mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Is writing a Python script to parse system logs…
A security engineer is writing a Python script to parse system logs and alert on suspicious patterns. What is the best practice to ensure the script remains secure when handling log data?
⚠ Common exam trap
Candidates often mistakenly think that `eval()` is acceptable for dynamic evaluation in scripts, when in fact it is a critical security flaw that leads to arbitrary code execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sanitize log input and use safe parsing functions like `json.loads()` for structured logs.
Sanitizing log input and using safe parsing functions like `json.loads()` prevents injection attacks (e.g., command injection, code injection) that can occur when untrusted log data is processed. `json.loads()` strictly parses JSON according to RFC 7159, rejecting malformed or malicious payloads, whereas unsanitized input could contain escape sequences or embedded scripts that compromise the script's execution context.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store all logs in a database and query directly.
Why it's wrong here
Database queries can also be vulnerable if not parameterized.
- ✗
Use `eval()` to dynamically evaluate log content.
Why it's wrong here
`eval()` can execute arbitrary code, leading to injection.
- ✓
Sanitize log input and use safe parsing functions like `json.loads()` for structured logs.
Why this is correct
Safe parsing prevents injection and handles data securely.
- ✗
Run the script with root privileges to access all logs.
Why it's wrong here
Running as root increases the impact of a compromise.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.