100-160 Question 205
Select 3An organization has discovered a vulnerability in one of its web applications that could allow attackers to execute SQL injection attacks. The application is used to process sensitive customer data, and a successful attack could lead to data theft. Based on this scenario, which of the following statements reflects the correct approach to managing this risk?
- A
Apply input validation and parameterized queries to mitigate the vulnerability.
- B
Accept the risk, as the likelihood of exploitation is extremely low.
- C
Determine the level of risk by assessing the likelihood of exploitation and the potential impact.
- D
Disregard the vulnerability since no attacks have been reported so far.
- E
Implement a web application firewall (WAF) to reduce the likelihood of exploitation.
Show answer and explanation
Correct answers: A, C, E
Explanation
Effective risk management involves identifying vulnerabilities, assessing the associated risks (likelihood and impact), and implementing appropriate mitigation strategies. In this scenario, applying input validation and parameterized queries directly addresses the vulnerability, while a WAF provides an additional layer of protection. Assessing the risk level ensures that the organization can prioritize and respond appropriately. Accepting or ignoring the risk without proper evaluation is not a recommended cybersecurity practice.
- A. Correct.
Applying input validation and parameterized queries is a direct mitigation strategy to address SQL injection vulnerabilities. This reduces the likelihood of exploitation.
- B. Incorrect.
Accepting the risk without further analysis is not a recommended approach, as the potential impact (data theft) is significant, and the likelihood of exploitation must first be properly assessed.
- C. Correct.
Determining the level of risk by analyzing the likelihood and impact is a critical step in risk management. It helps prioritize the vulnerability and decide on appropriate actions.
- D. Incorrect.
Disregarding the vulnerability is not a responsible approach to cybersecurity, particularly for a vulnerability that could lead to significant data theft.
- E. Correct.
Implementing a web application firewall (WAF) can help reduce the likelihood of exploitation by blocking malicious traffic targeting the vulnerability.