File Upload, Response Readiness, Proactive Defense GWEB Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is a recommended practice for securely storing uploaded files on a web server?

   • AStore files in a database as BLOBs with no filename
   • BStore files outside the web root and use randomized filenames
   • CStore files in a temporary directory and delete them after a short time
   • DStore files in the web root with their original filenames
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security team is tuning a WAF for a web application that allows users to submit comments containing HTML. The WAF currently blocks any request containing '<script>'. Users are complaining that legitimate comments with code examples are being blocked. The team needs to reduce false positives without weakening security. Which approach is BEST?

   • AIncrease the WAF's sensitivity to catch more attacks, accepting that some legitimate requests will be blocked.
   • BChange the WAF rule to inspect the context of the '<script>' string and only block when it appears in a dangerous context, such as within a form submission that is not expected to contain HTML.
   • CBlock all requests containing any HTML tags to prevent XSS.
   • DRemove the '<script>' rule entirely and rely on output encoding in the application.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   During a forensic investigation of a web application breach, an analyst copies log files from the compromised server to a forensic workstation. Which practice is ESSENTIAL to maintain the chain of custody?

   • ADocument who collected the evidence, when, and how, and store the evidence in a secure location with restricted access.
   • BDelete any logs that are not directly related to the attack to reduce noise.
   • CShare the logs with all team members to speed up the investigation.
   • DUse the original server to analyze the logs to avoid copying errors.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A web application allows users to upload images. The current validation checks the file extension against a whitelist (.jpg, .png, .gif) and the MIME type from the Content-Type header. A tester successfully uploaded a file named 'evil.jpg' with Content-Type image/jpeg, but the file contains PHP code. Which additional validation would MOST reliably detect this?

   • ACheck the file size and reject any file larger than 2 MB.
   • BInspect the file's magic bytes (magic number) and verify they match the allowed image types.
   • CUse a client-side JavaScript check to verify the file extension.
   • DStore the file with a .txt extension instead of the original extension.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company's web application was compromised via a file upload vulnerability. The incident response team needs to contain the incident while preserving evidence for forensic analysis. Which action should be taken FIRST?

   • ADelete all uploaded files from the server to remove the malicious content.
   • BIsolate the affected server from the network while preserving the current state of logs and memory.
   • CRebuild the server from a known-good image to restore service quickly.
   • DNotify law enforcement immediately before taking any other action.
   Reveal Solution Discussion Select an answer first