An incident responder notices that a web application's admin panel checks the HTTP header X-Admin: false to decide whether to show administrative functions. An attacker could simply change the header to X-Admin: true to gain admin access. Which of the following is the most appropriate remediation?

Move the authorization decision to the server-side session and enforce role-based access control on every administrative request.

Add a second header X-Admin-Check: enabled and require both headers to match.

Rename the header to X-Admin-Level and require the value 'superuser' instead of 'true'.

Use HTTPS to encrypt the header so that it cannot be modified in transit.

A web application allows users to view reports by specifying a path parameter, such as /view?path=reports/2024/q1.pdf. An attacker discovers that using /view?path=../../../../etc/shadow returns the system shadow file. Which of the following is the most robust defense?

Replace all occurrences of '../' in the path parameter with an empty string.

Store report files in a database and serve them via a binary field instead of the filesystem.

Canonicalize the path on the server and verify that the resolved path starts with the allowed base directory before serving the file.

Use a regular expression to block any path containing '..'.

During a penetration test, an analyst discovers that a web application uses sequential invoice numbers in the URL (e.g., /invoice?id=1001). The analyst writes a script to iterate through IDs and successfully retrieves invoices belonging to other customers. Which technique is the analyst primarily using?

Path traversal to access files outside the web root.

Enumeration of direct object references to bypass authorization.

SQL injection to extract data from the database.

Session fixation to hijack another user's session.

A web application serves static files from a directory that also contains sensitive configuration files. The application uses a path parameter to select files, and a recent penetration test found a path traversal vulnerability. The team wants to fix the vulnerability without moving the sensitive files to a different location. Which remediation is most appropriate?

Set the web server to follow symlinks and rely on the operating system's file permissions.

Add a web application firewall rule to block any request containing '../'.

Canonicalize the requested path and verify it is within the public web root before serving the file.

Move the sensitive files to a directory outside the web root and update the application to reference them by an indirect ID.

GIAC Certified Incident Handler

Domain 3Objective 1

Exploiting Insecure Web Application References GCIH Practice Questions (Page 7)

Part of the Web Application Security domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~24–40 in this domain), expect 8–13 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

6concepts

Questions 31–35

31application · medium
An incident responder notices that a web application's admin panel checks the HTTP header X-Admin: false to decide whether to show administrative functions. An attacker could simply change the header to X-Admin: true to gain admin access. Which of the following is the most appropriate remediation?
Select an answer first
32application · medium
A web application allows users to view reports by specifying a path parameter, such as /view?path=reports/2024/q1.pdf. An attacker discovers that using /view?path=../../../../etc/shadow returns the system shadow file. Which of the following is the most robust defense?
Select an answer first
33application · medium
During a penetration test, an analyst discovers that a web application uses sequential invoice numbers in the URL (e.g., /invoice?id=1001). The analyst writes a script to iterate through IDs and successfully retrieves invoices belonging to other customers. Which technique is the analyst primarily using?
Select an answer first
34foundation · easy
An attacker systematically tries different values for a user ID parameter in a web application to find records belonging to other users. Which exploitation technique is being used?
Select an answer first
35expert · medium
A web application serves static files from a directory that also contains sensitive configuration files. The application uses a path parameter to select files, and a recent penetration test found a path traversal vulnerability. The team wants to fix the vulnerability without moving the sensitive files to a different location. Which remediation is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Exploiting Insecure Web Application References GCIH Practice Questions (Page 7)

Questions 31–35

An incident responder notices that a web application's admin panel checks the HTTP header X-Admin: false to decide whether to show administrative functions. An attacker could simply change the header to X-Admin: true to gain admin access. Which of the following is the most appropriate remediation?

A web application allows users to view reports by specifying a path parameter, such as /view?path=reports/2024/q1.pdf. An attacker discovers that using /view?path=../../../../etc/shadow returns the system shadow file. Which of the following is the most robust defense?

An attacker systematically tries different values for a user ID parameter in a web application to find records belonging to other users. Which exploitation technique is being used?

Keep studying — Web Application Security