Exam CAS-004 topic 1 question 354 discussion

Just going with Gemini's reasoning...The Vulnerability: The web application appears to be vulnerable to unauthorized access of files through the get-files.jsp script.

This is a typical CompTia question where there are multiple right answers. WAFs oftentimes have input validation built-in. This would solve the problem and defend against a lot more web-based attacks.

input validation would mitigate the vulnerability by making sure the information is not able to get exfiltrated. To protect against this, a WAF would be the next best choice.

A. Input validation. Input validation is the process of checking user input to ensure that it is valid and safe. In this case, the security engineer should recommend that the web application validate the file parameter to ensure that it is a valid "file" path. This will prevent attackers from being able to exfiltrate arbitrary files from the web server.

A. Input validation would be the BEST mitigation technique to recommend. Input validation would ensure that users can only access files they are permitted to access, directly addressing the root cause of the vulnerability

A. input validation