File Upload, Response Readiness, Proactive Defense GWEB Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   During a forensic investigation, an analyst discovers that the web server logs were rotated and overwritten, losing critical evidence. The team wants to prevent this in the future. Which combination of measures is MOST effective?

   • ADisable log rotation entirely to keep all logs indefinitely.
   • BCentralize log collection to a remote, immutable storage system with proper access controls and retention policies.
   • CIncrease the log rotation frequency to keep logs smaller and easier to manage.
   • DStore logs only on the local server to avoid network transmission issues.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team is configuring a WAF for a web application that allows file uploads. They want to block malicious file uploads while minimizing false positives for legitimate users. Which WAF rule configuration is most appropriate?

   • AInspect the file content for known malicious signatures and block requests that match, while allowing common image and document types.
   • BBlock any request that contains the string 'php' in the filename.
   • CRate-limit all upload requests to a low threshold to slow down attackers.
   • DBlock all requests with a Content-Type header that is not in a strict whitelist of image types.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company runs a web application on a Linux server with a third-party content management system (CMS). A critical vulnerability is announced for the CMS, and the vendor releases a patch. The company has a change management policy that requires testing before production deployment. What is the most appropriate action?

   • AWait for the next scheduled maintenance window, which is three months away, to apply the patch.
   • BApply the patch to a staging environment, run regression tests, and then deploy to production within the change window.
   • CImplement a WAF rule to mitigate the vulnerability and skip the patch entirely.
   • DImmediately apply the patch to production to minimize the exposure window, then test afterward.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A web application allows users to upload images. The server-side validation checks the file extension against a whitelist and verifies the MIME type from the Content-Type header. The application also re-encodes images using a library that is known to be vulnerable to decompression bombs. An attacker uploads a small PNG file that, when decompressed, expands to a huge image, causing memory exhaustion. Which defense would be most effective in preventing this attack?

   • ASet limits on the decompressed image dimensions and memory usage during re-encoding, and reject files that exceed these limits.
   • BBlock uploads with a Content-Type header that does not match the file extension.
   • CStore uploaded files outside the web root and serve them with a random filename.
   • DUse a WAF rule to block requests that contain a large amount of compressed data.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is a proactive defense measure that helps identify potential security weaknesses before they are exploited?

   • ALog analysis
   • BIncident response
   • CThreat modeling
   • DPatch management
   Reveal Solution Discussion Select an answer first