Web Application Configuration Testing GWAPT Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A web server is configured with a strong TLS 1.2 configuration, but it also supports the RC4 cipher suite for legacy clients. A tester wants to recommend disabling RC4. What is the best justification?

   • ARC4 is slower than AES, causing performance issues
   • BRC4 is a symmetric cipher, which is inherently insecure
   • CRC4 is not supported by modern browsers
   • DRC4 is cryptographically broken and can be exploited to recover plaintext
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is an example of information disclosure through logging?

   • ALogging full credit card numbers in access logs
   • BLogging the user's IP address
   • CLogging the requested URL
   • DLogging the HTTP status code
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A file upload feature accepts any file extension and stores uploads in a directory that is accessible via the web. An attacker uploads a file named shell.php. What is the most likely impact and the best mitigation?

   • AThe attacker can overwrite other files; set the directory to read-only
   • BThe attacker can perform XSS; sanitize the file content
   • CThe attacker can execute the PHP file by requesting its URL; restrict uploads to allowed extensions and store them outside the web root
   • DThe attacker can only read the file, not execute it; rename the file with a random name
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An application uses a session cookie that is not marked HttpOnly. A tester finds a reflected XSS vulnerability. What is the most likely impact of combining these two issues?

   • AAn attacker can steal the session cookie via JavaScript and impersonate the user
   • BThe session cookie can be intercepted over HTTP
   • CThe session cookie is stored insecurely on the server
   • DThe session cookie can be brute-forced more easily
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   During testing, you trigger a 404 error and the response includes the internal IP address of the application server. What is the best way to remediate this information disclosure?

   • AUse a reverse proxy to hide the server's IP
   • BDisable the web server's error logging
   • CConfigure custom error pages that do not include internal details
   • DChange the internal IP address of the server
   Reveal Solution Discussion Select an answer first