Modern Application Framework Issues and Serialization GWEB Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security architect is evaluating a new web framework that uses a default configuration to automatically deserialize JSON request bodies into model objects. The framework also provides a global filter that can be configured to restrict types. The team is concerned about performance and wants to minimize configuration overhead. What is the best approach?

   • AUse a block-list of dangerous types and apply it only to endpoints that accept user input
   • BEnable the global filter with a strict allow-list of model types and apply it to all deserialization endpoints
   • CRely on the framework's default configuration because it is widely used
   • DDisable automatic deserialization and manually parse JSON in each endpoint
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A penetration tester is assessing a Java application that uses a custom deserialization filter. The filter blocks all classes except those in the application's own package. The tester finds a class in that package that has a readObject() method that performs a file operation based on a field in the serialized data. What is the most likely impact?

   • AThe attack will fail because the filter also checks the method signatures
   • BThe filter is bypassed because the class is allowed, and the attacker can trigger the file operation
   • CThe filter prevents the attack because the class is in the application's package
   • DThe attack will only work if the attacker can also bypass the filter for other classes
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   When evaluating a framework's security posture regarding serialization, which factor is most important to consider?

   • AWhether the framework automatically compresses serialized data
   • BWhether the framework provides built-in mechanisms to restrict deserialization to safe types
   • CWhether the framework uses a popular programming language
   • DWhether the framework supports both XML and JSON serialization
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A .NET application deserializes JSON data from an external API to populate a configuration object. The team wants to prevent deserialization attacks without changing the data format. Which approach is most effective?

   • AUse a JavaScriptSerializer with a hardcoded type resolver
   • BStore the JSON in a database before deserializing it
   • CUse a custom JsonConverter that validates each property type against an allow-list
   • DDisable the API's HTTPS certificate validation to speed up the connection
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company is choosing between two web frameworks for a new application. Framework A has a built-in deserialization allow-list feature but requires manual configuration. Framework B has no built-in protection but is easier to use. The application will handle untrusted user input. What should the security team recommend?

   • AChoose Framework B because it is easier to use and less likely to have configuration errors
   • BChoose Framework A and configure the allow-list for all deserialization endpoints
   • CChoose Framework A but disable the allow-list feature to improve performance
   • DChoose Framework B and rely on network segmentation to protect the application
   Reveal Solution Discussion Select an answer first