File Upload, Response Readiness, Proactive Defense GWEB Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A web application stores uploaded resumes in a directory under the web root. A security audit recommends storing files outside the web root. What is the PRIMARY security benefit of this change?

   • AIt ensures that uploaded files are automatically scanned for malware.
   • BIt prevents direct HTTP access to the uploaded files, reducing the risk of file-based exploits.
   • CIt prevents users from uploading files with dangerous extensions.
   • DIt allows the application to use randomized filenames more easily.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A web application allows users to upload profile images. The current validation checks the file extension against a whitelist (.jpg, .png, .gif) and verifies the MIME type from the Content-Type header. A penetration test revealed that an attacker can upload a file with a .jpg extension that contains PHP code and execute it by requesting the file directly. The application stores uploads in the web root under /uploads. Which combination of changes would most effectively mitigate this vulnerability?

   • AAdd a check that rejects files whose MIME type does not match the extension, and rename the file to a random string with the original extension.
   • BUse a WAF rule to block requests to /uploads that contain PHP code in the body, and require users to re-authenticate before uploading.
   • CChange the upload directory permissions to read-only and set the file system to deny execution for all users except the application pool.
   • DStore uploads outside the web root, serve them through a handler that forces the correct Content-Type, and disable script execution in the upload directory.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A web application allows users to upload files that are then shared with other users. The application currently stores files in the web root with original filenames and performs no content inspection. A security consultant recommends a defense-in-depth approach. Which combination of controls would provide the STRONGEST protection against file-based attacks?

   • AStore files outside the web root, use randomized filenames, validate file content against a whitelist of allowed types, and serve files through a script that sets Content-Disposition: attachment.
   • BPerform client-side validation only and store files in the web root.
   • CStore files in the web root but with a .txt extension and rely on the web server to not execute them.
   • DUse a WAF to block malicious uploads and keep the current storage method.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of centralized logging in a web application environment?

   • ATo make it easier to analyze and correlate events from multiple sources
   • BTo prevent attackers from modifying logs
   • CTo automatically block malicious IP addresses
   • DTo reduce the storage space required for logs
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A document management system accepts PDF and DOCX files. Developers implemented validation by checking the file extension and the MIME type from the Content-Type header. A security review found that attackers can upload a file with a .pdf extension but containing HTML/JavaScript, which is then served to other users. The application stores files in a database and serves them via a download endpoint. Which additional control would best address this issue?

   • AInspect the file content to verify the actual file signature (magic bytes) and reject files that do not match the expected format.
   • BUse a WAF rule to block requests that contain HTML tags in the file upload body.
   • CAdd a Content-Disposition: attachment header when serving files to force download instead of inline rendering.
   • DStore files with a random name and use a separate endpoint that requires authentication to access them.
   Reveal Solution Discussion Select an answer first