Leading Edge Technologies and Web Security GWEB Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is a primary security implication of adopting a microservices architecture in a web application?

   • AAuthentication is no longer needed because services communicate internally
   • BThe attack surface expands because each service exposes its own API and data store
   • CThe use of containers eliminates the need for network segmentation
   • DThe application becomes immune to injection attacks because services are isolated
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which technology is commonly used to implement a 'single-page application' (SPA) architecture?

   • AJavaScript frameworks that dynamically update the DOM without full page reloads
   • BProgressive web apps that require service workers for offline functionality
   • CWebAssembly modules that run compiled code in the browser
   • DServer-side rendering frameworks like PHP with embedded templates
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A development team is building a web application that uses WebAssembly (Wasm) modules for client-side computation. The security team is planning the testing strategy. Which of the following is the most important consideration when testing this application?

   • ABecause Wasm is a binary format, traditional web application testing tools like intercepting proxies cannot be used, so the team must rely on static analysis only.
   • BThe security team should test the Wasm module's input handling and the interfaces between JavaScript and Wasm, as these are common sources of vulnerabilities.
   • CWasm modules are compiled from a source language, so the security team should focus on testing the source code and the build pipeline, not the compiled binary.
   • DWasm runs in a sandbox, so the security team can assume that the module cannot access the DOM or make network requests.
   Reveal Solution Discussion Select an answer first
5. 4expert · medium

   A security tester is assessing a web application that uses a combination of serverless functions and a traditional web server. The tester wants to identify potential security issues. Which of the following is the most effective testing approach?

   • AUse an automated scanner that supports both serverless and traditional web testing.
   • BTest the serverless functions for event injection and the web server for common vulnerabilities like SQL injection and XSS.
   • CFocus on the serverless functions, as they are the new technology and are more likely to have vulnerabilities.
   • DTest the application's authentication and authorization mechanisms, as they are the most critical.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is adopting a zero-trust architecture for its web application. The security team is planning the implementation. Which of the following is the most important security consideration?

   • AThe security team should implement a single sign-on (SSO) solution to reduce the number of passwords users need to remember.
   • BAll traffic, including internal traffic, must be encrypted and authenticated, and access decisions must be made based on the identity of the user and device.
   • CThe security team should focus on perimeter defenses, such as firewalls and VPNs, to protect the network boundary.
   • DThe security team should deploy a Web Application Firewall (WAF) to protect the application from external attacks.
   Reveal Solution Discussion Select an answer first