ExamTopics Logo
Mail Us[email protected]
Menu
Comptia Discussions
exam questions

Exam CAS-004 All Questions

View all questions & answers for the CAS-004 exam
Go to Exam

Exam CAS-004 topic 1 question 445 discussion

Actual exam question from CompTIA's CAS-004
Question #: 445
Topic #: 1
[All CAS-004 Questions]

A security researcher identified the following messages while testing a web application:

/file/admin/myprofile.php ERROR file does not exist.
/file/admin/userinfo.php ERROR file does not exist.
/file/admin/adminprofile.php ERROR file does not exist.
/file/admin/admininfo.php ERROR file does not exist.
/file/admin/universalprofile.php ERROR file does not exist.
/file/admin/universalinfo.php ERROR file does not exist.
/file/admin/restrictedprofile.php ACCESS is denied.
/file/admin/restrictedinfo.php ERROR file does not exist.

Which of the following should the researcher recommend to remediate the issue?

  • A. Software composition analysis
  • B. Packet inspection
  • C. Proper error handling
  • D. Elimination of the use of unsafe functions
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️
by 23169fd at July 18, 2024, 6:34 p.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
Steel16
1 week, 1 day ago
Selected Answer: C
o The error messages are revealing too much information about the internal structure of the web application, which can be exploited by attackers. Implementing proper error handling will ensure that error messages do not disclose sensitive information and provide only generic messages to the users, thereby enhancing the security of the application.
upvoted 1 times
...
23169fd
8 months ago
Selected Answer: C
The messages provide information about the existence and access permissions of certain files, which can be useful to an attacker. Proper error handling involves: Ensuring that error messages do not reveal sensitive information about the server or its structure. Customizing error messages to be generic and user-friendly without disclosing specifics about the error (e.g., "An error occurred" instead of "ERROR file does not exist" or "ACCESS is denied"). Logging detailed error information on the server-side for debugging purposes without exposing it to the end user.
upvoted 2 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago