nerdexam
Cisco

300-910 · Question #55

Refer to the exhibit. An application has been developed as a fileserver. To create this application as a fileserver, the class is used to store data in an SQL database. Which two steps help minimize t

The correct answer is A. Reject string values that are greater than maximum size C. Validate the content of the name and address parameters. To minimize the risk of attack and compromise for an application storing data in an SQL database, it is essential to implement robust input validation techniques. These techniques focus on sanitizing and constraining user-provided data before processing.

Security

Question

Refer to the exhibit. An application has been developed as a fileserver. To create this application as a fileserver, the class is used to store data in an SQL database. Which two steps help minimize the risk of attack and compromise of the application? (Choose two.)

Options

  • AReject string values that are greater than maximum size
  • BUse floating point instead of integer for rating to avoid overflow
  • CValidate the content of the name and address parameters
  • DRun the application in a Docker container
  • ECompile the application using Java HotSpot

How the community answered

(15 responses)
  • A
    73% (11)
  • B
    7% (1)
  • D
    7% (1)
  • E
    13% (2)

Why each option

To minimize the risk of attack and compromise for an application storing data in an SQL database, it is essential to implement robust input validation techniques. These techniques focus on sanitizing and constraining user-provided data before processing.

AReject string values that are greater than maximum sizeCorrect

Rejecting string values greater than a maximum size prevents buffer overflow vulnerabilities and limits the potential for excessively large, malicious inputs that could exploit parsing or storage mechanisms. This ensures that the application only processes data within expected bounds, enhancing stability and security.

BUse floating point instead of integer for rating to avoid overflow

Using floating point instead of integer for rating does not primarily minimize attack risk; it addresses numerical precision or range issues, but not typically the attack vectors targeted by input validation.

CValidate the content of the name and address parametersCorrect

Validating the content of parameters like name and address is a fundamental security practice to prevent various injection attacks, such as SQL injection or cross-site scripting, by ensuring that input adheres to expected formats and does not contain malicious code or unexpected characters. This sanitization protects the database and application from harmful payloads.

DRun the application in a Docker container

Running an application in a Docker container provides process isolation, which is a layer of environmental security, but it does not directly prevent application-level attacks originating from malicious input data itself.

ECompile the application using Java HotSpot

Compiling an application using Java HotSpot is about the Java Virtual Machine's runtime environment and performance, not directly a security measure against input-based attacks or database compromise.

Concept tested: Secure coding practices, input validation

Source: https://learn.microsoft.com/en-us/previous-versions/aspnet/ms972956(v=msdn.10)

Topics

#Application Security#Input Validation#SQL Injection Prevention#Buffer Overflow Prevention

Community Discussion

No community discussion yet for this question.

Full 300-910 Practice