Which of the following is a reason environmental variables are a concern when reviewing potential system vulnerabilities?

Question

Options

• AThe contents of environmental variables could affect the scope and impact of an exploited
• BIn-memory environmental variable values can be overwritten and used by attackers to insert
• CEnvironmental variables define cryptographic standards for the system and could create
• DEnvironmental variables will determine when updates are run and could mitigate the likelihood of

• A
  84% (27)
• B
  9% (3)
• C
  3% (1)
• D
  3% (1)

Explanation

Option A is correct because environmental variables often store sensitive configuration data - such as API keys, database credentials, file paths, and privilege-level settings - that are inherited by processes at runtime. When a vulnerability is exploited, the attacker gains access to the same environment the process runs in, meaning those variables can dramatically expand the scope (what systems can be reached) and impact (what damage can be done) of the attack.

Why the distractors are wrong:

• B misrepresents the threat model - while env vars live in memory, the concern isn't attackers overwriting them to inject data; that describes a different class of attack (memory corruption/injection).
• C is factually incorrect - cryptographic standards are defined by libraries, protocols, and configurations, not environmental variables.
• D is also factually incorrect - update scheduling is managed by package managers, cron jobs, or OS update services, not environmental variables.

Memory tip: Think of environmental variables as the "context bubble" a process lives in - if an attacker pops the bubble (exploits the process), everything in that bubble (credentials, paths, tokens) becomes theirs. Scope and impact = how wide and how deep the damage goes, which env vars directly influence.

No community discussion yet for this question.