Leading Edge Technologies and Web Security GWEB Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security tester is assessing a web application that uses a micro frontend architecture. The tester wants to test for cross-origin issues. Which approach is most effective?

   • ATest only the main application shell for vulnerabilities, since the micro frontends are isolated.
   • BTest the micro frontends using a standard web scanner without considering the composition.
   • CTest each micro frontend individually for XSS and CSRF, and also test the communication between them for origin validation.
   • DTest only the iframe boundaries, since they are the only source of cross-origin issues.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security tester is assessing a web application that uses GraphQL and has a strict rate-limiting policy. The tester wants to test for denial-of-service via complex queries. Which approach is most effective while avoiding rate-limiting?

   • ATest for SQL injection in the GraphQL queries.
   • BSend many simple queries in a short time to overwhelm the server.
   • CUse a tool to automatically generate queries from the schema and send them sequentially.
   • DSend a single complex query that requests deeply nested fields to exceed the query depth limit.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security tester is assessing a web application that uses a message queue (e.g., RabbitMQ) for asynchronous processing of user uploads. Which test is most important?

   • ATest for SQL injection in the message broker's management interface.
   • BTest for XSS in the message queue's web console.
   • CTest for insecure deserialization in the message payloads.
   • DTest for CSRF in the message queue's API.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company is planning to use a blockchain-based identity management system for its web application. The security team is evaluating the security implications. Which of the following is the most important security consideration?

   • AThe private keys used for identity management are stored on the user's device, so the security team must ensure that the application does not expose these keys to other users.
   • BThe security team must test the smart contracts that manage identity for vulnerabilities, as they are the core of the identity management system.
   • CThe blockchain is immutable, so once a user's identity is recorded, it cannot be changed, which may conflict with data privacy regulations like GDPR.
   • DThe blockchain is decentralized, so the security team does not need to worry about a single point of failure.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security tester is evaluating a web application that uses a NoSQL database (e.g., MongoDB) for storing user data. Which injection test is most important?

   • ATest for NoSQL injection by sending JSON payloads with operators like $gt and $ne in query parameters.
   • BTest for LDAP injection by sending LDAP-specific payloads.
   • CTest for SQL injection by sending classic SQL payloads like ' OR 1=1 --.
   • DTest for command injection by sending shell commands in the query parameters.
   Reveal Solution Discussion Select an answer first