Application Software Security GCCC Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A company exposes a public API that allows third-party developers to query customer account balances. The API uses API keys for authentication. Recently, a developer's key was leaked and used to scrape data from thousands of accounts. The company wants to reduce the impact of future key leaks while maintaining a good developer experience. Which combination of controls should the company implement?

   • ASwitch to mutual TLS authentication and require every developer to install a client certificate, but keep the current API key mechanism as a fallback.
   • BAdd a WAF in front of the API and configure it to block any request that does not include a valid User-Agent header.
   • CIssue longer and more complex API keys and require developers to rotate them every 90 days, but do not add rate limiting.
   • DImplement per-key rate limiting, require the use of short-lived JWTs obtained via OAuth 2.0, and monitor for anomalous access patterns such as high-volume sequential requests.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   What is the primary function of a web application firewall (WAF)?

   • ATo encrypt all data stored in the application's database
   • BTo manage user authentication and authorization for the application
   • CTo scan the application's source code for vulnerabilities
   • DTo filter and monitor HTTP traffic between a web application and its users
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A company is building a public API that allows users to upload and share files. The API uses OAuth 2.0 with bearer tokens for authentication. The security team is concerned about token leakage through browser history, referrer headers, and logs. Which set of controls should the team implement to reduce the risk of token leakage?

   • AEmbed the token in the URL query string so that it is not sent in the Authorization header, and rely on HTTPS for encryption.
   • BUse a single static token for all users and rotate it only when a leak is suspected.
   • CUse long-lived tokens that are stored in localStorage so that users do not have to re-authenticate frequently.
   • DRequire the use of short-lived tokens, store tokens only in memory on the client, and ensure that the API does not log the Authorization header.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A development team is about to release a new version of a web application. The team has already run SAST and fixed all reported issues. The security manager wants to identify runtime vulnerabilities that SAST cannot detect, such as authentication bypass and business-logic flaws. Which additional testing approach should the team use?

   • ARun another SAST scan with a different tool to get a second opinion on the source code.
   • BDeploy the application to production and monitor the logs for any unusual activity that might indicate a vulnerability.
   • CReview the application's configuration files manually to ensure that all security settings are enabled.
   • DRun a DAST scan against a staging environment that includes authenticated test accounts and realistic business workflows.
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   Which of the following attacks is a web application firewall (WAF) specifically designed to help prevent?

   • AInsider threats from authorized users abusing their privileges
   • BDenial-of-service attacks that overwhelm the network bandwidth
   • CPhysical theft of the server hardware
   • DSQL injection
   Reveal Solution Discussion Select an answer first