mediumMultiple SelectObjective-mapped
CAS-004 Practice Question: Which THREE of the following are common…
Which THREE of the following are common vulnerabilities found in web applications according to the OWASP Top 10 2021? (Select THREE.)
⚠ Common exam trap
A common trap is assuming SQL Injection remains a separate category in the OWASP Top 10 2021; however, it was merged into the broader Injection category (A03). Additionally, SSRF was added as a new category (A10), so it is a correct answer despite being a less familiar vulnerability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cryptographic Failures
The OWASP Top 10 2021 lists three categories that correspond directly to the options: A02:2021 Cryptographic Failures (option A), A01:2021 Broken Access Control (option B), and A10:2021 Server-Side Request Forgery (option C). Option D (SQL Injection) is not a standalone category in the 2021 list; it falls under A03:2021 Injection, which is broader and includes various injection types. Option E (Remote Code Execution via buffer overflow) is not listed as a distinct category in the OWASP Top 10 2021. Therefore, the correct three answers are A, B, and C.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Cryptographic Failures
Why this is correct
Cryptographic Failures (A02:2021) is a distinct category in the OWASP Top 10 2021, covering weak encryption, improper key management, and failure to enforce HTTPS. This is a correct answer.
- ✓
Broken Access Control
Why this is correct
Broken Access Control (A01:2021) is the top category in the OWASP Top 10 2021, involving failures to enforce restrictions on authenticated users. This is a correct answer.
- ✓
Server-Side Request Forgery (SSRF)
Why this is correct
Server-Side Request Forgery (SSRF) is A10:2021, a new entry in the 2021 list. This is a correct answer.
- ✗
SQL Injection
Why it's wrong here
SQL Injection is not a standalone category in the OWASP Top 10 2021; it is part of A03:2021 Injection. Since the question asks for distinct categories listed in the Top 10, this is incorrect.
- ✗
Remote Code Execution (RCE) via buffer overflow
Why it's wrong here
Remote Code Execution via buffer overflow is not listed as a distinct category in the OWASP Top 10 2021. Although RCE may occur through injection, buffer overflow is not specifically addressed, so this is incorrect.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.