Security Testing GWEB Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A penetration tester is testing a web application that uses JSON Web Tokens (JWTs) for authentication. The tester notices that the server does not validate the 'alg' header and accepts 'none' as an algorithm. What is the most direct way to exploit this misconfiguration?

   • ABrute-force the JWT secret by trying common passwords.
   • BIntercept a valid token and replay it to a different endpoint.
   • CModify the token's expiration time to extend the session.
   • DForge a token with the 'alg' set to 'none' and an arbitrary payload to gain access as another user.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A vulnerability scan of a web application reports a 'High' severity SQL injection finding in a search parameter. The development team claims the parameter is properly parameterized. What is the most appropriate next step?

   • ARe-run the scan with a different tool to see if it also reports the issue.
   • BIgnore the finding because the developers confirmed the code is safe.
   • CImmediately patch the code to add additional input validation.
   • DManually verify the finding by sending crafted payloads to the search parameter and observing the response.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security team is planning a penetration test for a healthcare web application that stores patient records. The test must comply with HIPAA and must not cause any data loss or service interruption. Which constraint is MOST important to include in the rules of engagement?

   • AThe testers must avoid any action that could alter, delete, or expose protected health information (PHI).
   • BThe testers may use any exploit technique as long as they do not exfiltrate actual patient data.
   • CThe testers must report all findings within 24 hours regardless of severity.
   • DThe testers must use only automated tools to minimize human error.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A security analyst is running a vulnerability scan against a web application that uses a Web Application Firewall (WAF). The scan reports a high number of 'blocked' responses and few findings. The analyst suspects the WAF is interfering with the scan. What is the best way to get accurate scan results?

   • ATemporarily place the WAF in detection mode or whitelist the scanner's IP address, with approval.
   • BIgnore the scan results and rely on manual testing only.
   • CRun the scan from a different IP address to avoid the WAF's IP-based blocking.
   • DIncrease the scan intensity to overwhelm the WAF.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   When interpreting the results of a vulnerability scan, what does a 'false positive' mean?

   • AThe scanner missed a real vulnerability
   • BThe vulnerability is exploitable but not present
   • CThe scanner reported a vulnerability that does not actually exist
   • DThe vulnerability is present but not exploitable
   Reveal Solution Discussion Select an answer first