Defense in Depth GSEC Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which application security practice is most effective at preventing SQL injection attacks?

   • AUsing a web application firewall (WAF) only
   • BInput validation and parameterized queries
   • CEncrypting all data at rest
   • DDisabling error messages on the server
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company runs a public-facing web application that handles customer orders. The application has been targeted by SQL injection and cross-site scripting (XSS) attacks. The security team wants to add layers of protection without rewriting the application immediately. Which approach is most effective?

   • ADeploy a web application firewall (WAF) in front of the application and implement input validation on the server side.
   • BEnable HTTPS on the application and use secure cookies.
   • CPerform a penetration test and fix all identified vulnerabilities.
   • DUse a network firewall to block all traffic to the application except from known IP addresses.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company is designing a new data center. The security team wants to protect against both unauthorized physical access and theft of servers. Which combination of physical controls is most effective?

   • AUse smart cards for all employees and place servers in an open area for easy access.
   • BInstall motion sensors and rely on remote monitoring to alert security personnel.
   • CUse biometric access controls on server room doors, CCTV monitoring, and server racks with locking doors.
   • DInstall a mantrap at the main entrance and use a security guard at the reception desk.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company has implemented strong technical controls, but employees still fall for phishing emails and share passwords. The security team wants to improve the human factor layer. Which approach is most effective?

   • ASend a monthly email newsletter with security tips.
   • BImplement a spam filter and block all external email.
   • CConduct regular security awareness training, including simulated phishing exercises, and enforce a policy for reporting suspicious emails.
   • DTerminate employees who fall for phishing simulations.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A small e-commerce company is designing a new architecture for its online store. The budget is limited, and the team must choose a set of controls that provides the best defense in depth without over-engineering. The store will be hosted on a single server with a public IP. Which set of controls is the most balanced and effective?

   • AUse only a cloud-based DDoS protection service and rely on the hosting provider's physical security.
   • BInstall a host-based firewall, keep the server patched, use strong passwords, and enable SSL/TLS for all traffic.
   • CDeploy a dedicated hardware firewall, an IDS, and a web application firewall in front of the server.
   • DImplement a full disk encryption solution and require multi-factor authentication for all administrative access.
   Reveal Solution Discussion Select an answer first