A web application uses a cookie named 'role' with the value 'user' to determine access levels. An attacker changes the cookie value to 'admin' and gains access to admin-only features. Which vulnerability is being exploited?

Access control bypass via parameter tampering

A web server hosts a file download feature that uses the URL /download?file=report.pdf. An attacker submits /download?file=../../etc/passwd and successfully retrieves the server's password file. Which type of attack is this?

Insecure Direct Object Reference

A web application allows users to upload profile pictures and then view them via /image?file=avatar.jpg. The application stores uploaded files in /var/www/uploads. A penetration test reveals that the application is vulnerable to path traversal, allowing access to /etc/passwd. The team wants to fix the vulnerability but also wants to allow users to reference their uploaded files by name. Which solution is most appropriate?

Store uploaded files in a database and serve them via a binary field, ignoring the filename parameter.

Use a web application firewall to block any request containing '../'.

Map the user-supplied filename to a server-generated random filename and store the mapping in a database; serve files using the random filename.

Sanitize the filename by removing all non-alphanumeric characters before using it in the file path.

To prevent IDOR attacks, a web application should use indirect references (e.g., random tokens) instead of direct database keys in URLs. What is the primary purpose of this mitigation?

To make it harder for attackers to guess or enumerate valid object references

To allow users to share links more easily

GIAC Certified Incident Handler

Domain 3Objective 1

Exploiting Insecure Web Application References GCIH Practice Questions (Page 8)

Part of the Web Application Security domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~24–40 in this domain), expect 8–13 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

6concepts

Questions 36–40

36foundation · easy
A web application uses a cookie named 'role' with the value 'user' to determine access levels. An attacker changes the cookie value to 'admin' and gains access to admin-only features. Which vulnerability is being exploited?
Select an answer first
37foundation · easy
An attacker modifies a request header from 'X-Admin: false' to 'X-Admin: true' and gains access to an administrative panel. What type of vulnerability is this?
Select an answer first
38foundation · easy
A web server hosts a file download feature that uses the URL /download?file=report.pdf. An attacker submits /download?file=../../etc/passwd and successfully retrieves the server's password file. Which type of attack is this?
Select an answer first
39expert · medium
A web application allows users to upload profile pictures and then view them via /image?file=avatar.jpg. The application stores uploaded files in /var/www/uploads. A penetration test reveals that the application is vulnerable to path traversal, allowing access to /etc/passwd. The team wants to fix the vulnerability but also wants to allow users to reference their uploaded files by name. Which solution is most appropriate?
Select an answer first
40foundation · easy
To prevent IDOR attacks, a web application should use indirect references (e.g., random tokens) instead of direct database keys in URLs. What is the primary purpose of this mitigation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Exploiting Insecure Web Application References GCIH Practice Questions (Page 8)

Questions 36–40

A web application uses a cookie named 'role' with the value 'user' to determine access levels. An attacker changes the cookie value to 'admin' and gains access to admin-only features. Which vulnerability is being exploited?

An attacker modifies a request header from 'X-Admin: false' to 'X-Admin: true' and gains access to an administrative panel. What type of vulnerability is this?

A web server hosts a file download feature that uses the URL /download?file=report.pdf. An attacker submits /download?file=../../etc/passwd and successfully retrieves the server's password file. Which type of attack is this?

To prevent IDOR attacks, a web application should use indirect references (e.g., random tokens) instead of direct database keys in URLs. What is the primary purpose of this mitigation?

Keep studying — Web Application Security