Web Communication Security GSEC Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A web application is vulnerable to cross-site scripting (XSS) because it reflects user input without proper encoding. The security team wants to implement a defense-in-depth approach. They plan to add a Content Security Policy (CSP) header. Which CSP directive is most effective in mitigating the impact of reflected XSS?

   • Aframe-ancestors 'self'
   • Bscript-src 'self'
   • Cdefault-src 'self'
   • Dobject-src 'none'
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the role of a digital certificate in HTTPS?

   • AIt stores the server's private key securely
   • BIt authenticates the server's identity to the client
   • CIt encrypts the data transmitted between the client and server
   • DIt prevents the server from being compromised
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A web developer is building a login system for a healthcare portal. The application sets a session cookie after authentication. The developer wants to ensure the cookie is not accessible to client-side scripts and is only sent over HTTPS. Which set of cookie attributes should be used?

   • ASecure; Path=/
   • BSecure; SameSite=Strict
   • CSecure; HttpOnly
   • DHttpOnly; Domain=example.com
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which cookie attribute is used to ensure a cookie is only sent over HTTPS connections?

   • ASameSite
   • BHttpOnly
   • CDomain
   • DSecure
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is session fixation?

   • AAn attacker steals a session ID from the user's browser
   • BAn attacker uses a fixed IP address to impersonate a user
   • CAn attacker sets a user's session ID to a known value
   • DAn attacker prevents a user from logging out
   Reveal Solution Discussion Select an answer first