AJAX Technologies and Security Strategies GWEB Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security analyst is setting up logging for an AJAX endpoint that handles password changes. The endpoint accepts the current password, new password, and a CSRF token. Which logging practice is most appropriate?

   • ALog only the CSRF token to verify its validity.
   • BLog the user ID, timestamp, IP address, and the success/failure status, but never log the password values.
   • CLog the full request body including the new password for forensic analysis.
   • DLog the current password to detect brute-force attempts.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A web application uses AJAX to submit a login form. The developer wants to protect the credentials from being exposed in browser history and from being logged by proxy servers. Which approach is MOST appropriate?

   • AUse HTTP Basic Authentication over HTTPS.
   • BSend the credentials as query parameters in a GET request over HTTPS.
   • CEncode the credentials in Base64 and put them in the URL fragment.
   • DSend the credentials in the POST body over HTTPS instead of in the URL query string.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A mobile web application uses AJAX to send user credentials to a login endpoint. The application is served over HTTPS, but the login endpoint is also accessible over HTTP due to a misconfiguration. Which control should be implemented to ensure credentials are never transmitted in plaintext?

   • AUse a CSRF token in the login form.
   • BAdd a `Referrer-Policy: no-referrer` header to all responses.
   • CSet the `Secure` flag on the session cookie.
   • DImplement HTTP Strict Transport Security (HSTS) with `max-age` and `includeSubDomains`.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which control should be applied to an AJAX endpoint to ensure that only authenticated users can access it?

   • AInput length limit
   • BAuthentication check
   • COutput encoding
   • DRate limiting
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which technology is the traditional JavaScript API used to make asynchronous HTTP requests from a web browser without reloading the page?

   • AXMLHttpRequest
   • BDocument Object Model (DOM)
   • CServer-Sent Events
   • DWebSocket
   Reveal Solution Discussion Select an answer first