Leading Edge Technologies and Web Security GWEB Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company is considering using a Content Delivery Network (CDN) with edge computing capabilities to serve dynamic content. The security team is assessing the implications. Which of the following is the most important security consideration?

   • AThe CDN's edge nodes are managed by the provider, so the security team does not need to worry about the security of the edge infrastructure.
   • BThe edge computing code runs on the CDN's infrastructure, so the security team must test the code for vulnerabilities and ensure that it does not expose sensitive data.
   • CThe CDN automatically encrypts all traffic between the edge and the origin, so the security team does not need to configure TLS.
   • DThe CDN edge nodes are outside the corporate network, so the security team must ensure that the origin server is not directly accessible from the internet.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security tester is assessing a web application that uses a Single Page Application (SPA) framework like React or Angular. The tester wants to identify client-side security issues. Which of the following is the most effective testing technique?

   • AIntercept and modify the API requests and responses to test for authorization flaws and data exposure.
   • BReview the SPA's build configuration to ensure that source maps are not exposed in production.
   • CRun an automated scanner that crawls the SPA and tests for common vulnerabilities like XSS and CSRF.
   • DUse a browser's developer tools to inspect the JavaScript code and look for hardcoded secrets or insecure API calls.
   Reveal Solution Discussion Select an answer first
4. 8expert · medium

   A security tester is assessing a web application that uses a microservices architecture with a service mesh. The tester wants to identify potential security issues. Which of the following is the most effective testing technique?

   • AFocus on the service mesh, as it is the new technology and is more likely to have vulnerabilities.
   • BTest the microservices for common vulnerabilities like SQL injection and XSS, and test the service mesh for misconfigurations.
   • CUse an automated scanner that supports microservices and service mesh testing.
   • DTest the service mesh configuration for misconfigurations, such as overly permissive mTLS policies or insecure authorization rules.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is planning to use a content delivery network (CDN) to serve static assets and also to provide DDoS protection for its web application. The security team is evaluating the implications. Which consideration is most important?

   • AThe CDN can cache sensitive data if not configured properly, so you must ensure that cache-control headers are set correctly.
   • BThe CDN will automatically encrypt all traffic between the client and the origin server.
   • CThe CDN will prevent all application-layer attacks, such as SQL injection.
   • DThe CDN will hide the origin server's IP address from attackers.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A development team is adopting a microservices architecture where each service is deployed as a container in a Kubernetes cluster. The services communicate over HTTP using JSON. The security team needs to ensure that inter-service communication is protected from eavesdropping and tampering. Which control should be implemented?

   • AEnable TLS for all inter-service communication using a service mesh with mutual TLS.
   • BUse network policies to restrict traffic between services, but allow plain HTTP since the cluster is private.
   • CUse a VPN between all pods to encrypt traffic.
   • DImplement API keys in the HTTP headers of each request to authenticate services.
   Reveal Solution Discussion Select an answer first