Topic 07 Practice Test 2 covers Vulnerability Types for CompTIA Security+ SY0-701 and maps to objective 2.3: Explain various types of vulnerabilities. For broader exam preparation, review the CompTIA Security+ Exam Dumps. Every option includes focused editorial reasoning explaining both the concept and its fit to the scenario.
Question 1
To change the resource after validation but before the protected operation, which security approach should be selected?
- TOCTOU vulnerability
- SQL injection
- Sideloading
- Jailbreaking
Correct Answer: A
Correct Answer
Answer A is correct because TOCTOU vulnerability means a race condition caused by a gap between checking a resource and later using it. That makes it the best answer here; Jailbreaking addresses removing vendor-imposed restrictions on a mobile device or operating system, not the function requested in the stem.
Incorrect Answers
Answer B is incorrect because SQL injection refers to injection of attacker-controlled SQL syntax into an application’s database query. The concept is valid, but it does not match this stem. The required function is a race condition caused by a gap between checking a resource and later using it, which maps to TOCTOU vulnerability.
Answer C is incorrect because Sideloading refers to installation of software from a source outside the approved application distribution mechanism. The concept is valid, but it does not match this stem. The required function is a race condition caused by a gap between checking a resource and later using it, which maps to TOCTOU vulnerability.
Answer D is incorrect because Jailbreaking refers to removing vendor-imposed restrictions on a mobile device or operating system. The question is not asking for this function. It is testing a race condition caused by a gap between checking a resource and later using it, so TOCTOU vulnerability is the stronger fit.
Question 2
Which term describes risk created when a product has reached the end of vendor support and no longer receives security fixes?
- Resource reuse
- Firmware vulnerability
- Zero-day vulnerability
- End-of-life vulnerability
Correct Answer: D
Correct Answer
Answer D is correct because End-of-life vulnerability means risk created when a product has reached the end of vendor support and no longer receives security fixes. The requirement maps directly to this function, whereas Firmware vulnerability is aimed at a weakness in low-level device software that controls hardware operation.
Incorrect Answers
Answer A is incorrect because Resource reuse refers to risk that residual data from a previous user or workload remains accessible when memory or storage resources are reassigned. The question is not asking for this function. It is testing risk created when a product has reached the end of vendor support and no longer receives security fixes, so End-of-life vulnerability is the stronger fit.
Answer B is incorrect because Firmware vulnerability refers to a weakness in low-level device software that controls hardware operation. The scenario instead requires risk created when a product has reached the end of vendor support and no longer receives security fixes, which is why End-of-life vulnerability is the better answer; this option serves the different function defined above.
Answer C is incorrect because Zero-day vulnerability refers to a vulnerability for which defenders do not yet have a broadly available fix or may have little warning before exploitation. This could be appropriate elsewhere, but the required function is risk created when a product has reached the end of vendor support and no longer receives security fixes; that makes End-of-life vulnerability the precise choice.
Question 3
What is an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults?
- Supply-chain vulnerability
- Sideloading
- Security misconfiguration
- Operating-system vulnerability
Correct Answer: C
Correct Answer
Answer C is correct because Security misconfiguration means an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults. This is the precise fit for the scenario. Operating-system vulnerability serves the different purpose of a weakness in the operating system kernel, service, driver, or security configuration.
Incorrect Answers
Answer A is incorrect because Supply-chain vulnerability refers to a weakness introduced through software dependencies, service providers, vendors, or hardware components. That concept can be valid in another scenario, but this question is testing an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults; Security misconfiguration therefore fits the requirement more directly.
Answer B is incorrect because Sideloading refers to installation of software from a source outside the approved application distribution mechanism. The concept is valid, but it does not match this stem. The required function is an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults, which maps to Security misconfiguration.
Answer D is incorrect because Operating-system vulnerability refers to a weakness in the operating system kernel, service, driver, or security configuration. That concept can be valid in another scenario, but this question is testing an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults; Security misconfiguration therefore fits the requirement more directly.
Question 4
Which term describes removing vendor-imposed restrictions on a mobile device or operating system?
- Malicious update
- Jailbreaking
- VM escape
- Security misconfiguration
Correct Answer: B
Correct Answer
Answer B is correct because Jailbreaking means removing vendor-imposed restrictions on a mobile device or operating system. This is the precise fit for the scenario. VM escape serves the different purpose of a virtualization flaw that allows code in a guest virtual machine to affect the hypervisor or another isolation boundary.
Incorrect Answers
Answer A is incorrect because Malicious update refers to a compromised or intentionally harmful software or firmware update delivered through a trusted update mechanism. The concept is valid, but it does not match this stem. The required function is removing vendor-imposed restrictions on a mobile device or operating system, which maps to Jailbreaking.
Answer C is incorrect because VM escape refers to a virtualization flaw that allows code in a guest virtual machine to affect the hypervisor or another isolation boundary. This could be appropriate elsewhere, but the required function is removing vendor-imposed restrictions on a mobile device or operating system; that makes Jailbreaking the precise choice.
Answer D is incorrect because Security misconfiguration refers to an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults. This could be appropriate elsewhere, but the required function is removing vendor-imposed restrictions on a mobile device or operating system; that makes Jailbreaking the precise choice.
Question 5
Two requirements remain open in a vulnerability analysis: weakness introduced through software dependencies, service providers, vendors, or hardware components; vulnerability for which defenders do not yet have a broadly available fix or may have little warning before exploitation. Which TWO options close those specific gaps? Choose TWO.
- Supply-chain vulnerability
- VM escape
- Zero-day vulnerability
- Firmware vulnerability
- Security misconfiguration
Correct Answers: A, C
Correct Answers
Answer A is correct because Supply-chain vulnerability means a weakness introduced through software dependencies, service providers, vendors, or hardware components. This option satisfies a specific requirement in the stem; VM escape serves a virtualization flaw that allows code in a guest virtual machine to affect the hypervisor or another isolation boundary and therefore is not interchangeable with it.
Answer C is correct because Zero-day vulnerability means a vulnerability for which defenders do not yet have a broadly available fix or may have little warning before exploitation. This option satisfies a specific requirement in the stem; Firmware vulnerability serves a weakness in low-level device software that controls hardware operation and therefore is not interchangeable with it.
Incorrect Answers
Answer B is incorrect because VM escape means a virtualization flaw that allows code in a guest virtual machine to affect the hypervisor or another isolation boundary. The fixed-count answer set is Supply-chain vulnerability, Zero-day vulnerability; this option does not fill one of those named functions.
Answer D is incorrect because Firmware vulnerability means a weakness in low-level device software that controls hardware operation. The question requires exactly 2 selections: Supply-chain vulnerability, Zero-day vulnerability. This option falls outside that required set. For example, Zero-day vulnerability is required for a vulnerability for which defenders do not yet have a broadly available fix or may have little warning before exploitation.
Answer E is incorrect because Security misconfiguration means an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults. The required choices are Supply-chain vulnerability, Zero-day vulnerability. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Question 6
Which race condition is caused by a gap between checking a resource and later using it?
- Supply-chain vulnerability
- TOCTOU vulnerability
- Zero-day vulnerability
- Cryptographic vulnerability
Correct Answer: B
Correct Answer
Answer B is correct because TOCTOU vulnerability means a race condition caused by a gap between checking a resource and later using it. The deciding point is functional fit: this option covers the stated need, while Cryptographic vulnerability addresses a weakness caused by broken algorithms, poor key handling, weak parameters, or incorrect cryptographic implementation.
Incorrect Answers
Answer A is incorrect because Supply-chain vulnerability refers to a weakness introduced through software dependencies, service providers, vendors, or hardware components. This could be appropriate elsewhere, but the required function is a race condition caused by a gap between checking a resource and later using it; that makes TOCTOU vulnerability the precise choice.
Answer C is incorrect because Zero-day vulnerability refers to a vulnerability for which defenders do not yet have a broadly available fix or may have little warning before exploitation. The scenario instead requires a race condition caused by a gap between checking a resource and later using it, which is why TOCTOU vulnerability is the better answer; this option serves the different function defined above.
Answer D is incorrect because Cryptographic vulnerability refers to a weakness caused by broken algorithms, poor key handling, weak parameters, or incorrect cryptographic implementation. The question is not asking for this function. It is testing a race condition caused by a gap between checking a resource and later using it, so TOCTOU vulnerability is the stronger fit.
Question 7
The control set for a vulnerability analysis must address both writing more data to a memory buffer than it can safely hold, potentially overwriting adjacent memory and virtualization flaw that allows code in a guest virtual machine to affect the hypervisor or another isolation boundary. Which TWO choices map directly to those needs? Choose TWO.
- Buffer overflow
- Jailbreaking
- SQL injection
- VM escape
- Supply-chain vulnerability
Correct Answers: A, D
Correct Answers
Answer A is correct because Buffer overflow means writing more data to a memory buffer than it can safely hold, potentially overwriting adjacent memory. This option satisfies a specific requirement in the stem; SQL injection serves injection of attacker-controlled SQL syntax into an application’s database query and therefore is not interchangeable with it.
Answer D is correct because VM escape means a virtualization flaw that allows code in a guest virtual machine to affect the hypervisor or another isolation boundary. This option satisfies a specific requirement in the stem; Supply-chain vulnerability serves a weakness introduced through software dependencies, service providers, vendors, or hardware components and therefore is not interchangeable with it.
Incorrect Answers
Answer B is incorrect because Jailbreaking means removing vendor-imposed restrictions on a mobile device or operating system. The fixed-count answer set is VM escape, Buffer overflow; this option does not fill one of those named functions. For example, Buffer overflow is required for writing more data to a memory buffer than it can safely hold, potentially overwriting adjacent memory.
Answer C is incorrect because SQL injection means injection of attacker-controlled SQL syntax into an application’s database query. The question requires exactly 2 selections: VM escape, Buffer overflow. This option falls outside that required set. For example, Buffer overflow is required for writing more data to a memory buffer than it can safely hold, potentially overwriting adjacent memory.
Answer E is incorrect because Supply-chain vulnerability means a weakness introduced through software dependencies, service providers, vendors, or hardware components. The scenario calls for VM escape, Buffer overflow. Selecting this option would leave one of those required functions uncovered.
Question 8
To exploit an unexpected sequence between checks and actions, which security approach should be selected?
- Malicious update
- SQL injection
- Legacy-system vulnerability
- Race condition
Correct Answer: D
Correct Answer
Answer D is correct because Race condition means a flaw in which security depends on the timing or ordering of concurrent operations. The deciding point is functional fit: this option covers the stated need, while Malicious update addresses a compromised or intentionally harmful software or firmware update delivered through a trusted update mechanism.
Incorrect Answers
Answer A is incorrect because Malicious update refers to a compromised or intentionally harmful software or firmware update delivered through a trusted update mechanism. That concept can be valid in another scenario, but this question is testing a flaw in which security depends on the timing or ordering of concurrent operations; Race condition therefore fits the requirement more directly.
Answer B is incorrect because SQL injection refers to injection of attacker-controlled SQL syntax into an application’s database query. The question is not asking for this function. It is testing a flaw in which security depends on the timing or ordering of concurrent operations, so Race condition is the stronger fit.
Answer C is incorrect because Legacy-system vulnerability refers to risk introduced by old technology that must remain in service despite outdated security capabilities. The scenario instead requires a flaw in which security depends on the timing or ordering of concurrent operations, which is why Race condition is the better answer; this option serves the different function defined above.
Question 9
To expose information because reused resources were not properly cleared, which security approach should be selected?
- Operating-system vulnerability
- Resource reuse
- Firmware vulnerability
- Cross-site scripting (XSS)
Correct Answer: B
Correct Answer
Answer B is correct because Resource reuse means risk that residual data from a previous user or workload remains accessible when memory or storage resources are reassigned. This matches the requirement as written. Cross-site scripting (XSS) can be valid in another context, but it is used for injection of active client-side content that executes in another user’s browser under the context of a trusted site.
Incorrect Answers
Answer A is incorrect because Operating-system vulnerability refers to a weakness in the operating system kernel, service, driver, or security configuration. The scenario instead requires risk that residual data from a previous user or workload remains accessible when memory or storage resources are reassigned, which is why Resource reuse is the better answer; this option serves the different function defined above.
Answer C is incorrect because Firmware vulnerability refers to a weakness in low-level device software that controls hardware operation. The key mismatch is functional: Resource reuse addresses risk that residual data from a previous user or workload remains accessible when memory or storage resources are reassigned, the need stated by the question.
Answer D is incorrect because Cross-site scripting (XSS) refers to injection of active client-side content that executes in another user’s browser under the context of a trusted site. That concept can be valid in another scenario, but this question is testing risk that residual data from a previous user or workload remains accessible when memory or storage resources are reassigned; Resource reuse therefore fits the requirement more directly.
Question 10
What is a weakness in the operating system kernel, service, driver, or security configuration?
- SQL injection
- Cloud-specific vulnerability
- Operating-system vulnerability
- Security misconfiguration
Correct Answer: C
Correct Answer
Answer C is correct because Operating-system vulnerability means a weakness in the operating system kernel, service, driver, or security configuration. This is the precise fit for the scenario. Security misconfiguration serves the different purpose of an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults.
Incorrect Answers
Answer A is incorrect because SQL injection refers to injection of attacker-controlled SQL syntax into an application’s database query. The concept is valid, but it does not match this stem. The required function is a weakness in the operating system kernel, service, driver, or security configuration, which maps to Operating-system vulnerability.
Answer B is incorrect because Cloud-specific vulnerability refers to a weakness tied to cloud design, permissions, exposed services, shared responsibility, or service configuration. The scenario instead requires a weakness in the operating system kernel, service, driver, or security configuration, which is why Operating-system vulnerability is the better answer; this option serves the different function defined above.
Answer D is incorrect because Security misconfiguration refers to an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults. The question is not asking for this function. It is testing a weakness in the operating system kernel, service, driver, or security configuration, so Operating-system vulnerability is the stronger fit.
Question 11
The control set for a vulnerability analysis must address both weakness caused by broken algorithms, poor key handling, weak parameters, or incorrect cryptographic implementation and vulnerability for which defenders do not yet have a broadly available fix or may have little warning before exploitation. Which TWO choices map directly to those needs? Choose TWO.
- Cryptographic vulnerability
- Resource reuse
- Zero-day vulnerability
- Memory injection
- Operating-system vulnerability
Correct Answers: A, C
Correct Answers
Answer A is correct because Cryptographic vulnerability means a weakness caused by broken algorithms, poor key handling, weak parameters, or incorrect cryptographic implementation. This selection maps directly to one of the named needs. Resource reuse addresses risk that residual data from a previous user or workload remains accessible when memory or storage resources are reassigned, so it does not satisfy the same slot.
Answer C is correct because Zero-day vulnerability means a vulnerability for which defenders do not yet have a broadly available fix or may have little warning before exploitation. The fixed-count item needs this function in the answer set. Memory injection covers placing malicious code or data into the memory space of a running process, a different requirement.
Incorrect Answers
Answer B is incorrect because Resource reuse means risk that residual data from a previous user or workload remains accessible when memory or storage resources are reassigned. The question requires exactly 2 selections: Cryptographic vulnerability, Zero-day vulnerability. This option falls outside that required set.
Answer D is incorrect because Memory injection means placing malicious code or data into the memory space of a running process. The fixed-count answer set is Cryptographic vulnerability, Zero-day vulnerability; this option does not fill one of those named functions.
Answer E is incorrect because Operating-system vulnerability means a weakness in the operating system kernel, service, driver, or security configuration. The scenario calls for Cryptographic vulnerability, Zero-day vulnerability. Selecting this option would leave one of those required functions uncovered.
Question 12
What is a compromised or intentionally harmful software or firmware update delivered through a trusted update mechanism?
- Security misconfiguration
- Buffer overflow
- Operating-system vulnerability
- Malicious update
Correct Answer: D
Correct Answer
Answer D is correct because Malicious update means a compromised or intentionally harmful software or firmware update delivered through a trusted update mechanism. That makes it the best answer here; Operating-system vulnerability addresses a weakness in the operating system kernel, service, driver, or security configuration, not the function requested in the stem.
Incorrect Answers
Answer A is incorrect because Security misconfiguration refers to an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults. This could be appropriate elsewhere, but the required function is a compromised or intentionally harmful software or firmware update delivered through a trusted update mechanism; that makes Malicious update the precise choice.
Answer B is incorrect because Buffer overflow refers to writing more data to a memory buffer than it can safely hold, potentially overwriting adjacent memory. The key mismatch is functional: Malicious update addresses a compromised or intentionally harmful software or firmware update delivered through a trusted update mechanism, the need stated by the question.
Answer C is incorrect because Operating-system vulnerability refers to a weakness in the operating system kernel, service, driver, or security configuration. The key mismatch is functional: Malicious update addresses a compromised or intentionally harmful software or firmware update delivered through a trusted update mechanism, the need stated by the question.
Question 13
Which virtualization flaw allows code in a guest virtual machine to affect the hypervisor or another isolation boundary?
- VM escape
- TOCTOU vulnerability
- Race condition
- Security misconfiguration
Correct Answer: A
Correct Answer
Answer A is correct because VM escape means a virtualization flaw that allows code in a guest virtual machine to affect the hypervisor or another isolation boundary. This is the precise fit for the scenario. Race condition serves the different purpose of a flaw in which security depends on the timing or ordering of concurrent operations.
Incorrect Answers
Answer B is incorrect because TOCTOU vulnerability refers to a race condition caused by a gap between checking a resource and later using it. The key mismatch is functional: VM escape addresses a virtualization flaw that allows code in a guest virtual machine to affect the hypervisor or another isolation boundary, the need stated by the question.
Answer C is incorrect because Race condition refers to a flaw in which security depends on the timing or ordering of concurrent operations. The concept is valid, but it does not match this stem. The required function is a virtualization flaw that allows code in a guest virtual machine to affect the hypervisor or another isolation boundary, which maps to VM escape.
Answer D is incorrect because Security misconfiguration refers to an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults. This could be appropriate elsewhere, but the required function is a virtualization flaw that allows code in a guest virtual machine to affect the hypervisor or another isolation boundary; that makes VM escape the precise choice. This question specifically tests the requirement represented by VM escape.
Question 14
Which term describes risk that residual data from a previous user or workload remains accessible when memory or storage resources are reassigned?
- Resource reuse
- TOCTOU vulnerability
- Cross-site scripting (XSS)
- End-of-life vulnerability
Correct Answer: A
Correct Answer
Answer A is correct because Resource reuse means risk that residual data from a previous user or workload remains accessible when memory or storage resources are reassigned. This matches the requirement as written. TOCTOU vulnerability can be valid in another context, but it is used for a race condition caused by a gap between checking a resource and later using it.
Incorrect Answers
Answer B is incorrect because TOCTOU vulnerability refers to a race condition caused by a gap between checking a resource and later using it. The scenario instead requires risk that residual data from a previous user or workload remains accessible when memory or storage resources are reassigned, which is why Resource reuse is the better answer; this option serves the different function defined above.
Answer C is incorrect because Cross-site scripting (XSS) refers to injection of active client-side content that executes in another user’s browser under the context of a trusted site. The key mismatch is functional: Resource reuse addresses risk that residual data from a previous user or workload remains accessible when memory or storage resources are reassigned, the need stated by the question.
Answer D is incorrect because End-of-life vulnerability refers to risk created when a product has reached the end of vendor support and no longer receives security fixes. That concept can be valid in another scenario, but this question is testing risk that residual data from a previous user or workload remains accessible when memory or storage resources are reassigned; Resource reuse therefore fits the requirement more directly.
Question 15
During a vulnerability analysis, the team has two independent requirements: (1) flaw in which security depends on the timing or ordering of concurrent operations; and (2) unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults. Which TWO choices best satisfy those requirements? Choose TWO.
- Legacy-system vulnerability
- TOCTOU vulnerability
- VM escape
- Security misconfiguration
- Race condition
Correct Answers: D, E
Correct Answers
Answer D is correct because Security misconfiguration means an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults. The fixed-count item needs this function in the answer set. TOCTOU vulnerability covers a race condition caused by a gap between checking a resource and later using it, a different requirement.
Answer E is correct because Race condition means a flaw in which security depends on the timing or ordering of concurrent operations. It belongs in the fixed-count answer set because it covers one of the stated requirements. TOCTOU vulnerability instead serves a race condition caused by a gap between checking a resource and later using it and cannot replace this function.
Incorrect Answers
Answer A is incorrect because Legacy-system vulnerability means risk introduced by old technology that must remain in service despite outdated security capabilities. The required choices are Security misconfiguration, Race condition. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer B is incorrect because TOCTOU vulnerability means a race condition caused by a gap between checking a resource and later using it. Every answer slot must map to a stated requirement. The correct set is Security misconfiguration, Race condition, so this option cannot replace one of those selections.
Answer C is incorrect because VM escape means a virtualization flaw that allows code in a guest virtual machine to affect the hypervisor or another isolation boundary. The question requires exactly 2 selections: Security misconfiguration, Race condition. This option falls outside that required set.
Question 16
During a vulnerability analysis, three requirements must be addressed: (1) weakness in the operating system kernel, service, driver, or security configuration; (2) risk introduced by old technology that must remain in service despite outdated security capabilities; and (3) vulnerability for which defenders do not yet have a broadly available fix or may have little warning before exploitation. Which THREE choices best satisfy them? Choose THREE.
- Memory injection
- Operating-system vulnerability
- Firmware vulnerability
- Legacy-system vulnerability
- Security misconfiguration
- Zero-day vulnerability
Correct Answers: B, D, F
Correct Answers
Answer B is correct because Operating-system vulnerability means a weakness in the operating system kernel, service, driver, or security configuration. One required function is exactly what this option provides. Security misconfiguration may be useful elsewhere, but it is used for an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults.
Answer D is correct because Legacy-system vulnerability means risk introduced by old technology that must remain in service despite outdated security capabilities. It belongs in the fixed-count answer set because it covers one of the stated requirements. Memory injection instead serves placing malicious code or data into the memory space of a running process and cannot replace this function.
Answer F is correct because Zero-day vulnerability means a vulnerability for which defenders do not yet have a broadly available fix or may have little warning before exploitation. One required function is exactly what this option provides. Memory injection may be useful elsewhere, but it is used for placing malicious code or data into the memory space of a running process.
Incorrect Answers
Answer A is incorrect because Memory injection means placing malicious code or data into the memory space of a running process. The scenario calls for Legacy-system vulnerability, Operating-system vulnerability, Zero-day vulnerability. Selecting this option would leave one of those required functions uncovered.
Answer C is incorrect because Firmware vulnerability means a weakness in low-level device software that controls hardware operation. The required choices are Legacy-system vulnerability, Operating-system vulnerability, Zero-day vulnerability. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer E is incorrect because Security misconfiguration means an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults. Every answer slot must map to a stated requirement. The correct set is Legacy-system vulnerability, Operating-system vulnerability, Zero-day vulnerability, so this option cannot replace one of those selections.
Question 17
What is a flaw in which security depends on the timing or ordering of concurrent operations?
- End-of-life vulnerability
- Cloud-specific vulnerability
- Race condition
- Operating-system vulnerability
Correct Answer: C
Correct Answer
Answer C is correct because Race condition means a flaw in which security depends on the timing or ordering of concurrent operations. The deciding point is functional fit: this option covers the stated need, while End-of-life vulnerability addresses risk created when a product has reached the end of vendor support and no longer receives security fixes.
Incorrect Answers
Answer A is incorrect because End-of-life vulnerability refers to risk created when a product has reached the end of vendor support and no longer receives security fixes. The key mismatch is functional: Race condition addresses a flaw in which security depends on the timing or ordering of concurrent operations, the need stated by the question.
Answer B is incorrect because Cloud-specific vulnerability refers to a weakness tied to cloud design, permissions, exposed services, shared responsibility, or service configuration. The concept is valid, but it does not match this stem. The required function is a flaw in which security depends on the timing or ordering of concurrent operations, which maps to Race condition.
Answer D is incorrect because Operating-system vulnerability refers to a weakness in the operating system kernel, service, driver, or security configuration. The concept is valid, but it does not match this stem. The required function is a flaw in which security depends on the timing or ordering of concurrent operations, which maps to Race condition.
Question 18
Two requirements remain open in a vulnerability analysis: unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults; installation of software from a source outside the approved application distribution mechanism. Which TWO options close those specific gaps? Choose TWO.
- Security misconfiguration
- Memory injection
- End-of-life vulnerability
- TOCTOU vulnerability
- Sideloading
Correct Answers: A, E
Correct Answers
Answer A is correct because Security misconfiguration means an unsafe system or application setting such as excessive permissions, exposed services, or insecure defaults. This selection maps directly to one of the named needs. TOCTOU vulnerability addresses a race condition caused by a gap between checking a resource and later using it, so it does not satisfy the same slot.
Answer E is correct because Sideloading means installation of software from a source outside the approved application distribution mechanism. The fixed-count item needs this function in the answer set. End-of-life vulnerability covers risk created when a product has reached the end of vendor support and no longer receives security fixes, a different requirement.
Incorrect Answers
Answer B is incorrect because Memory injection means placing malicious code or data into the memory space of a running process. The fixed-count answer set is Sideloading, Security misconfiguration; this option does not fill one of those named functions.
Answer C is incorrect because End-of-life vulnerability means risk created when a product has reached the end of vendor support and no longer receives security fixes. The scenario calls for Sideloading, Security misconfiguration. Selecting this option would leave one of those required functions uncovered.
Answer D is incorrect because TOCTOU vulnerability means a race condition caused by a gap between checking a resource and later using it. The scenario calls for Sideloading, Security misconfiguration. Selecting this option would leave one of those required functions uncovered.
Question 19
To compromise a device below the operating-system layer, which security approach should be selected?
- Operating-system vulnerability
- Buffer overflow
- Firmware vulnerability
- TOCTOU vulnerability
Correct Answer: C
Correct Answer
Answer C is correct because Firmware vulnerability means a weakness in low-level device software that controls hardware operation. The deciding point is functional fit: this option covers the stated need, while Buffer overflow addresses writing more data to a memory buffer than it can safely hold, potentially overwriting adjacent memory.
Incorrect Answers
Answer A is incorrect because Operating-system vulnerability refers to a weakness in the operating system kernel, service, driver, or security configuration. The concept is valid, but it does not match this stem. The required function is a weakness in low-level device software that controls hardware operation, which maps to Firmware vulnerability.
Answer B is incorrect because Buffer overflow refers to writing more data to a memory buffer than it can safely hold, potentially overwriting adjacent memory. The concept is valid, but it does not match this stem. The required function is a weakness in low-level device software that controls hardware operation, which maps to Firmware vulnerability.
Answer D is incorrect because TOCTOU vulnerability refers to a race condition caused by a gap between checking a resource and later using it. The question is not asking for this function. It is testing a weakness in low-level device software that controls hardware operation, so Firmware vulnerability is the stronger fit.
Question 20
To exploit a newly discovered weakness before standard remediation is available, which security approach should be selected?
- SQL injection
- Zero-day vulnerability
- Cross-site scripting (XSS)
- TOCTOU vulnerability
Correct Answer: B
Correct Answer
Answer B is correct because Zero-day vulnerability means a vulnerability for which defenders do not yet have a broadly available fix or may have little warning before exploitation. This matches the requirement as written. SQL injection can be valid in another context, but it is used for injection of attacker-controlled SQL syntax into an application’s database query.
Incorrect Answers
Answer A is incorrect because SQL injection refers to injection of attacker-controlled SQL syntax into an application’s database query. The question is not asking for this function. It is testing a vulnerability for which defenders do not yet have a broadly available fix or may have little warning before exploitation, so Zero-day vulnerability is the stronger fit.
Answer C is incorrect because Cross-site scripting (XSS) refers to injection of active client-side content that executes in another user’s browser under the context of a trusted site. That concept can be valid in another scenario, but this question is testing a vulnerability for which defenders do not yet have a broadly available fix or may have little warning before exploitation; Zero-day vulnerability therefore fits the requirement more directly.
Answer D is incorrect because TOCTOU vulnerability refers to a race condition caused by a gap between checking a resource and later using it. This could be appropriate elsewhere, but the required function is a vulnerability for which defenders do not yet have a broadly available fix or may have little warning before exploitation; that makes Zero-day vulnerability the precise choice.
