File Upload, Response Readiness, Proactive Defense GWEB Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A web application was breached via a file upload vulnerability. The incident response team has isolated the server and collected forensic images. The CEO wants to restore service as quickly as possible, but the legal team insists on preserving evidence for potential litigation. Which action BEST balances these competing requirements?

   • ABring the original server back online immediately after removing the malicious files.
   • BWait for the forensic analysis to complete before restoring any service.
   • CRestore the application from a known-good backup onto a new server, while keeping the original server offline and preserved for forensic analysis.
   • DCopy the forensic images to a secure location and then rebuild the original server from scratch.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A development team is building a new web application and wants to integrate proactive security measures early in the SDLC. Which approach BEST aligns with proactive defense?

   • ARely on the hosting provider's default security settings.
   • BPerform a penetration test only after the application is fully deployed.
   • CConduct threat modeling during the design phase to identify potential attack vectors and apply security controls accordingly.
   • DDeploy a WAF after the application is in production to filter malicious traffic.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security analyst is reviewing logs after a suspected file upload attack. The logs show multiple failed upload attempts with filenames like 'test.php.jpg' and 'shell.php%00.jpg'. The analyst needs to determine if any attack succeeded. Which log data would be MOST useful?

   • AThe user-agent string of the client.
   • BThe IP address of the attacker.
   • CThe result of the server-side validation checks for each upload attempt, including whether the file was accepted or rejected.
   • DThe size of each uploaded file.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following best describes a polyglot file in the context of file upload attacks?

   • AA file that contains multiple malicious payloads, each targeting a different vulnerability
   • BA file that has been compressed and then encrypted to evade detection
   • CA file with an extension that has been changed to hide its true type
   • DA file that is valid in multiple formats, such as a GIF that also contains PHP code
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A web application team wants to improve its ability to detect and respond to attacks. They plan to implement comprehensive logging and monitoring. Which logging practice is most effective for detecting file upload attacks?

   • ALog only the IP address and timestamp of each upload request.
   • BLog only successful uploads to reduce log volume and storage costs.
   • CLog the filename, file size, MIME type, user ID, IP address, and the result of validation checks for every upload attempt.
   • DLog the full content of every uploaded file for later analysis.
   Reveal Solution Discussion Select an answer first