Web Architecture and Configuration GWEB Practice Questions (Page 11)

Questions 51–55

1. 51foundation · easy

   Which client-side technology is responsible for controlling the visual presentation, such as colors, fonts, and layout?

   • AJavaScript
   • BCSS
   • CPHP
   • DHTML
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A web application uses JSON Web Tokens (JWT) for authentication. After a security review, the team wants to ensure that tokens cannot be tampered with. What is the most important configuration to enforce?

   • AVerify the token's signature using a strong, secret key on the server.
   • BUse a long, random token string instead of a JWT.
   • CStore the token in a cookie with the HttpOnly attribute.
   • DSet a short expiration time on the token.
   Reveal Solution Discussion Select an answer first
4. 53expert · hard

   A development team is building a web application using a server-side framework that renders HTML templates. They need to allow users to submit comments that will be displayed to other users. What is the most secure way to handle user-generated content to prevent stored XSS?

   • AStore the input as-is and rely on a Content Security Policy (CSP) to block scripts.
   • BUse a client-side JavaScript library to escape the content before displaying it.
   • CEncode the user input when rendering it in the HTML template using the framework's auto-escaping feature.
   • DSanitize the input by removing all HTML tags before storing it in the database.
   Reveal Solution Discussion Select an answer first
5. 54expert · hard

   A company is migrating a legacy application from a monolithic architecture to a microservices architecture. They need to decide between using an application server with shared session state or stateless services with token-based authentication. What is the primary advantage of stateless services?

   • AThey eliminate the need for authentication entirely.
   • BThey allow any instance to handle any request without requiring session affinity or shared state.
   • CThey are always faster than stateful services.
   • DThey require a centralized database for session storage.
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   A web application is deployed behind a reverse proxy that terminates TLS. The application itself runs on HTTP on an internal network. The security team notices that some responses include the Set-Cookie header without the Secure attribute. The application team says they cannot enable HTTPS directly on the application server. What is the most effective way to ensure cookies are only sent over HTTPS?

   • AConfigure the reverse proxy to rewrite the Set-Cookie header and add the Secure attribute to all cookies.
   • BDisable cookies entirely and switch to URL-based session tracking to avoid the Secure attribute issue.
   • CChange the application's cookie name to include the word 'Secure' so that clients treat it as secure.
   • DSet the application's cookie domain to a non-secure domain so that the browser automatically adds the Secure attribute.
   Reveal Solution Discussion Select an answer first