Modern Application Framework Issues and Serialization GWEB Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A development team is building a microservice that receives serialized data from multiple internal services. The data is in a custom binary format that is deserialized using a third-party library. The team wants to prevent deserialization attacks without changing the data format. Which control should they implement?

   • ASet a short timeout on the deserialization call to prevent denial of service.
   • BUse a network firewall to restrict access to the microservice.
   • CAdd a cryptographic signature to the serialized data and verify it before deserialization.
   • DLog all deserialization attempts and review them periodically.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is an effective mitigation against insecure deserialization?

   • AUsing a block-list of known malicious classes
   • BEncrypting serialized data with a symmetric key
   • CUsing an allow-list of classes that are permitted to be deserialized
   • DEncoding all serialized data with base64 before transmission
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is a recommended practice to prevent deserialization attacks when an application must accept serialized data?

   • AValidate the serialized data against a strict schema before deserialization
   • BUse a serialization format that only supports data, not objects, such as JSON
   • CDeserialize the data in a sandboxed environment with restricted permissions
   • DLog all deserialization attempts for later analysis
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A team is migrating a legacy Java application that deserializes data from a trusted internal service. They want to maintain compatibility but reduce the risk of insecure deserialization. Which approach is the best balance?

   • ABase64-encode the serialized data and store it in a database
   • BAdd a digital signature to the serialized data and verify it before deserialization
   • CImplement an ObjectInputFilter that allows only the known classes used by the internal service
   • DSwitch to XML serialization without any validation
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is an example of a modern framework vulnerability caused by insecure defaults?

   • AA framework that automatically rotates session identifiers after login
   • BA framework that enables debug mode in production, exposing stack traces and configuration details
   • CA framework that uses a well-known encryption algorithm like AES for session data
   • DA framework that requires developers to explicitly enable HTTPS in production
   Reveal Solution Discussion Select an answer first