hardMultiple ChoiceObjective-mapped
CISSP Practice Question: A security architect is reviewing a software…
A security architect is reviewing a software design that uses a third-party library for XML parsing. The library is known to be vulnerable to XML External Entity (XXE) attacks. The architect recommends replacing the library. What is the primary risk of XXE attacks that the architect wants to avoid?
⚠ Common exam trap
The CISSP exam often tests the distinction between the primary risk (data disclosure) and secondary risks (DoS, SSRF, or RCE), so candidates mistakenly choose denial of service (Option C) because they recall the 'billion laughs' attack, but the question explicitly asks for the primary risk of XXE.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disclosure of sensitive files from the server
XXE attacks exploit XML parsers that process external entities, allowing an attacker to read sensitive files from the server (e.g., /etc/passwd) by referencing them in the entity definition. The primary risk is unauthorized data disclosure, as the parser may include the file content in the response or error message. This directly violates confidentiality, a core security objective.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Disclosure of sensitive files from the server
Why this is correct
This is the correct answer. XML External Entity (XXE) vulnerabilities allow an attacker to define or reference external entities within XML documents, which are then processed by the XML parser. By leveraging the `file://` protocol, an attacker can instruct the server to read arbitrary local files, such as `/etc/passwd`, application configuration files, or other sensitive system files, and include their content within the XML parser's response or error messages, leading to unauthorized data disclosure.
- ✗
Remote code execution by injecting malicious XML
Why it's wrong here
Remote Code Execution (RCE) is generally not a direct consequence of an XXE vulnerability alone. While XXE can be used to fetch external resources, including potentially malicious scripts, the XML parser itself does not execute arbitrary code. RCE would typically require the XXE to be chained with another vulnerability, such as a specific server-side request forgery (SSRF) vulnerability that allows interaction with internal services capable of code execution, or a vulnerable XML processing library that misinterprets fetched data as executable instructions, making it a rare primary outcome.
- ✗
Denial of service (DoS) from entity expansion
Why it's wrong here
Denial of Service (DoS) through entity expansion, often referred to as a 'billion laughs' attack, is a possible outcome of XXE where recursively defined entities consume excessive server memory and CPU resources, causing the application or server to crash or become unresponsive. However, while a valid concern, DoS is typically considered a secondary impact compared to the direct and often more critical risk of sensitive data disclosure or server-side request forgery, which can lead to further compromise.
- ✗
Cross-site scripting (XSS) delivered via XML response
Why it's wrong here
Cross-site Scripting (XSS) is a client-side vulnerability where malicious scripts are injected into web pages viewed by other users, typically through input validation flaws. XXE, conversely, is a server-side vulnerability that exploits how an XML parser processes external entities. Although an XXE attack might be used to retrieve and embed malicious content into an XML response, this alone does not constitute XSS unless the client-side application subsequently renders that XML response in an insecure manner, allowing the embedded script to execute in the user's browser.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.