Question 590
A team enables external sharing by default on a newly purchased document SaaS without identity governance review. Which response best addresses the central security requirement with a defensible, risk-based design?
- Assess maintainership, provenance, vulnerability exposure and replacement options before adoption
- Configure secure defaults, centralized identity lifecycle, audit retention and approved sharing scope
- Turn off all auditing because the vendor logs elsewhere
- Assume vendor network security prevents public link sharing
Explanation
Correct Answer
B:SaaS baseline configuration is a customer responsibility in many service models.
Incorrect Answers
A:Legal permission to use code does not establish ongoing security fitness. Configure secure defaults, centralized identity lifecycle, audit retention and approved sharing scope.
C:Loss of customer evidence harms response.
D:Transport security does not authorize document recipients.
Question 591
A reporting API concatenates user input into SQL statements for a database query. Which response best addresses the central security requirement with a defensible, risk-based design?
- Escape only quote characters in a custom regex
- Use parameterized queries and allowlist any unavoidable dynamic SQL identifiers
- Grant the database account administrator rights
- Bind values using prepared statements and restrict database privileges
Explanation
Correct Answer
B:Bound parameters separate user values from executable SQL syntax.
Incorrect Answers
A:Ad-hoc escaping can be bypassed across encodings and contexts.
C:Broader privileges worsen an exploit.
D:Structured parameterization avoids brittle application-specific quoting rules. Use parameterized queries and allowlist any unavoidable dynamic SQL identifiers.
Question 592
A support portal inserts user-submitted ticket text into HTML with no contextual output encoding. Which response best addresses the central security requirement with a defensible, risk-based design?
- Filter only the literal string script
- Use parameterized queries and allowlist any unavoidable dynamic SQL identifiers
- Disable TLS to make pages simpler
- Apply context-specific output encoding and safe DOM APIs with supplemental CSP
Explanation
Correct Answer
D:Untrusted display data must not become executable browser script.
Incorrect Answers
A:Event handlers and encodings bypass simple patterns.
B:Bound parameters separate user values from executable SQL syntax. Apply context-specific output encoding and safe DOM APIs with supplemental CSP.
C:Transport security does not prevent client-side scripting.
Question 593
A session-authenticated portal accepts a state-changing POST from another website using ambient cookies. Which response best addresses the central security requirement with a defensible, risk-based design?
- Add only a content-security-policy header
- Rely only on the user having logged in previously
- Require CSRF protection using appropriate tokens and SameSite cookie controls with server-side verification
- Use parameterized queries and allowlist any unavoidable dynamic SQL identifiers
Explanation
Correct Answer
C:CSRF abuses the browser's authority to send credentials automatically.
Incorrect Answers
A:CSP is not a general replacement for CSRF verification.
B:Login is what enables ambient cookie misuse.
D:Bound parameters separate user values from executable SQL syntax. Require CSRF protection using appropriate tokens and SameSite cookie controls with server-side verification.
Question 594
A search form escapes strings manually before constructing SQL but supports complex Unicode input. Which response best addresses the central security requirement with a defensible, risk-based design?
- Replace apostrophes with spaces in every input
- Return database admin error details to users
- Bind values using prepared statements and restrict database privileges
- Apply context-specific output encoding and safe DOM APIs with supplemental CSP
Explanation
Correct Answer
C:Structured parameterization avoids brittle application-specific quoting rules.
Incorrect Answers
A:Other syntax and encoding paths remain.
B:Verbose errors assist attacks.
D:Untrusted display data must not become executable browser script. Bind values using prepared statements and restrict database privileges.
Question 595
A JSON API accepts negative quantities and enormous integers that overflow downstream billing calculations. Which response best addresses the central security requirement with a defensible, risk-based design?
- Define schema, ranges and business invariants with server-side enforcement
- Bind values using prepared statements and restrict database privileges
- Accept every number and fix reports later
- Trust only the mobile client to validate quantity
Explanation
Correct Answer
A:Syntactically valid JSON can still violate business rules.
Incorrect Answers
B:Structured parameterization avoids brittle application-specific quoting rules. Define schema, ranges and business invariants with server-side enforcement.
C:Bad transactions may already have executed.
D:An attacker can bypass client validation.
Question 596
A tenant API trusts a tenant ID supplied in a URL without checking the authenticated user's entitlement. Which response best addresses the central security requirement with a defensible, risk-based design?
- Permit access whenever an API key is syntactically valid
- Hide tenant IDs in long random paths only
- Bind values using prepared statements and restrict database privileges
- Enforce object-level authorization on every resource request using server-side identity context
Explanation
Correct Answer
D:Valid login does not imply authorization to other tenants' objects.
Incorrect Answers
A:Authentication alone cannot constrain object ownership.
B:Obscurity is not a substitute for access checks.
C:Structured parameterization avoids brittle application-specific quoting rules. Enforce object-level authorization on every resource request using server-side identity context.
Question 597
An order-processing service launches a shell command by concatenating an uploaded file name into a command string. Which response best addresses the central security requirement with a defensible, risk-based design?
- Remove spaces from filenames and continue shell concatenation
- Avoid shell construction and use structured process APIs with safe argument handling
- Bind values using prepared statements and restrict database privileges
- Run the command as an unrestricted system administrator
Explanation
Correct Answer
B:Command injection arises when untrusted text becomes executable shell syntax.
Incorrect Answers
A:Shell metacharacters can bypass simple filters.
C:Structured parameterization avoids brittle application-specific quoting rules. Avoid shell construction and use structured process APIs with safe argument handling.
D:Higher privilege worsens a compromise.
Question 598
A single-page application writes API response data into innerHTML while claiming all API content is trusted. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use textContent or a safe templating sink and context-aware sanitization for approved rich HTML
- Trust all JSON merely because it came over TLS
- Disable browser updates to avoid changed script behavior
- Use parameterized queries and allowlist any unavoidable dynamic SQL identifiers
Explanation
Correct Answer
A:Client DOM sinks can execute attacker-controlled markup even when delivered by an API.
Incorrect Answers
B:Transport authentication does not establish content safety.
C:Obsolete browsers introduce more risk.
D:Bound parameters separate user values from executable SQL syntax. Use textContent or a safe templating sink and context-aware sanitization for approved rich HTML.
Question 599
A bank introduces a new fund-transfer endpoint but assumes HTTPS alone prevents cross-site request forgery. Which response best addresses the central security requirement with a defensible, risk-based design?
- Rely solely on session cookies
- Implement anti-CSRF request validation and appropriate cookie policy for authenticated state changes
- Define schema, ranges and business invariants with server-side enforcement
- Use certificate renewal as the only mitigation
Explanation
Correct Answer
B:HTTPS encrypts traffic but does not identify whether the user intended a cross-origin POST.
Incorrect Answers
A:Cookies are automatically attached in some cross-site contexts.
C:Syntactically valid JSON can still violate business rules. Implement anti-CSRF request validation and appropriate cookie policy for authenticated state changes.
D:Certificate freshness does not prevent request forgery.
Question 600
After a prior sql parameterization finding, a global logistics firm reports that the approved safeguard is implemented: “Bind values using prepared statements and restrict database privileges.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Replace apostrophes with spaces in every input
- Test representative encodings and special characters without altered query structure
- Run this adjacent but different test as the sole proof: Submit controlled SQL metacharacters and verify data scope remains unchanged
- Accept a signed change ticket saying: Bind values using prepared statements and restrict database privileges
Explanation
Correct Answer
B:Query-structure integrity tests validate parameter binding.
Incorrect Answers
A:Other syntax and encoding paths remain. Test representative encodings and special characters without altered query structure.
C:Injection tests demonstrate value/code separation. It tests injection, while this case requires evidence about sql parameterization.
D:Test representative encodings and special characters without altered query structure. Query-structure integrity tests validate parameter binding.
Certified Information Systems Security Professional (CISSP) Practice Tests