Web Communication Security GSEC Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of the X-Frame-Options header?

   • ATo control which domains can access the page via CORS
   • BTo enforce HTTPS on the site
   • CTo prevent clickjacking attacks by controlling whether a page can be embedded in a frame
   • DTo block cross-site scripting
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A small e-commerce company recently deployed a new web application. Users report that when they visit the site, the browser shows a warning that the connection is not private, and the URL bar does not display a padlock. The site is reachable at https://www.example.com. The administrator confirms the web server is listening on port 443 and the certificate is installed. Which action would most directly resolve the user-facing warning?

   • AEnsure the certificate is issued by a publicly trusted CA and covers the exact hostname www.example.com.
   • BAdd the certificate to the server's trusted root store.
   • CConfigure the server to redirect all HTTP traffic to HTTPS using a 301 redirect.
   • DEnable TLS 1.2 and disable older protocols like SSLv3 and TLS 1.0.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which practice helps prevent session hijacking?

   • AUsing a short session timeout
   • BUsing the HttpOnly attribute on session cookies
   • CDisabling cookies entirely
   • DStoring session IDs in URLs
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security analyst is investigating a potential downgrade attack. The web server supports TLS 1.2 and TLS 1.3, but the analyst notices that some clients are connecting with TLS 1.0. The server logs show that these connections are coming from a legacy application that does not support newer TLS versions. The company must maintain compatibility with this legacy application but also wants to prevent downgrade attacks. Which approach best balances security and compatibility?

   • AKeep TLS 1.0 enabled only for the IP addresses of the legacy application, and use TLS 1.2 or higher for all other clients.
   • BDisable TLS 1.0 and 1.1 on the server, and require the legacy application to be updated or replaced.
   • CEnable TLS 1.0 but require the use of a strong cipher suite.
   • DUse a reverse proxy that terminates TLS and re-encrypts to the legacy application with TLS 1.0.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A web application uses cookies to maintain user sessions. A penetration test reveals that an attacker can set a session cookie for a victim's browser by exploiting a subdomain that shares the parent domain. The attacker then waits for the victim to log in and uses the attacker's known session token. What type of attack is this, and what is the most effective mitigation?

   • ACross-site request forgery; use SameSite=Strict on the cookie.
   • BMan-in-the-middle attack; use HSTS on the application.
   • CSession fixation; set the cookie's Domain attribute to the exact hostname and use a new session ID after login.
   • DSession hijacking; use the Secure attribute on the cookie.
   Reveal Solution Discussion Select an answer first