AJAX Technologies and Security Strategies GWEB Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security engineer is reviewing an AJAX endpoint that returns JSON. The endpoint is accessed via HTTPS and uses cookies for session management. The engineer wants to prevent JSON hijacking, where an attacker uses a `<script>` tag to load the JSON and override a JavaScript array constructor. Which combination of controls is MOST effective?

   • ASet the `X-Content-Type-Options: nosniff` header and rely on the `application/json` content type.
   • BRequire a custom header like `X-Requested-With` on all AJAX requests.
   • CReturn the JSON with a `while(1);` prefix and set the `Content-Type` to `application/json`.
   • DUse `Access-Control-Allow-Origin: *` to allow any origin to read the response.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company's web application has an AJAX endpoint that allows users to update their own profile. The endpoint is protected by a session cookie and a CSRF token. A penetration test found that the CSRF token is not validated when the request includes a custom header `X-Requested-With: XMLHttpRequest`. The application relies on the same-origin policy to prevent cross-origin AJAX requests. Which additional control is most effective to prevent CSRF?

   • ACheck the `Origin` header and reject requests that do not match the application's origin.
   • BRequire the `X-Requested-With` header to be present and equal to `XMLHttpRequest`.
   • CUse a double-submit cookie pattern where the token is in a cookie and a request header.
   • DValidate the CSRF token for all requests, regardless of the presence of the `X-Requested-With` header.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A web application has an AJAX endpoint that accepts a JSON array of filter objects and uses them to query a database. An attacker sends a request with duplicate keys in a JSON object, such as `{"filter": "a", "filter": "b"}`. The server-side framework parses the JSON and uses the last value. The security team is concerned about HTTP parameter pollution. Which defense is most effective?

   • AUse the first value encountered when parsing duplicate keys.
   • BReject requests that contain duplicate keys in the JSON body by validating the raw input before parsing.
   • CRely on the framework's default behavior of using the last value.
   • DAdd a CSRF token to the AJAX request.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security operations team is configuring monitoring for a web application's AJAX endpoints. They want to detect credential stuffing attacks that use AJAX login requests. The application uses a standard login form with JSON submission. Which monitoring approach is most effective while minimizing false positives?

   • AAlert when the same session ID submits more than 10 login attempts in 5 minutes.
   • BAlert when a single IP address submits login requests for multiple distinct usernames at a high rate.
   • CAlert when any login request includes a `Referer` header from a different domain.
   • DAlert when the login endpoint receives a high volume of requests with `Content-Type: application/json`.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A web application has an AJAX endpoint that returns user data in JSON format. The endpoint is accessed via a `<script>` tag by a legacy integration, and the response is a JSON array. A security review identified a JSON hijacking risk. Which change is most effective to mitigate this?

   • AReturn the JSON response as an object with a prefix, such as `)]}',\n` before the JSON.
   • BSet the `Content-Type` header to `application/json`.
   • CAdd a CSRF token to the request.
   • DUse `XMLHttpRequest` instead of `fetch` in the legacy integration.
   Reveal Solution Discussion Select an answer first