Security Testing GWEB Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A development team is building a new online payment portal. The security lead wants to identify threats early in the SDLC. The team draws a data flow diagram showing the user's browser, the web server, the application server, and the payment gateway. They then use STRIDE to categorize potential threats. Which threat category is most directly associated with an attacker modifying the amount of a transaction in transit?

   • AInformation Disclosure
   • BSpoofing
   • CTampering
   • DRepudiation
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst is using an automated vulnerability scanner on a web application. The scanner reports a cross-site scripting (XSS) vulnerability in a search field. The analyst reviews the raw HTTP request and response and sees that the input is reflected in the response without encoding. What should the analyst do to confirm the finding?

   • ARe-run the scanner with a higher intensity setting to see if the result changes.
   • BIgnore the finding because reflected XSS is not a serious risk.
   • CManually craft a request with a benign XSS payload and observe whether it executes in a browser.
   • DAccept the scanner result as valid because the scanner is trusted.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A penetration tester is testing a web application that uses a microservices architecture. The tester has found a vulnerability in one service that allows an attacker to access another service's internal API. The rules of engagement allow testing all services. What is the most important consideration when reporting this finding?

   • AThe specific version of the compromised service's software.
   • BThe severity of the vulnerability in the compromised service.
   • CThe fact that the vulnerability enables lateral movement between services, increasing the overall impact.
   • DThe time it took to exploit the vulnerability.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which element is essential for defining the success criteria of a security test?

   • AThe names of the security testers involved
   • BThe version of the web server software
   • CThe list of all known vulnerabilities in the application
   • DA clear statement of what constitutes a successful outcome
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A vulnerability scan of a web application reports a large number of 'medium' severity findings. The security analyst reviews the findings and notices that many are due to outdated JavaScript libraries that are not actually used by the application. What should the analyst do?

   • AManually verify which libraries are actually loaded and used, then remove false positives from the report.
   • BReport all findings as-is because the scanner is authoritative.
   • CIgnore the scan results because medium findings are not important.
   • DAsk the development team to update all libraries regardless of usage.
   Reveal Solution Discussion Select an answer first