True

• False

Answer explanation

True. 'VM escape' is a security vulnerability where a guest operating system can break out of its virtual environment and gain access to the host machine, potentially compromising the host's security.

Which describes a virtualization vulnerability where one VM accesses another VM's resources?

• Resource reuse

• Privilege escalation

• Resource exhaustion

• Concurrent session usage

Answer explanation

Resource reuse describes a virtualization vulnerability where one VM can access another VM's resources, potentially leading to unauthorized data access or manipulation. This highlights the risks of inadequate isolation between VMs.

Which of the following is a cloud-related vulnerability?

• Insecure APIs

• Poor access controls

• Misconfigured cloud storage

• Shadow IT

• All of the above

Answer explanation

All listed options—Insecure APIs, Poor access controls, Misconfigured cloud storage, and Shadow IT—are recognized cloud-related vulnerabilities, making 'All of the above' the correct choice.

Installing apps from outside official app stores is called:

• Jailbreaking

• Rooting

• Sideloading

• Carrier unlocking

Answer explanation

Sideloading refers to installing apps from sources outside official app stores, allowing users to bypass restrictions. Jailbreaking and rooting involve modifying the device's operating system, while carrier unlocking pertains to network restrictions.