Exam CAS-004 topic 1 question 435 discussion

Actual exam question from CompTIA's CAS-004

Question #: 435
Topic #: 1

A security architect examines a section of code and discovers the following:

char username[20]
char password[20]
gets(username)
checkUserExists(username)

Which of the following changes should the security architect require before approving the code for release?

A. Allow only alphanumeric characters for the username.
B. Make the password variable longer to support more secure passwords.
C. Prevent more than 20 characters from being entered.
D. Add a password parameter to the checkUserExists function.

Show Suggested Answer

Suggested Answer: C 🗳️

by isaphiltrick at July 6, 2024, 4:23 p.m.

Comments

Submit Cancel

Orean

9 months, 2 weeks ago

Selected Answer: C

gets() does not check the maximum amount of characters entered. An fgets(username, sizeof(username), stdin) statement would accomplish this.

upvoted 1 times

...

ChopSNap

12 months ago

Selected Answer: C

The best change the security architect should require before approving the code for release is C. Prevent more than 20 characters from being entered. his is essential because gets() does not perform bounds checking, leading to a buffer overflow risk. It’s crucial to ensure that input does not exceed the allocated buffer size.

upvoted 1 times

...

isaphiltrick

1 year ago

Selected Answer: C

The code snippet provided is vulnerable to a buffer overflow attack due to the use of the gets function, which does not limit the input size. This can lead to memory corruption and potential security vulnerabilities. By ensuring that no more than 20 characters are entered, the code can prevent buffer overflow attacks, thus mitigating a significant security risk.

upvoted 3 times

...