Application Software Security GCCC Practice Questions (Page 11)

Questions 51–53

1. 51application · medium

   A company is migrating a monolithic application to a microservices architecture running in Kubernetes. The security team wants to ensure that the migration does not introduce new vulnerabilities. Which practice should the team implement during the migration?

   • AExpose every microservice through a public ingress so that the API gateway can handle authentication and authorization centrally.
   • BApply network policies to restrict communication between microservices to only the required ports and protocols, and enable mutual TLS for service-to-service communication.
   • CRun all microservices in the same namespace and rely on the Kubernetes service account to authenticate all traffic.
   • DUse the same container image for all microservices to simplify patching, and rely on the image scanner to identify vulnerabilities.
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A security engineer is reviewing a Java application that deserializes objects received from a message queue. The application uses Java's native serialization. A SAST scan flags the deserialization as insecure. The application is critical and cannot be taken offline for a rewrite. Which remediation should the engineer prioritize?

   • ASwitch the application to use JSON serialization instead of Java native serialization, but do not change the message format.
   • BAdd a WAF rule to block any message that contains the string 'java.lang.Runtime' to prevent command execution.
   • CRun a DAST scan against the application to identify any deserialization payloads that are being sent to the message queue.
   • DImplement an allowlist of classes that are permitted to be deserialized, and run the deserialization in a sandboxed environment with limited permissions.
   Reveal Solution Discussion Select an answer first
3. 53expert · hard

   A development team is migrating a legacy application to a modern framework. The application currently uses XML to transfer data between services. A security review identifies that the XML parser is vulnerable to XXE (XML External Entity) attacks. The team must fix this without breaking existing functionality. Which approach is most effective?

   • AAdd a WAF rule to block XXE payloads
   • BUse a different XML parser without changing configuration
   • CReplace XML with JSON for all data transfers
   • DDisable external entity resolution in the XML parser configuration
   Reveal Solution Discussion Select an answer first