File Upload, Response Readiness, Proactive Defense GWEB Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A web application allows users to upload images for avatars. The server-side validation checks the file extension against a whitelist and verifies the MIME type from the Content-Type header. The application also re-encodes images using a library that is known to be vulnerable to decompression bombs. An attacker uploads a small PNG file that, when decompressed, expands to a huge image, causing memory exhaustion. Which defense would be most effective in preventing this attack?

   • ASet limits on the decompressed image dimensions and memory usage during re-encoding, and reject files that exceed these limits.
   • BStore uploaded files outside the web root and serve them with a random filename.
   • CUse a WAF rule to block requests that contain a large amount of compressed data.
   • DBlock uploads with a Content-Type header that does not match the file extension.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a server-side file upload validation technique that checks the actual content of the file rather than just its metadata?

   • AContent inspection
   • BMIME type checking
   • CFile extension whitelisting
   • DClient-side JavaScript validation
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which security header helps protect against cross-site scripting (XSS) attacks by controlling how the browser renders content?

   • AX-Frame-Options
   • BStrict-Transport-Security (HSTS)
   • CContent-Security-Policy (CSP)
   • DReferrer-Policy
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A document management system accepts PDF uploads. A user uploads a file that passes the extension check (.pdf) and the MIME type check (application/pdf), but when another user downloads it, the file is actually an HTML page containing JavaScript that steals session cookies. Which upload attack vector is being exploited?

   • ADouble extension attack
   • BContent-type spoofing
   • CNull byte injection
   • DPolyglot file
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is a critical piece of information that should be logged for every web application request to enable security monitoring?

   • AThe user's browser history
   • BThe user's social security number
   • CThe user's physical location
   • DThe user's IP address and timestamp
   Reveal Solution Discussion Select an answer first