Web Application Overview GWAPT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is deploying a web application that uses a microservices architecture. Each microservice is exposed via a REST API, and the frontend communicates with them through an API gateway. The security team wants to ensure that only authenticated users can access the microservices. Where should the authentication logic be implemented to provide a centralized control point?

   • AIn the frontend JavaScript code
   • BAt the API gateway
   • CIn each microservice independently
   • DIn the database layer
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company's web application is deployed with a load balancer in front of two application servers that share a single database. The application uses sticky sessions to maintain session affinity. During a penetration test, the tester finds that after a server fails and the load balancer routes the user to the other server, the user is logged out. Which architectural change would best preserve the user's session across server failures?

   • AIncrease the sticky session timeout on the load balancer
   • BUse a cookie that stores the session data directly on the client
   • CConfigure the load balancer to use round-robin instead of sticky sessions
   • DStore session data in a shared session store such as Redis or a database
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A penetration tester is analyzing an application's login flow. The tester sends a POST request to /login with valid credentials and receives a 302 redirect to /dashboard. The tester then sends a GET request to /dashboard without a session cookie and receives a 302 redirect to /login. Which HTTP status code behavior is the application using to manage unauthenticated access?

   • A401 Unauthorized to indicate the request requires authentication
   • B403 Forbidden to indicate the user is not allowed to access the resource
   • C200 OK with the login page content embedded in the response
   • D302 Found to redirect the client to the login page when the session is missing
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In a typical web application interaction, which sequence correctly describes how the client, server, and database interact when a user submits a form?

   • AServer sends an HTTP request to the client → client queries the database → client returns the result to the server
   • BDatabase sends data to the client → client forwards it to the server → server stores it and responds
   • CClient sends an HTTP request → server processes and queries the database → server returns an HTTP response → client renders the result
   • DClient queries the database directly → database sends the result to the server → server sends an HTTP response to the client
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A web application uses a session management system that stores session data in a database. The session ID is a random 128-bit value. The application also has a 'remember me' feature that sets a second cookie with a persistent token. A tester discovers that the persistent token is the user's password hash. Which of the following is the most critical issue?

   • AThe session ID is too short at 128 bits
   • BThe session ID is stored in a database, creating a performance bottleneck
   • CThe persistent token is not cryptographically random and can be guessed
   • DThe 'remember me' cookie is not marked as HttpOnly
   Reveal Solution Discussion Select an answer first