AJAX Technologies and Security Strategies GWEB Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Why is logging AJAX requests important for security monitoring?

   • AIt helps detect anomalous patterns such as unusual request frequency or unexpected parameters
   • BIt prevents cross-site scripting attacks
   • CIt automatically blocks malicious requests
   • DIt encrypts the data sent in AJAX requests
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is JSON hijacking?

   • AAn attack that causes a denial of service by sending large JSON payloads
   • BAn attack that steals JSON data by overriding JavaScript array constructors or using script tags
   • CAn attack that injects malicious JSON into a web page
   • DAn attack that modifies JSON data in transit
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security analyst is tuning an anomaly detection system for AJAX endpoints. The system logs request parameters, user IDs, and timestamps. The analyst wants to detect credential stuffing, where an attacker tries many username/password pairs via an AJAX login endpoint. The attacker rotates IP addresses and uses random User-Agent strings. Which detection strategy is MOST effective?

   • ABlock any IP address that makes more than 10 requests per minute.
   • BLog the `User-Agent` string and block any that are not in a known list.
   • CMonitor the total number of requests to the login endpoint per hour.
   • DMonitor the rate of failed login attempts per username across all IP addresses.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security team wants to detect automated AJAX scraping of a public API. The API returns JSON data and is used by a legitimate single-page app. The team notices a client making hundreds of requests per minute with a consistent `User-Agent` and no referrer. Which monitoring signal is MOST useful to distinguish this bot from a legitimate user?

   • AMonitor the server's CPU usage during peak hours.
   • BTrack the rate of requests per IP address and the sequence of requested endpoints.
   • CLog only the `User-Agent` string of each request.
   • DRecord the response size for every request.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A single-page application loads user-generated HTML content from an AJAX endpoint and displays it in a modal. The content is sanitized on the server, but the team wants to add a client-side control to limit the damage if a sanitization bypass occurs. The app already has a CSP that allows `script-src 'self'`. Which additional client-side control is MOST effective?

   • AEncode the content with `encodeURIComponent` before inserting it.
   • BInsert the content into the DOM using `innerHTML` inside an `<iframe sandbox>` with no `allow-scripts` attribute.
   • CSet the `innerHTML` property on a detached element and then append it to the DOM.
   • DUse `document.write` to output the content.
   Reveal Solution Discussion Select an answer first