One of the most consistently reported software security vulnerabilities that leads to major exploits is:

A.
Lack of malware detection.

B.
Attack surface decrease.

C.
Inadequate network hardening.

D.
Poor input validation.

Explanation:
D: With coding there are standards that should be observed. Of these standards the most fundamental is
input validation. Attacks such as SQL injection depend on unfiltered input being sent through a web
application. This makes for a software vulnerability that can be exploited. There are two primary ways to
do input validation: client-side validation and server-side validation. Thus with poor input validation you
increase your risk with regard to exposure to major software exploits.
Incorrect Answers:
A: Malware detection refers to antivirus software which purpose is to identify, prevent and eliminate
viruses. This is not software vulnerability.
B: The attack surface of an application is the area of that application that is available to users—those who
are authenticated and, more importantly, those who are not. As such, it can include the services,
protocols, interfaces, and code. The smaller the attack surface, the less visible the application is to attack.
C: Network hardening refers to the process of making sure that your network is as secure as it can be.
This is not a software vulnerability that may lead to major exploits.

Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, 6th Edition, Sybex, Indianapolis,
2014, pp. 219, 345.