最新的GIAC Certified Web Application Defender - GWEB免費考試真題

A. No input validation

B. Client-side validation only

C. Both client-side and server-side validation

D. Server-side validation only

A. Ensuring the uploaded file is not executable on the server

B. Verifying the file extension only

C. Checking the file MIME type against a whitelist

D. Allowing all file types but scanning for size

A. Regularly updating the web server software

B. Enforcing strong password policies

C. Validating and encoding user input

D. Implementing strict session management controls

A. They cause significant performance degradation.

B. They enforce overly strict communication protocols.

C. They prevent the web service from being discovered.

D. They can lead to the exposure of backend system details.

A. To enhance the user experience by reducing server load

B. To increase the application's response time

C. To allow unrestricted access to all site resources

D. To prevent bulk data extraction from the site

A. Disabling cookies in the user's browser

B. Including a unique token in every POST request

C. Using GET requests for state-changing operations

D. Using the same-origin policy with no exceptions

A. To synchronize session states across different devices.

B. To limit the time a session remains active, reducing the risk of unauthorized use.

C. To provide users with the ability to recover closed sessions.

D. To ensure that user data is automatically backed up.

A. Requiring re-authentication for sensitive transactions

B. Allowing session tokens to be reused indefinitely

C. Enforcing SameSite cookies for session management

D. Using CAPTCHA for all form submissions

A. Avoiding the use of standard HTTP methods

B. Restricting access with proper authentication and authorization

C. Implementing stateful session management

D. Utilizing API keys transmitted over HTTP headers

A. RC4

B. AES

C. SHA-1

D. DES

A. Simplification of the authentication process

B. Reduced complexity for user login processes

C. Increased website performance

D. Potential for centralized access point vulnerabilities

A. Conducting thorough user acceptance testing

B. Ensuring compatibility with all web browsers

C. Regularly updating user interface themes

D. Keeping all framework components up to date

A. Using GET requests for all data manipulation

B. Allowing unsecured connections for faster performance

C. Using HTTPS for all communication

D. Implementing input validation for all request parameters

A. SQL Injection

B. Phishing

C. Cross-Site Scripting (XSS)

D. Elevation of Privilege

A. Allowing fallback to older versions for compatibility

B. Using strong cipher suites

C. Enabling only the latest version of the protocol

D. Requiring client-side certificates