During an incident response engagement, a tester finds that a web application uses sequential numeric IDs for user profiles (e.g., /profile?id=1001). The tester wants to enumerate all user profiles to check for IDOR vulnerabilities. Which technique is most appropriate for this task?

Use a web crawler to follow all links on the site and record every profile URL.

Use a script to iterate through a range of IDs and compare response sizes or status codes to identify valid profiles.

Send a request with a negative ID to see if the application returns an error.

Intercept the request with a proxy and manually change the ID to a few high-value numbers.

A developer is fixing a path traversal vulnerability in a file download feature. Which of the following is the most effective server-side mitigation?

Use a blacklist of dangerous characters like '..' and '/'

Validate and sanitize the user-supplied file path to ensure it stays within the intended directory

Store files in a database instead of the filesystem

Rely on client-side JavaScript to validate the file name

A web application allows users to download documents by passing a filename parameter, such as /download?file=report.pdf. A penetration tester discovers that submitting /download?file=../../../../etc/passwd returns the contents of the system password file. Which combination of controls would most effectively mitigate this vulnerability?

Use a URL rewrite rule to replace '../' with an empty string in the filename parameter.

Set the web server's document root to the system root directory so that all files are accessible.

Validate the filename against a whitelist of allowed files and serve the file from a dedicated storage directory using server-side path resolution.

Remove all dot characters from the filename parameter before processing the request.

A large enterprise application exposes customer records via /customer?id= . The development team wants to mitigate IDOR but also needs to maintain the ability to link records to external systems that currently use the numeric ID. Which approach best balances security and the external integration requirement?

Add a rate limit on the /customer endpoint to slow down enumeration attempts.

Use a signed token that contains the numeric ID and a user-specific signature.

Replace the numeric ID with a UUID and maintain a mapping table for external systems.

Keep the numeric ID in the URL but add a server-side authorization check that verifies the user's relationship to the record.

GIAC Certified Incident Handler

Domain 3Objective 1

Exploiting Insecure Web Application References GCIH Practice Questions (Page 1)

Part of the Web Application Security domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~24–40 in this domain), expect 8–13 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

6concepts

Questions 1–5

1application · medium
During an incident response engagement, a tester finds that a web application uses sequential numeric IDs for user profiles (e.g., /profile?id=1001). The tester wants to enumerate all user profiles to check for IDOR vulnerabilities. Which technique is most appropriate for this task?
Select an answer first
2foundation · easy
A developer is fixing a path traversal vulnerability in a file download feature. Which of the following is the most effective server-side mitigation?
Select an answer first
3application · medium
A web application allows users to download documents by passing a filename parameter, such as /download?file=report.pdf. A penetration tester discovers that submitting /download?file=../../../../etc/passwd returns the contents of the system password file. Which combination of controls would most effectively mitigate this vulnerability?
Select an answer first
4expert · medium
A large enterprise application exposes customer records via /customer?id=<numeric>. The development team wants to mitigate IDOR but also needs to maintain the ability to link records to external systems that currently use the numeric ID. Which approach best balances security and the external integration requirement?
Select an answer first
5foundation · easy
An e-commerce site calculates the total price of an order on the client side and sends it in a hidden form field. An attacker changes the price from 100 to 1 and completes the purchase. What is this attack called?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Exploiting Insecure Web Application References GCIH Practice Questions (Page 1)

Questions 1–5

During an incident response engagement, a tester finds that a web application uses sequential numeric IDs for user profiles (e.g., /profile?id=1001). The tester wants to enumerate all user profiles to check for IDOR vulnerabilities. Which technique is most appropriate for this task?

A developer is fixing a path traversal vulnerability in a file download feature. Which of the following is the most effective server-side mitigation?

An e-commerce site calculates the total price of an order on the client side and sends it in a hidden form field. An attacker changes the price from 100 to 1 and completes the purchase. What is this attack called?

Keep studying — Web Application Security