Web Architecture and Configuration GWEB Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   What is the purpose of an ORM (Object-Relational Mapping) library in a web application?

   • ATo manage user sessions
   • BTo handle HTTP requests
   • CTo render HTML templates
   • DTo convert database rows into objects in the application code
   Reveal Solution Discussion Select an answer first
2. 47expert · medium

   A web application uses a token-based authentication mechanism where the token is stored in a JavaScript variable and sent in the Authorization header. The application also uses a Content Security Policy (CSP) that allows scripts from any source. Which attack is the most likely to compromise the token?

   • ASQL injection that extracts the token from the database
   • BCross-site request forgery (CSRF) that uses the token
   • CMan-in-the-middle attack that intercepts the token over HTTP
   • DCross-site scripting (XSS) that reads the token from JavaScript
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A company hosts multiple web applications on a single Apache web server using name-based virtual hosting. The security team wants to ensure that requests without a valid Host header do not reach any application. Which configuration change best achieves this?

   • AUse a rewrite rule to redirect all requests to the first virtual host
   • BEnable the mod_evasive module to block repeated requests from the same IP
   • CConfigure a default virtual host that returns a 444 No Response status
   • DSet the ServerTokens directive to Prod to hide server version information
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which of the following is a stateless token-based authentication mechanism often used in modern web APIs?

   • AURL rewriting
   • BHTTP Basic Authentication
   • CServer-side session cookie
   • DJWT (JSON Web Token)
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   An administrator is configuring a web server to host multiple websites on a single IP address. Each site needs its own TLS certificate. What is the most appropriate method to achieve this?

   • AUse Server Name Indication (SNI) to select the correct certificate based on the requested hostname.
   • BConfigure each site on a different port.
   • CUse IP-based virtual hosting with multiple IP addresses.
   • DUse a single wildcard certificate for all sites.
   Reveal Solution Discussion Select an answer first