CompTIA Exam CS0-003 Topic 2 Question 14 Discussion

Actual exam question for CompTIA's CS0-003 exam

Question #: 14
Topic #: 2

A security analyst is trying to validate the results of a web application scan with Burp Suite. The security analyst performs the following:

Which of the following vulnerabilitles Is the securlty analyst trylng to valldate?

ASQL injection

BLFI

CXSS

DCSRF

Show Suggested Answer

Suggested Answer: B

The security analyst is validating a Local File Inclusion (LFI) vulnerability, as indicated by the ''/.../.../.../'' in the GET request which is a common indicator of directory traversal attempts associated with LFI. The other options are not relevant for this purpose: SQL injection involves injecting malicious SQL statements into a database query; XSS involves injecting malicious scripts into a web page; CSRF involves tricking a user into performing an unwanted action on a web application.

According to the CompTIA CySA+ Study Guide: Exam CS0-003, 3rd Edition1, one of the objectives for the exam is to ''use appropriate tools and methods to manage, prioritize and respond to attacks and vulnerabilities''. The book also covers the usage and syntax of Burp Suite, a tool used for testing web application security, in chapter 6. Specifically, it explains the meaning and function of each component in Burp Suite, such as Repeater, which allows the security analyst to modify and resend individual requests1, page 239. Therefore, this is a reliable source to verify the answer to the question.

by Claribel at Mar 09, 2024, 06:45 PM

Limited Time Offer

25%

Off

Get Premium CS0-003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Noe

4 days ago

Haha, good point. These certification exams are always trying to catch you off guard. I bet the question writer is sitting back, rubbing their hands together and thinking 'Let's see if they fall for the ol' SQL injection trap!'

upvoted 0 times

...

Kiley

5 days ago

You guys are right, but I think it's worth noting that the exam question might be trying to trick us. SQL injection is the obvious answer, but what if they're looking for something a little more subtle, like XSS or CSRF? I'm going to think this through a bit more carefully.

upvoted 0 times

...

Maryln

6 days ago

Yea, I agree. The image shows a SQL query being injected into the web application, so SQL injection is the most likely vulnerability the analyst is trying to validate. It's a classic web application attack vector.

upvoted 0 times

...

Bo

7 days ago

Hmm, this question seems pretty straightforward. The security analyst is clearly using Burp Suite to validate the results of a web application scan, and the image shows a SQL injection attack. So, I'd say the answer is A) SQL injection.

upvoted 0 times

...