Leading Edge Technologies and Web Security GWEB Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is planning to adopt a service mesh (e.g., Istio) for its microservices-based web application. The security team is evaluating the security implications. Which of the following is the most important security benefit that a service mesh provides?

   • AIt provides observability features like distributed tracing and metrics, which can help detect and diagnose security incidents.
   • BIt automatically encrypts all traffic between services using mutual TLS, without requiring changes to application code.
   • CIt replaces the need for a Web Application Firewall (WAF) at the edge, because it can filter all incoming HTTP requests.
   • DIt provides a centralized policy enforcement point for authentication and authorization between services, reducing the risk of insecure direct object references.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company is deploying a new customer-facing web application that uses GraphQL to aggregate data from multiple internal microservices. The security team must test the API for vulnerabilities before production release. Which testing approach is most appropriate for this GraphQL-based application?

   • ATest the underlying microservices individually with traditional REST scanners and skip the GraphQL layer, since the API gateway handles security.
   • BRun a standard REST API scanner against the /graphql endpoint using a predefined wordlist of common REST paths.
   • CPerform only static analysis of the GraphQL schema files to identify exposed fields, since runtime testing is not possible with GraphQL.
   • DUse a GraphQL-aware testing tool to enumerate the schema, craft queries that request nested or sensitive fields, and test for authorization and rate-limiting gaps.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is migrating its customer-facing web application to a serverless architecture using AWS Lambda and API Gateway. The security team is concerned about the new attack surface introduced by this change. Which of the following is the most important security consideration when testing this serverless application?

   • AThe API Gateway acts as a traditional network firewall, so the security team can rely on it to block all malicious requests before they reach the function.
   • BThe function code is executed in a shared, multi-tenant runtime environment, so the security team must verify that the function does not expose sensitive data through logs or error messages.
   • CThe function's event-triggered execution model means that the security team must test the function's input validation and authorization logic for every possible event source, not just HTTP requests.
   • DBecause the function runs in a managed environment, the security team does not need to perform any vulnerability scanning on the function's dependencies.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security tester is evaluating a web application that uses JSON Web Tokens (JWT) for session management. Which test is most important to perform?

   • ATest whether the token is stored in local storage or session storage.
   • BTest whether the server accepts tokens with the 'none' algorithm.
   • CTest whether the token expires after a reasonable time.
   • DTest whether the token is sent over HTTPS.
   Reveal Solution Discussion Select an answer first
6. 15expert · medium

   A security tester is assessing a web application that uses a combination of WebSockets and REST APIs. The tester wants to identify potential security issues. Which of the following is the most effective testing approach?

   • AUse an automated scanner that supports both REST and WebSocket testing.
   • BTest the application's authentication and authorization mechanisms, as they are the most critical.
   • CTest the REST APIs for common vulnerabilities like SQL injection and XSS, and test the WebSocket endpoints for origin validation and message-level authorization.
   • DFocus on the WebSocket endpoints, as they are newer and more likely to have vulnerabilities.
   Reveal Solution Discussion Select an answer first