Web Communication Security GSEC Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A user reports that after logging into a web application, they are redirected to a different site that looks identical and asks them to re-enter their password. The user's browser shows a valid HTTPS connection to the fake site. Which type of attack is most likely occurring?

   • APhishing via a look-alike domain with a valid certificate
   • BSession hijacking via cookie theft
   • CDowngrade attack to HTTP
   • DMan-in-the-middle with a self-signed certificate
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A user connects to a corporate web portal from a hotel Wi-Fi. The portal uses HTTPS with a valid certificate. An attacker on the same network performs an ARP spoofing attack to intercept the user's traffic. The attacker cannot decrypt the TLS traffic. What is the most significant risk to the user's session?

   • AThe attacker can modify the web page content because TLS does not provide integrity.
   • BThe attacker can read the user's password because TLS is not strong enough.
   • CThe attacker can observe the encrypted traffic and later perform a session replay if the session token is not properly protected.
   • DThe attacker can redirect the user to a fake site because the certificate is valid.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company's web application has been suffering from SQL injection attacks. The application is behind a load balancer that terminates TLS. The security team wants to add a layer of defense that inspects HTTP traffic for malicious patterns before it reaches the application. Which solution best meets this requirement?

   • AConfigure the database to reject all queries that contain the word 'SELECT'.
   • BEnable TLS 1.3 on the load balancer to encrypt all traffic end-to-end.
   • CUse a network firewall to block port 443 from all IP addresses except the company's office.
   • DDeploy a Web Application Firewall (WAF) that inspects decrypted HTTP requests and blocks SQL injection signatures.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A security analyst at a financial firm notices that an attacker is able to intercept and modify traffic between a user's browser and the company's web application. The attacker has placed a rogue device on the network path and is presenting a self-signed certificate to the browser. The browser displays a certificate warning, but the user clicks through it. Which control would have prevented the user from bypassing the warning?

   • ADeploy a client-side policy that blocks sites with untrusted certificates and enforces HTTPS-only browsing.
   • BImplement certificate pinning in the web application's code.
   • CEnable HTTP Strict Transport Security (HSTS) on the web server.
   • DUse a web application firewall (WAF) to inspect incoming HTTPS traffic.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   What is the primary role of a Web Application Firewall (WAF)?

   • ATo encrypt all data stored in the application's database
   • BTo manage user authentication and authorization
   • CTo filter and monitor HTTP traffic to protect web applications from attacks
   • DTo provide a virtual private network for remote users
   Reveal Solution Discussion Select an answer first