CS0-003 Question #198: Real Exam Question with Answer & Explanation

The correct answer is C: XXE. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end o

Submitted by daniela_cl· Mar 6, 2026Vulnerability Management

Question

A security analyst is validating a particular finding that was reported in a web application vulnerability scan to make sure it is not a false positive. The security analyst uses the snippet below: Which of the following vulnerability types is the security analyst validating?

Options

ADirectory traversal
BXSS
CXXE
DSSRF

Explanation

XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. In some situations, an attacker can escalate an XXE attack to compromise the underlying server or other back-end infrastructure, by leveraging the XXE vulnerability to perform server-side request forgery (SSRF) attacks.

Topics

#vulnerability validation#false positive#web application vulnerability#XXE

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice Browse All CS0-003 Questions