An API endpoint accepts a 'filename' parameter that is used to construct a file path for saving uploaded files. An attacker sends a filename like '; rm -rf /' and the server executes it. The application uses a framework that escapes shell metacharacters in some places but not here. Which of the following is the most effective fix?

Use a whitelist of allowed filename characters and reject any others.

Sanitize the filename by removing semicolons and spaces.

Encode the filename using URL encoding before using it.

Log all file uploads and review them manually.

A company's API gateway is configured to allow cross-origin requests from any domain. A developer notices that an attacker can host a malicious website that makes authenticated API calls on behalf of logged-in users. Which configuration change would best mitigate this risk?

Disable CORS entirely for all endpoints.

Restrict the CORS policy to a specific allowlist of trusted origins.

Add a rate limit to all API endpoints.

Require an API key in the request header.

After a confirmed API breach, which of the following is a compensating control that can be implemented quickly to mitigate further exploitation while a patch is developed?

Ignoring the incident until the patch is ready

Disabling the affected API endpoint temporarily

Changing the API documentation to remove the vulnerable feature

Deleting all logs related to the incident

A developer discovers that an API endpoint that should only be accessed by internal services is also accessible from the public internet. The endpoint allows unauthenticated requests and returns sensitive configuration data. Which immediate action should be taken?

Change the endpoint's URL to a less predictable path.

Log all requests to the endpoint.

Restrict network access to the endpoint using a firewall or network security group.

Add authentication to the endpoint.

An API sets the CORS header 'Access-Control-Allow-Origin: *' and reflects any origin sent in the request. Which of the following is the primary risk?

The API will be vulnerable to denial of service

The API will be vulnerable to SQL injection

Any website can make authenticated requests to the API on behalf of a logged-in user

The API will expose stack traces in error messages

GIAC Certified Incident Handler

Domain 3Objective 2

Web Application API Attacks GCIH Practice Questions (Page 5)

Part of the Web Application Security domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~24–40 in this domain), expect 8–13 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 21–25

21application · medium
An API endpoint accepts a 'filename' parameter that is used to construct a file path for saving uploaded files. An attacker sends a filename like '; rm -rf /' and the server executes it. The application uses a framework that escapes shell metacharacters in some places but not here. Which of the following is the most effective fix?
Select an answer first
22application · medium
A company's API gateway is configured to allow cross-origin requests from any domain. A developer notices that an attacker can host a malicious website that makes authenticated API calls on behalf of logged-in users. Which configuration change would best mitigate this risk?
Select an answer first
23foundation · easy
After a confirmed API breach, which of the following is a compensating control that can be implemented quickly to mitigate further exploitation while a patch is developed?
Select an answer first
24application · medium
A developer discovers that an API endpoint that should only be accessed by internal services is also accessible from the public internet. The endpoint allows unauthenticated requests and returns sensitive configuration data. Which immediate action should be taken?
Select an answer first
25foundation · easy
An API sets the CORS header 'Access-Control-Allow-Origin: *' and reflects any origin sent in the request. Which of the following is the primary risk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.