CompTIA Security Plus Mock Test Q745

One of the most consistently reported software security vulnerabilities that leads to major exploits is:

A. Lack of malware detection.
B. Attack surface decrease.
C. Inadequate network hardening.
D. Poor input validation.

Correct Answer: D
Section: Application, Data and Host Security

D: With coding there are standards that should be observed. Of these standards the most fundamental is input validation. Attacks such as SQL injection depend on unfiltered input
being sent through a web application. This makes for a software vulnerability that can be exploited. There are two primary ways to do input validation: client-side validation and serverside
validation. Thus with poor input validation you increase your risk with regard to exposure to major software exploits.

Incorrect Answers:
A: Malware detection refers to antivirus software which purpose is to identify, prevent and eliminate viruses. This is not software vulnerability.
B: The attack surface of an application is the area of that application that is available to users—those who are authenticated and, more importantly, those who are not. As such, it can
include the services, protocols, interfaces, and code. The smaller the attack surface, the less visible the application is to attack.
C: Network hardening refers to the process of making sure that your network is as secure as it can be. This is not a software vulnerability that may lead to major exploits.

Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, 6th Edition, Sybex, Indianapolis, 2014, pp. 219, 345.