GSEC Web Communication Security — 15 Questions

Question 1

An analyst is investigating a web application that frequently transmits sensitive session tokens over plain HTTP during initial login redirection before switching to HTTPS. Which vulnerability class does this pattern represent, and how should it be remediated?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Broken Authentication; remediated by deploying HTTP Strict Transport Security headers to enforce encrypted communications permanently.. Insecure transport layer protections allow attackers to intercept cleartext session identifiers via network sniffing. Enforcing mandatory HTTP Strict Transport Security guarantees that modern browsers reject unencrypted connections completely. This mitigation blocks downgrade attacks and protects confidentiality during the entire web browsing session lifecycle.

Answer

Cross-Site Request Forgery; remediated by implementing unpredictable anti-CSRF tokens in all state-changing form submissions.

Answer

Sensitive Data Exposure; remediated by disabling cookies entirely and relying solely on URL parameter-based session management.

Answer

Insecure Deserialization; remediated by validating object types during the deserialization phase of incoming HTTP requests.

Question 2

A security engineer notices that a web application reflects user-supplied input directly inside a JavaScript execution context within a script block without proper encoding. Which remediation strategy provides the most effective defense-in-depth against resulting XSS attacks?

Accepted Answer

Apply strict context-aware output encoding for JavaScript variables combined with a robust Content Security Policy header.. Context-aware output encoding neutralizes malicious payloads by converting special characters into safe HTML or JavaScript escape sequences before rendering. Combining this practice with a strict Content Security Policy establishes multiple defensive layers that prevent unauthorized script execution even if encoding fails.

Answer

Deploy a restrictive Content Security Policy header that disables inline script execution and restricts trusted script sources.

Answer

Implement robust server-side input validation using regular expressions to strip out all angle brackets and quotation marks.

Answer

Store all user-supplied input inside encrypted database tables to ensure confidentiality before rendering it in the browser.

Question 3

A security architect is designing a secure API authentication workflow using JSON Web Tokens. Which THREE implementation practices are critical to ensure token integrity and prevent signature verification bypasses?

Accepted Answer

Explicitly enforce an approved list of cryptographic algorithms during token verification to reject the 'none' algorithm.. Securing JSON Web Tokens requires explicitly defining allowed cryptographic algorithms in the verification function to prevent algorithm substitution attacks. Additionally, validating the token expiration claim prevents replay attacks, while utilizing strong symmetric or asymmetric keys ensures signatures cannot be forged.

Answer

Store the secret signing key directly within client-side local storage to simplify authentication retrieval logic.

Answer

Encode all user session payloads in plain Base64 format inside the token body for maximum read performance.

Question 4

Which TWO of the following headers are critical for preventing Clickjacking and Cross-Site Scripting (XSS) in modern web applications? (Choose two)

Accepted Answer

Content-Security-Policy. Security headers are essential for browser-based defense-in-depth. Content-Security-Policy (CSP) provides a powerful mechanism to restrict resource loading, effectively mitigating XSS. X-Frame-Options is the traditional standard to prevent clickjacking by restricting how a page can be embedded in frames. Together, these headers significantly harden the browser's interaction with the web application by limiting the browser's willingness to execute malicious content or participate in frame-based UI redressing attacks.

Answer

Strict-Transport-Security

Answer

X-Content-Type-Options

Answer

Access-Control-Allow-Origin

Question 5

A security engineer is reviewing a web application's login flow. The application uses a session cookie that is set with the Secure attribute, but the engineer notices that the cookie is still being sent over an unencrypted HTTP connection during the initial login request. Which of the following is the most likely explanation for this behavior?

Accepted Answer

The Secure attribute only prevents the cookie from being sent over HTTP after it has been set, but the initial transmission of credentials can still occur over HTTP.. The Secure attribute ensures that a cookie is only sent over HTTPS, but it does not protect the initial request that sets the cookie if that request is made over HTTP. In this scenario, the login form is submitted over HTTP, so credentials and any session cookie in the response are exposed. The correct answer identifies that the attribute applies only after the cookie is set, and the initial transmission remains vulnerable.

Answer

The server is misconfigured and is not enforcing HTTPS for the login page, but the Secure attribute will still protect the cookie after authentication.

Answer

The Secure attribute is not supported by the browser being used, so the cookie is sent over both HTTP and HTTPS.

Answer

The Secure attribute only applies to cookies with the HttpOnly flag, so without HttpOnly, the cookie is sent over HTTP.

Question 6

A security engineer is configuring a web server to mitigate Cross-Site Request Forgery (CSRF) attacks. The application uses session cookies for authentication. Which of the following implementations provides the strongest protection against CSRF while maintaining usability?

Accepted Answer

Implement a synchronized token pattern with per-request tokens.. The synchronized token pattern is a robust CSRF defense because it requires a secret, unpredictable token that is tied to the user's session and validated on the server. Unlike SameSite cookies, it does not interfere with cross-site navigation. Re-authentication is too disruptive, and Origin header validation alone is insufficient due to potential spoofing or absence. Thus, the token pattern balances security and usability effectively.

Answer

Require re-authentication for every state-changing request.

Answer

Set the 'SameSite' attribute of session cookies to 'Strict'.

Answer

Validate the 'Origin' header on all incoming requests.

Question 7

A security engineer is configuring TLS for a web application. The organization requires that all connections use forward secrecy to protect past session keys if the server's private key is compromised. Which of the following cipher suites should be selected to meet this requirement?

Accepted Answer

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. Forward secrecy is achieved through ephemeral key exchanges like ECDHE or DHE. The cipher suite TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 uses ECDHE, providing forward secrecy along with modern AEAD encryption (GCM). The RSA-based suites do not offer forward secrecy. While DHE also provides forward secrecy, ECDHE is more efficient and commonly preferred. Therefore, the ECDHE suite is the correct choice.

Answer

TLS_DHE_RSA_WITH_AES_256_CBC_SHA256

Answer

TLS_RSA_WITH_AES_128_GCM_SHA256

Answer

TLS_RSA_WITH_AES_256_CBC_SHA

Question 8

A GSEC analyst is reviewing a web application that sets session cookies with the Secure and HttpOnly attributes. The analyst observes that an attacker on the same local network can still capture the session cookie when a user visits the site over an unencrypted HTTP URL that redirects to HTTPS. Which mechanism should the organization implement to prevent the cookie from ever being transmitted over cleartext HTTP?

Accepted Answer

Configure the web server to send the Strict-Transport-Security header with a max-age directive.. Strict-Transport-Security (HSTS) is the only mechanism that makes the browser upgrade all requests for the host to HTTPS before any cleartext transmission occurs. Secure and HttpOnly protect the cookie in transit and from script access, but they do not stop the initial HTTP request that exposes the cookie. HSTS closes that gap.

Answer

Set the cookie's Path attribute to / and the Domain attribute to the exact hostname.

Answer

Enable HTTP Public Key Pinning (HPKP) on the web server.

Answer

Add the SameSite=Strict attribute to the session cookie.

Question 9

An administrator observes that internal users are receiving certificate warnings when accessing a new internal web application. The organization uses an internal Certificate Authority (CA). What is the primary cause of this behavior?

Accepted Answer

The internal Root CA certificate is not installed in the client's local trust store.. Certificate warnings occur when a client cannot establish a chain of trust back to a trusted Root CA. In internal environments, the internal CA certificate must be explicitly imported into the client's trusted root store. Without this root trust, the browser cannot verify the digital signature of the server's certificate, resulting in a trust error. This is a fundamental concept in PKI management for enterprise web security.

Answer

The server certificate has expired, triggering a validity date error in the browser.

Answer

The web server failed to send the intermediate certificate in the handshake process.

Answer

The web application is utilizing an outdated TLS version that browsers no longer support.

Question 10

A developer wants to prevent sensitive cookies from being transmitted over unencrypted HTTP connections. Which cookie attribute is specifically designed to enforce this requirement?

Accepted Answer

Secure. The Secure attribute is a critical security control for web applications. When a cookie is marked as Secure, the browser will only transmit that cookie if the request is being made over an encrypted connection, such as HTTPS. This prevents session tokens or sensitive data from being intercepted in cleartext via man-in-the-middle attacks, ensuring that transport-layer security is effectively utilized for all sensitive session-based interactions.

Answer

HttpOnly

Answer

SameSite=Strict

Answer

Path=/secure

Question 11

Refer to the exhibit. Which security risk does the 'HttpOnly' flag specifically mitigate?

Accepted Answer

Cross-Site Scripting (XSS) session theft. The HttpOnly flag is a vital defense against session hijacking via XSS. When this flag is enabled, the browser prevents client-side scripts, such as JavaScript, from accessing the cookie via the document.cookie object. If an attacker successfully executes an XSS attack, they cannot steal the session cookie, thereby preventing them from impersonating the user's session. This is a core defense-in-depth practice for protecting authentication tokens in modern web applications.

Answer

Cross-Site Request Forgery (CSRF)

Answer

Man-in-the-Middle (MitM) interception

Answer

SQL Injection (SQLi)

Question 12

During a web application audit, you determine that the server is vulnerable to a 'Slowloris' attack. What is the most likely symptom of this attack on the web server?

Accepted Answer

Exhaustion of available connection slots. Slowloris is a low-bandwidth Denial-of-Service (DoS) attack that keeps connections open by sending partial HTTP requests. By never completing the request headers, the server's connection pool becomes exhausted, leaving no threads available to handle legitimate users. This is a classic example of an application-layer DoS attack, which highlights the importance of configuring proper timeout settings and resource limits on web servers like Apache or Nginx.

Answer

Complete server crash due to memory corruption

Answer

Database downtime caused by excessive query volume

Answer

Unauthorized access to the application root directory

Question 13

A penetration tester is reviewing the TLS configuration of an e-commerce web server. The tester observes that the server prefers the cipher suite TLS_RSA_WITH_AES_128_CBC_SHA during the handshake. Which security weakness does this cipher suite selection introduce?

Accepted Answer

It lacks forward secrecy because the RSA key exchange does not generate ephemeral session keys.. The cipher suite TLS_RSA_WITH_AES_128_CBC_SHA relies on static RSA key exchange, where the client encrypts a premaster secret with the server's public key. This means the session key is tied to the server's long-term private key. If that private key is compromised later, an attacker who recorded the encrypted session can decrypt it retroactively. Forward secrecy requires ephemeral key exchanges like ECDHE or DHE, which generate unique session keys that are not recoverable from the long-term key.

Answer

It uses AES in CBC mode, which is vulnerable to padding oracle attacks such as POODLE.

Answer

It uses SHA-1 for integrity, which is considered cryptographically broken for MACs.

Answer

It allows downgrade to export-grade cryptography because of the RSA key exchange.

Question 14

A security analyst is examining a web application that uses HTTP Strict Transport Security (HSTS). The analyst notices that the HSTS header is only sent on HTTPS responses and includes the 'preload' directive. Which additional measure must be taken to ensure the domain is included in browser preload lists?

Accepted Answer

Submit the domain to the HSTS preload list maintained by Google, and ensure the header includes 'includeSubDomains' and a max-age of at least one year.. To preload HSTS, the domain must meet strict criteria: the HSTS header must include 'includeSubDomains', 'preload', and a max-age of at least one year. The 'preload' directive alone does not trigger automatic inclusion; the domain must be submitted to the preload list service. Once accepted, browsers hardcode the domain, enforcing HTTPS even on the first visit. This prevents SSL stripping attacks during initial connections.

Answer

Ensure the HSTS header is sent with a max-age of at least six months and includes the 'preload' directive, then submit the domain to the preload list.

Answer

Configure the server to redirect all HTTP requests to HTTPS with a 301 status code and include the HSTS header in the redirect response.

Answer

Add the 'preload' directive to the HSTS header and wait for browsers to automatically discover and add the domain to their preload lists.

Question 15

A security analyst is reviewing a web application that allows users to upload profile pictures. The application accepts files with .jpg and .png extensions, but the analyst discovers that an attacker can upload a file named 'avatar.php.jpg' and then access it directly via a URL. The server executes the file as PHP. Which security control would most directly prevent this type of attack?

Accepted Answer

Store uploaded files outside the web root and serve them via a handler that validates file content.. The vulnerability arises because the server executes uploaded files based on their extension or content. Storing files outside the web root and serving them through a validating handler prevents direct execution and ensures only safe content is delivered. This approach directly addresses the root cause, whereas other controls like CSP, HTTPS, or cookie flags do not stop server-side code execution.

Answer

Implement a strict Content Security Policy (CSP) that disallows inline scripts.

Answer

Enforce HTTPS for all upload and download requests to prevent man-in-the-middle attacks.

Answer

Set the 'secure' attribute on session cookies to ensure they are only sent over encrypted connections.