AJAX Technologies and Security Strategies GWEB Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the most important server-side control to protect an AJAX endpoint from malicious data?

   • AClient-side JavaScript validation
   • BCORS headers
   • CContent Security Policy (CSP)
   • DServer-side input validation
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A JavaScript application merges user-controlled JSON objects into a configuration object using a recursive merge function. A security researcher reports that a crafted AJAX request can set `__proto__` to inject properties into `Object.prototype`, leading to unexpected behavior. Which mitigation is MOST effective?

   • AUse `Object.create(null)` for the target object and reject any key named `__proto__` during merge.
   • BSet `Object.freeze(Object.prototype)` to prevent modification.
   • CUse `JSON.parse` with a reviver function that deletes `__proto__` keys.
   • DSanitize the JSON string by replacing `__proto__` with an empty string before parsing.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which HTTP header is used to control whether a browser allows a web page to make AJAX requests to a different origin?

   • AContent-Security-Policy
   • BX-Frame-Options
   • CStrict-Transport-Security
   • DAccess-Control-Allow-Origin
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A public-facing AJAX endpoint `/api/export` allows authenticated users to download their own data. A tester finds that by changing the `userId` parameter in the AJAX request, they can download another user's data. The endpoint checks that the session is valid but does not verify ownership. Which control should be added?

   • AAdd a CORS policy that restricts the endpoint to the application's own origin.
   • BRequire the `userId` parameter to be sent as a POST body instead of a query string.
   • COn the server, derive the `userId` from the authenticated session instead of trusting the client-supplied parameter.
   • DEncode the response data with HTML entities before returning it.
   Reveal Solution Discussion Select an answer first
6. 35application · medium · select all that apply

   A web application allows users to submit comments that are stored and later displayed to other users via AJAX. The development team wants to implement client-side security controls to mitigate XSS. Which of the following are effective client-side controls? Select all that apply.

   • AUse `eval()` to parse the JSON response and render it.
   • BImplement a Content Security Policy with `script-src 'self'`.
   • CSanitize the comment text on the client using a well-maintained library before insertion.
   • DUse `textContent` instead of `innerHTML` when rendering comments.
   • ESet the `HttpOnly` flag on the session cookie.
   Check answers Discussion Select an answer first