Managing Application Security GSLC Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   A web application allows users to upload profile pictures. An attacker uploads a file containing malicious script that executes when other users view the profile. Which type of vulnerability is this?

   • ABroken authentication.
   • BCross-site request forgery (CSRF).
   • CStored cross-site scripting (XSS).
   • DSQL injection.
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A company is migrating a monolithic application to a microservices architecture using containers. The security manager must balance the need for rapid deployment with the need to prevent known vulnerabilities from reaching production. Which strategy best achieves this balance?

   • APerform a full penetration test on every microservice before each release.
   • BAllow developers to deploy immediately and rely on runtime monitoring to detect issues.
   • CIntegrate container image scanning and SAST into the CI/CD pipeline with a fail-on-critical policy.
   • DRequire manual approval from the security team for every container deployment.
   Reveal Solution Discussion Select an answer first
4. 53foundation · easy

   What is the first step in the vulnerability management process for applications?

   • AVerification
   • BIdentification
   • CRemediation
   • DPrioritization
   Reveal Solution Discussion Select an answer first
5. 54foundation · easy

   What is the primary impact of a cross-site scripting (XSS) vulnerability?

   • AAn attacker can cause a denial of service by overwhelming the server
   • BAn attacker can directly modify the application's source code
   • CAn attacker can execute arbitrary code on the server
   • DAn attacker can steal sensitive information from other users' sessions
   Reveal Solution Discussion Select an answer first
6. 55foundation · easy

   Which of the following is an example of an injection vulnerability?

   • AAn attacker intercepts network traffic to read sensitive data
   • BAn attacker tricks a user into clicking a malicious link that executes JavaScript in their browser
   • CAn attacker modifies a URL parameter to access another user's session
   • DAn attacker submits malicious SQL code in a login form that is executed by the database
   Reveal Solution Discussion Select an answer first