nerdexam
CompTIA

CAS-003 · Question #844

A developer implements the following code snippet: Which of the following vulnerabilities does this code snippet resolve?

The correct answer is D. Information leakage. The code snippet addresses information leakage by controlling what sensitive internal details are exposed in application output, such as error messages, stack traces, or internal data returned to users.

Technical Integration of Enterprise Security

Question

A developer implements the following code snippet:

Which of the following vulnerabilities does this code snippet resolve?

Options

  • ASQL injection
  • BBuffer overflow
  • CMissing session limit
  • DInformation leakage

How the community answered

(17 responses)
  • B
    6% (1)
  • C
    12% (2)
  • D
    82% (14)

Why each option

The code snippet addresses information leakage by controlling what sensitive internal details are exposed in application output, such as error messages, stack traces, or internal data returned to users.

ASQL injection

SQL injection is prevented through parameterized queries or prepared statements that separate code from data, not through output sanitization or error message control.

BBuffer overflow

Buffer overflow vulnerabilities are mitigated by enforcing input length bounds and using memory-safe functions, not by controlling what the application returns as output.

CMissing session limit

Missing session limits are addressed through session timeout policies and concurrent session controls, which are unrelated to the output filtering shown in this snippet.

DInformation leakageCorrect

Information leakage occurs when an application unintentionally reveals sensitive internals - such as database error details, software version strings, internal file paths, or stack traces - to users or potential attackers. The code snippet implements output control that suppresses or sanitizes such details before they are returned in a response, directly resolving the vulnerability without requiring changes to input handling or session management.

Concept tested: Preventing information leakage through error output control

Source: https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure

Topics

#secure coding#information disclosure#application security#error handling

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice