Leading Edge Technologies and Web Security GWEB Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company is deploying a web application that uses a blockchain-based identity system for user authentication. The security team is assessing the risks. Which concern is most relevant?

   • AThe blockchain network is decentralized, so there is no central authority to revoke compromised identities.
   • BThe private keys used for identity are stored on the client side and can be stolen by malware or phishing.
   • CThe blockchain uses consensus algorithms that are vulnerable to 51% attacks.
   • DThe blockchain is immutable, so all transactions are public and cannot be deleted.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company is building a single-page application (SPA) that uses WebSockets for real-time notifications. The security team is performing a penetration test. Which test is essential for WebSocket endpoints?

   • ATest for HTTP request smuggling by sending malformed WebSocket frames.
   • BTest for SQL injection in the WebSocket message payloads.
   • CTest for TLS configuration on the WebSocket endpoint.
   • DTest for cross-site WebSocket hijacking by checking if the server validates the Origin header during the handshake.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is adopting a micro frontend architecture where multiple teams develop and deploy independent frontend modules that are composed into a single page. The security team is assessing the risks. Which security concern is most relevant?

   • AThe main concern is that micro frontends cannot use HTTPS.
   • BEach micro frontend may have its own security controls, leading to inconsistent authentication and authorization enforcement.
   • CMicro frontends are always more secure than monolithic applications because they are smaller.
   • DThe use of iframes to compose micro frontends automatically prevents cross-origin attacks.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company is migrating its web application to a containerized environment using Docker and Kubernetes. The security team must choose between using a service mesh with mutual TLS and implementing network policies only. The application handles sensitive customer data and must comply with data protection regulations. Which approach is the best security decision?

   • AImplement a service mesh with mutual TLS to encrypt inter-service communication and provide identity-based access control.
   • BUse a VPN between all pods to encrypt traffic.
   • CImplement network policies to restrict traffic between services, but allow plain HTTP since the cluster is private.
   • DRely on the container runtime's built-in encryption.
   Reveal Solution Discussion Select an answer first
6. 20expert · medium

   A security tester is assessing a web application that uses a blockchain-based identity management system. The tester wants to identify potential security issues. Which of the following is the most effective testing technique?

   • ATest the application code that interacts with the blockchain, as well as the smart contracts themselves.
   • BTest the smart contracts for vulnerabilities like reentrancy and integer overflow.
   • CUse an automated scanner that supports blockchain testing.
   • DFocus on the smart contracts, as they are the core of the identity management system.
   Reveal Solution Discussion Select an answer first