hardMultiple SelectObjective-mapped
CAS-004 Practice Question: Which TWO of the following are effective defenses…
Which TWO of the following are effective defenses against Server-Side Request Forgery (SSRF) attacks? (Select TWO.)
⚠ Common exam trap
Many test-takers mistakenly believe that input validation alone is sufficient to prevent SSRF, but attackers can bypass validation via encoding, redirects, or protocol smuggling. Whitelisting outbound destinations and disabling unused URL schemes are the primary effective controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Whitelist allowed outbound IP addresses and domains
Whitelisting allowed outbound IP addresses and domains is effective because it restricts the server from making requests to any destination not explicitly permitted, directly preventing SSRF attacks that rely on reaching internal or malicious external hosts. This defense operates at the network or application layer, ensuring that even if an attacker injects a URL, the request is blocked unless it matches the whitelist.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Whitelist allowed outbound IP addresses and domains
Why this is correct
Restricting outbound connections to known safe destinations prevents the server from making requests to internal or malicious hosts.
- ✗
Use a web application firewall (WAF) to block SSRF signatures
Why it's wrong here
WAFs are reactive and can be evaded; they are not a primary defense against SSRF.
- ✗
Enforce strict referrer headers on requests
Why it's wrong here
Referrer headers are not a reliable defense against SSRF as they can be spoofed or omitted.
- ✓
Disable unused URL schemes (e.g., file://, dict://)
Why this is correct
Disabling unnecessary schemes limits the attack surface for SSRF exploitation.
- ✗
Implement input validation on all user-supplied URLs
Why it's wrong here
Input validation is important but can be bypassed with encoding or other techniques; it is not as robust as whitelisting.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.