WorksheetsCompTIA Security+ SY0-701 Practice Test 8 By Mr. B
Total questions: 25
Worksheet time: 25mins
Which of the answers listed below refers to a security vulnerability that enables inserting malicious code into input fields, such as search bars or login forms, to execute unauthorized commands on a database?
RCE
SQLi
XSS
CSRF
Which of the following indicates an SQL injection attack attempt?
DELETE FROM itemDB WHERE itemID = '1';
SELECT * FROM users WHERE userName = 'Alice' AND password = '' OR '1' = '1';
DROP TABLE itemDB;
SELECT * FROM users WHERE email = 'example@example.com' AND password = '';
Which of the answers listed below describe the characteristics of a cross-site scripting attack? (Select 3 answers)
Exploits the trust a user's web browser has in a website
A malicious script is injected into a trusted website
User's browser executes attacker's script
Exploits the trust a website has in the user's web browser
A user is tricked by an attacker into submitting unauthorized web requests
Which of the following answers refers to a type of software embedded into a hardware chip?
Firmware
Middleware
Device driver
Machine code
Which of the terms listed below refers to a situation in which a product or service may no longer receive security patches or other updates, making it more vulnerable to attack?
EOL
ALM
EOS
SDLC
What is the main vulnerability related to legacy hardware?
Compatibility issues
Lack of security updates and patches
Worn-out physical components
Lack of skilled personnel to run it and maintain it
Which of the following answers refers to a virtualization-related vulnerability where virtualized assets allocated to one VM are improperly isolated and can be accessed or compromised by another VM?
Resource reuse
Privilege escalation
Resource exhaustion
Concurrent session usage
Which of the following terms is used to describe the process of removing software restrictions imposed by Apple on its iOS operating system?
Sideloading
Carrier unlocking
Rooting
Jailbreaking
A type of attack aimed at exploiting vulnerability that is present in already released software but unknown to the software developer is known as:
On-path attack
IV attack
Zero-day attack
Replay attack
Which type of Trojan enables unauthorized remote access to a compromised system?
APT
RAT
MaaS
PUP
A standalone malicious computer program that typically propagates itself over a computer network to adversely affect system resources and network bandwidth is referred to as:
Worm
Fileless virus
Bot
Logic bomb
Which of the answers listed below refer to the characteristic features of bloatware? (Select 3 answers)
Pre-installed on a device by the device manufacturer or retailer
Generally considered undesirable due to negative impact on system performance
Installed without user consent
Can be pre-installed, downloaded, or bundled with other software
Generally considered undesirable due to negative impact on system performance, privacy, and security
Malicious code activated by a specific event is called:
Cryptomalware
Backdoor
Rootkit
Logic bomb
Which of the following answers refers to a collection of software tools used by a hacker to mask intrusion and obtain administrator-level access to a computer or computer network?
Rootkit
Spyware
Backdoor
Trojan
The term "RFID cloning" refers to copying the data stored on any RFID-enabled device (including tags, cards, key fobs, implants, and other objects embedded with RFID technology) onto another RFID-enabled device, which then can be read and used in the same way as the original tag. While RFID cloning can be utilized for legitimate purposes, such as replicating important tags for backup and testing purposes, it also poses significant security risk, as duplicate tags can potentially be used for gaining unauthorized access or unauthorized information disclosure.
True
False
What is Blind SQL Injection?
A method where the attacker can see the data directly
A type of injection where results are inferred from responses
A technique that reveals the entire database
A fully secure database practice
What would be the result of the SQL query if the password input is '' or '1'='1'?
Returns only the matching user rows
Returns the whole table
Returns an error
Returns no rows
A cybersecurity analyst is reviewing the logs of a proxy server and saw the following URLs:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
https://test.diontraining.com/profi le.php?userid=1546
https://test.diontraining.com/profi le.php?userid=5482
https://test.diontraining.com/profi le.php?userid=3618
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
What type of vulnerability does this website have?
Improper error handling
Insecure direct object reference
Race condition
Weak or default configurations
The (a) is the software that controls the communication between the (b) and the physical host.
hypervisor
VM (virtual machine)
Operating System
Wifi
networks
Vending machines
Which malware focuses on tracking user activities and collecting personal information?
Grayware
Keylogger
Rootkit
Ransomware
https is port?
80
443
22
20
Which of the following is more secure and checks the submitted data to ensure its validity?
Browser-side validation
Server-side validation
Client-side validation
Database-side validation
What vulnerability is exploited in a Cross-Site Scripting attack?
Unexpected Action
Memory Leak
Buffer Overflow
Race Condition
A cybersecurity analyst is reviewing the logs of a proxy server and saw the following URLs:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
https://test.diontraining.com/profi le.php?userid=1546
https://test.diontraining.com/profi le.php?userid=5482
https://test.diontraining.com/profi le.php?userid=3618
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
What type of vulnerability does this website have?
Improper error handling
Insecure direct object reference
Race condition
Weak or default configurations
When a business creates virtual machines and forgets or ignores them.
It's briefly describes as: (a)
VM sprawl
Virtual Monitors
non-virtualized environments
managed VM
