Web Application Configuration Testing GWAPT Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   You are testing a web application that uses a content management system (CMS) with several plugins. You find that one plugin has a known critical vulnerability, but the vendor has not released a patch. The application is business-critical and cannot be taken offline. What is the best course of action?

   • ARemove the plugin and replace its functionality with custom code.
   • BDisable the plugin until a patch is available.
   • CAccept the risk and document it in the report.
   • DImplement a WAF rule to block known exploit patterns and monitor for suspicious activity.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   During a configuration review, you notice that the application's session timeout is set to 24 hours and the session cookie does not have the Secure flag. The application is used in a corporate environment where users access it from both the internal network and the internet. What is the most important configuration change?

   • AImplement a session fixation protection mechanism.
   • BSet the Secure flag on the session cookie.
   • CSet the HttpOnly flag on the session cookie.
   • DReduce the session timeout to 15 minutes.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company's web application is hosted on a shared hosting platform that only supports TLS 1.0 and TLS 1.1. The security team requires TLS 1.2 or higher, but the company cannot change hosting providers due to a contract. What is the most practical solution?

   • AAsk the hosting provider to enable TLS 1.2, even though they said it is not supported.
   • BPlace a reverse proxy in front of the application that terminates TLS 1.2 and forwards requests to the hosting platform over HTTP.
   • CAccept the risk and document it in the report.
   • DMove the application to a different hosting provider despite the contract penalty.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A web application runs on a server where the web root is also the home directory of the application user. The application allows file uploads and stores them in a subdirectory of the web root. What is the most significant risk and the best mitigation?

   • AThe application user can read sensitive files in the home directory; restrict file permissions
   • BUploaded files may be executed if the directory allows script execution; configure the upload directory to disable script execution
   • CUploaded files can overwrite application files; use random file names
   • DThe web root is too large; move the application to a separate directory
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is a common file upload misconfiguration that can lead to remote code execution?

   • ARestricting uploads to image files only
   • BStoring uploaded files outside the web root
   • CUsing random filenames for uploaded files
   • DAllowing upload of executable files without proper validation
   Reveal Solution Discussion Select an answer first