Leading Edge Technologies and Web Security GWEB Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security tester is assessing a web application that uses a JavaScript framework (e.g., React) on the client side and a REST API on the server. The tester wants to identify client-side security issues. Which technique is most effective?

   • ATest the application with a web application firewall (WAF) enabled to see if it blocks attacks.
   • BUse a browser's developer tools to inspect the DOM and network traffic, and manually test for DOM-based XSS.
   • CRun a vulnerability scanner against the server-side API only.
   • DPerform a static analysis of the JavaScript code using a SAST tool.
   Reveal Solution Discussion Select an answer first
2. 22expert · medium

   A company is planning to use a service mesh for its microservices-based web application. The security team is evaluating the security implications. Which of the following is the most important security consideration?

   • AThe service mesh can introduce new attack surfaces, such as the control plane and the sidecar proxies, so the security team must secure these components.
   • BThe service mesh is a managed service, so the security team does not need to worry about its security.
   • CThe service mesh provides a centralized policy enforcement point, so the security team does not need to implement authorization in the application code.
   • DThe service mesh provides mutual TLS, so the security team does not need to worry about encrypting traffic between services.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is a security concern specific to using a GraphQL API in a web application?

   • AClients can request deeply nested queries that may cause denial-of-service
   • BGraphQL automatically encrypts all data in transit, eliminating the need for TLS
   • CGraphQL only allows GET requests, making it vulnerable to CSRF
   • DGraphQL does not support authentication, so all endpoints are public
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which technique is essential when security testing a web application that relies heavily on client-side JavaScript frameworks?

   • ATesting only the initial HTML response because all logic is server-side
   • BAnalyzing the JavaScript bundle to identify API endpoints and client-side logic flaws
   • CDisabling JavaScript to test the server-side rendering only
   • DUsing only automated scanners because manual analysis is not effective for SPAs
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which technology is most directly associated with the concept of 'serverless' computing in modern web applications?

   • AFunction-as-a-Service (FaaS) platforms that execute code in response to events
   • BContainer orchestration platforms that manage clusters of virtual machines
   • CContent delivery networks that cache static assets at edge locations
   • DVirtual private servers that provide dedicated CPU and memory resources
   Reveal Solution Discussion Select an answer first