You save $69.98
A payment API concatenates a customer-supplied account number into a SQL query. A crafted value changes the WHERE clause and returns another customer’s transaction history. What engineering fix is BEST?
Binding values keeps untrusted input out of SQL grammar. It does not itself prevent a valid but unauthorized account ID, so resource authorization remains essential.
Manual escaping is dialect-sensitive and brittle; parameters are the primary defense against values becoming executable syntax.
An attacker can call the API directly, so client-side visibility does not prevent SQL injection or cross-account reads.
Excessive database privileges amplify harm and do not prevent injected syntax.
A team converts dynamic SQL data values to bound parameters. What additional requirement remains to prevent one authenticated user from retrieving another user’s account?
A safely bound account ID can still identify someone else’s record. Authentication and database syntax safety must be complemented by ownership and entitlement checks.
A validly formatted value can still refer to another customer; parameterization does not grant ownership.
Suppressing error details reduces information leakage but leaves direct unauthorized data access intact.
Transport encryption does not decide which business records a requester may access.
An API is changed to use parameterized SQL plus account ownership checks. What test suite BEST demonstrates the two controls?
The two negative tests distinguish SQL grammar isolation from object authorization. A normal owner read should still pass as a positive control.
Happy-path function alone does not test either injection resistance or object-level access control.
Successful injected syntax is evidence the original query construction vulnerability remains.
A client control can be bypassed and does not establish safe server query construction.
A support dashboard inserts customer-supplied ticket text into innerHTML, and users see scripted pop-ups. Which fix is MOST direct?
XSS results from treating attacker-controlled content as active browser code.
SQL escaping does not provide HTML/DOM context safety at output.
A warning cannot prevent browser execution of unsafe markup.
Logging changes do not remove the injection source-to-sink vulnerability.
The dashboard now uses safe text insertion. What related issue may still need separate controls?
Escaping must match each output context; one safe sink does not validate every rendering path.
CSP is defense in depth and cannot replace correct handling of untrusted content.
Output context changes can reintroduce executable interpretation.
Transport encryption does not control how browsers interpret stored content.
Which security test BEST shows the ticket renderer resists XSS?
The test observes rendered browser behavior in relevant contexts rather than only input acceptance.
Storage content does not establish whether output executes in another browser.
TLS protects the channel, not DOM interpretation of untrusted markup.
A header alone can be misconfigured and cannot prove safe output handling.
An image proxy accepts arbitrary user-provided URLs and fetches them server-side. Attackers use it to access cloud instance metadata and internal admin endpoints. What design BEST prevents SSRF?
SSRF crosses a network trust boundary via a trusted server fetch. Defense in depth requires controlling both URL parsing/destination selection and the actual outbound network path.
Hostname-only rules are bypassable through address encodings, DNS resolution and redirect chains.
Caller authentication does not authorize arbitrary network requests from the server to internal services.
Redirects and DNS rebinding can change the final target; TLS does not grant permission to retrieve private management URLs.
A proxy checks the submitted hostname against an allowlist before issuing an HTTP fetch. What remaining SSRF bypass must be addressed?
A hostname check at input time is not sufficient if the resolved destination can change. Validate each connection target and restrict egress at the network boundary.
HTTPS encrypts a connection; it does not make the destination authorized or prevent malicious private-address targeting.
An allowed host can redirect to a prohibited internal host or address unless each hop is checked.
An attacker may bypass DNS-name filtering by supplying direct IP literals in private/loopback ranges.
An image proxy team claims it has closed server-side request forgery paths. What security test BEST demonstrates the fix?
This tests bypass classes plus valid functionality, confirming the final network destination cannot cross the protected boundary.
A happy-path download does not prove SSRF restrictions on adversarial destinations.
This result directly demonstrates an unsafe redirect SSRF bypass remains.
Literal-only string filtering is incomplete and fails the intended destination policy.
A job worker deserializes objects received from untrusted users using a library that may instantiate arbitrary application classes during parsing. Which design best mitigates code-execution risk?
Dynamic object deserialization can run gadget chains while materializing attacker-controlled data. Data-only parsing with allowlisted schemas and resource limits reduces this dangerous interpretation.
Hiding errors does not prevent malicious constructors or gadget chains from executing.
Transport encryption does not change the risk of processing malicious payloads after delivery.
More resources do not stop unintended code execution and may worsen denial-of-service exposure.
A service switches from unsafe object deserialization to JSON with an explicit schema. What residual parser risk still needs a control?
Data-only formats prevent arbitrary object construction but remain susceptible to resource exhaustion if parser work is unbounded.
Deeply nested or huge inputs may consume excessive parser time/memory even without executable objects.
Removing validation on high-cost inputs defeats a principal safety constraint.
A schema specifies structure; business authorization must still validate requested operations and sensitive fields.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
