CompTIA SecurityX (CAS-005) — Question 316

A penetration tester discovers a condition that causes unexpected behavior in a web application. This results in the dump of the interpreter’s debugging information, which includes the interpreter’s version, full path of binary files, and the user ID running the process. Which of the following actions would best mitigate this risk?

Answer options

• A. Include routines in the application for message handling.
• B. Adopt a compiled programming language instead.
• C. Perform SAST vulnerability scans on every build.
• D. Validate user-generated input.

Correct answer: A

Explanation

Including routines for message handling helps manage how the application responds to unexpected situations, thereby reducing the likelihood of leaking sensitive debugging information. While adopting a compiled language may improve security, it does not directly address the specific risk of unintended information disclosure. Performing SAST scans is beneficial for identifying vulnerabilities but does not prevent the immediate risk from occurring. Validating user input is essential for security but does not specifically mitigate the issue of disclosing debugging information.