Exam CAS-004 topic 1 question 214 discussion

Actual exam question from CompTIA's CAS-004

Question #: 214
Topic #: 1

A security analyst is performing a review of a web application. During testing as a standard user, the following error log appears:

Which of the following BEST describes the analyst's findings and a potential mitigation technique?

A. The findings indicate unsecure references. All potential user input needs to be properly sanitized.
B. The findings indicate unsecure protocols All cookies should be marked as HttpOnly.
C. The findings indicate information disclosure. The displayed error message should be modified.
D. The findings indicate a SQL injection. The database needs to be upgraded.

Show Suggested Answer

Suggested Answer: C 🗳️

by OneSaint at Feb. 17, 2023, 2:24 p.m.

Comments

Submit Cancel

javier051977

10 months ago

Selected Answer: C

The error message provides potentially sensitive information about the database server and table that the web application is using. An attacker could use this information to launch targeted attacks against the web application or the database server. To mitigate this issue, the error message should be modified to provide a more generic message that does not disclose any specific information about the application's database or infrastructure. Additionally, any error logs generated by the web application should be reviewed regularly to identify potential security issues and address them promptly.

upvoted 4 times

...

last_resort

10 months, 1 week ago

C...error messages should not give out specific information

upvoted 2 times

...

smqzbq

11 months ago

Selected Answer: C

Nothing indicates sql injection and the log message disclouses internal details of a system to a "standard" user. This is also in current OWASP TOP 10.

upvoted 2 times

...