An e-commerce site stores the user's role in a cookie as role=user. A customer discovers that changing the cookie to role=admin grants access to the order-management dashboard. Which remediation should be applied to prevent this parameter tampering attack?

Encrypt the cookie value so that the client cannot read or modify it.

Sign the cookie with a secret key so that the client cannot modify it without detection.

Store the role in the server-side session and never accept role information from the client.

Add a hidden form field with the role and validate it on the server.

An e-commerce admin panel uses a cookie named 'role' with values like 'user' or 'admin'. A support technician discovers that changing the cookie value to 'admin' grants access to the admin dashboard. The application does not re-verify the role on the server. Which remediation is most appropriate?

Sign the cookie with a secret key so users cannot modify it without detection.

Add a client-side JavaScript check that verifies the role before showing the admin menu.

Store the role in a server-side session and never trust client-supplied role data.

Use HTTPS to encrypt the cookie in transit.

A penetration tester is assessing a web application that uses a random-looking token in the URL to access documents, such as /doc?token=8f3a2b... The tester suspects the token may be predictable because it is generated using a weak random number generator. Which technique would be most effective to confirm this?

Use a web crawler to discover all document URLs and check if any tokens are repeated.

Collect a large number of tokens and analyze them statistically to detect patterns or a weak PRNG.

Send a request with a token that is one character longer than the expected length.

Try common token values such as 'admin' or '1234'.

A web application allows users to export reports as PDFs. The export function takes a 'template' parameter that specifies a filename, e.g., /export?template=monthly.pdf. The application reads the template from a directory on the server. A penetration test reveals that an attacker can use /export?template=../../../../etc/passwd to read arbitrary files. The application also supports user-uploaded templates stored in a separate directory. The team needs to fix the vulnerability while still allowing users to select from predefined templates and their own uploads. Which solution is most appropriate?

Maintain a server-side mapping of allowed template names to their actual file paths, and only accept a template key from a predefined set that includes both system templates and user-uploaded templates.

Use a WAF to block requests with '../' in the template parameter.

Check that the file extension is '.pdf' before reading the file.

Sanitize the template parameter by removing all '../' sequences.

An online course platform allows users to enroll in courses by submitting a form with a hidden field 'course_price' set to 0. A user changes the value to -100 and receives a credit on their account. Which of the following is the most effective mitigation?

Validate that the price is a positive number before processing the enrollment.

Use HTTPS to protect the form submission.

Add a CAPTCHA to the enrollment form to prevent automated manipulation.

Do not trust the client-supplied price; calculate the price on the server based on the course ID and the user's entitlements.

GIAC Certified Incident Handler

Domain 3Objective 1

Exploiting Insecure Web Application References GCIH Practice Questions (Page 3)

Part of the Web Application Security domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~24–40 in this domain), expect 8–13 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

6concepts

Questions 11–15

11application · medium
An e-commerce site stores the user's role in a cookie as role=user. A customer discovers that changing the cookie to role=admin grants access to the order-management dashboard. Which remediation should be applied to prevent this parameter tampering attack?
Select an answer first
12application · medium
An e-commerce admin panel uses a cookie named 'role' with values like 'user' or 'admin'. A support technician discovers that changing the cookie value to 'admin' grants access to the admin dashboard. The application does not re-verify the role on the server. Which remediation is most appropriate?
Select an answer first
13expert · medium
A penetration tester is assessing a web application that uses a random-looking token in the URL to access documents, such as /doc?token=8f3a2b... The tester suspects the token may be predictable because it is generated using a weak random number generator. Which technique would be most effective to confirm this?
Select an answer first
14expert · hard
A web application allows users to export reports as PDFs. The export function takes a 'template' parameter that specifies a filename, e.g., /export?template=monthly.pdf. The application reads the template from a directory on the server. A penetration test reveals that an attacker can use /export?template=../../../../etc/passwd to read arbitrary files. The application also supports user-uploaded templates stored in a separate directory. The team needs to fix the vulnerability while still allowing users to select from predefined templates and their own uploads. Which solution is most appropriate?
Select an answer first
15application · medium
An online course platform allows users to enroll in courses by submitting a form with a hidden field 'course_price' set to 0. A user changes the value to -100 and receives a credit on their account. Which of the following is the most effective mitigation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Exploiting Insecure Web Application References GCIH Practice Questions (Page 3)

Questions 11–15

An e-commerce site stores the user's role in a cookie as role=user. A customer discovers that changing the cookie to role=admin grants access to the order-management dashboard. Which remediation should be applied to prevent this parameter tampering attack?

An e-commerce admin panel uses a cookie named 'role' with values like 'user' or 'admin'. A support technician discovers that changing the cookie value to 'admin' grants access to the admin dashboard. The application does not re-verify the role on the server. Which remediation is most appropriate?

An online course platform allows users to enroll in courses by submitting a form with a hidden field 'course_price' set to 0. A user changes the value to -100 and receives a credit on their account. Which of the following is the most effective mitigation?

Keep studying — Web Application Security