An API has been compromised through a vulnerability that allows attackers to reset other users' passwords. The incident response team has identified the affected endpoint and the vulnerability. Which of the following is the most important immediate step to prevent further exploitation?

Notify all users to change their passwords.

Review logs to identify affected accounts.

Disable the vulnerable endpoint until a patch is deployed.

Increase monitoring on the endpoint.

A social media API is experiencing an attack where attackers use a botnet to create fake accounts and post spam. The API has rate limiting per IP, but the botnet uses thousands of different IPs. The company wants to reduce spam without blocking legitimate users who may share IPs (e.g., corporate NAT). Which approach is the most effective?

Implement rate limiting based on the authenticated user account, not just the IP address.

Require email verification for all new accounts.

Increase the IP-based rate limit to allow more requests per IP.

Block all requests from data-center IP ranges.

A healthcare API accepts a patient ID as a query parameter to retrieve records. A security analyst notices that when the parameter is changed to a value like '1 OR 1=1', the API returns all patient records. The API uses parameterized queries for other inputs. Which action would best mitigate this vulnerability?

Increase the logging level for the API.

Use an allowlist to validate that the patient ID matches a numeric pattern before querying.

Add a WAF rule to block requests containing 'OR 1=1'.

Require the patient ID to be sent in the request body instead of the URL.

A company is migrating its internal APIs to a public cloud. The APIs handle sensitive customer data and must comply with data residency regulations that require data to remain in a specific country. The security team wants to ensure that only authorized internal applications can access the APIs. Which approach best meets both requirements?

Use a public cloud region outside the required country but encrypt all data at rest.

Expose the APIs publicly but require a strong API key.

Use a private cloud hosted on-premises, but this is not possible in a public cloud.

Deploy the APIs in a cloud region within the required country and use private endpoints with Azure Private Link.

GIAC Certified Incident Handler

Domain 3Objective 2

Web Application API Attacks GCIH Practice Questions (Page 6)

Part of the Web Application Security domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~24–40 in this domain), expect 8–13 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 26–30

26application · medium
An API has been compromised through a vulnerability that allows attackers to reset other users' passwords. The incident response team has identified the affected endpoint and the vulnerability. Which of the following is the most important immediate step to prevent further exploitation?
Select an answer first
27expert · hard
A social media API is experiencing an attack where attackers use a botnet to create fake accounts and post spam. The API has rate limiting per IP, but the botnet uses thousands of different IPs. The company wants to reduce spam without blocking legitimate users who may share IPs (e.g., corporate NAT). Which approach is the most effective?
Select an answer first
28application · medium
A healthcare API accepts a patient ID as a query parameter to retrieve records. A security analyst notices that when the parameter is changed to a value like '1 OR 1=1', the API returns all patient records. The API uses parameterized queries for other inputs. Which action would best mitigate this vulnerability?
Select an answer first
29foundation · easy
An API endpoint returns the full database record for a user, including internal notes and password hashes, when a client requests a user profile. Which type of vulnerability is this?
Select an answer first
30expert · hard
A company is migrating its internal APIs to a public cloud. The APIs handle sensitive customer data and must comply with data residency regulations that require data to remain in a specific country. The security team wants to ensure that only authorized internal applications can access the APIs. Which approach best meets both requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Web Application API Attacks GCIH Practice Questions (Page 6)

Questions 26–30

An API has been compromised through a vulnerability that allows attackers to reset other users' passwords. The incident response team has identified the affected endpoint and the vulnerability. Which of the following is the most important immediate step to prevent further exploitation?

An API endpoint returns the full database record for a user, including internal notes and password hashes, when a client requests a user profile. Which type of vulnerability is this?

Keep studying — Web Application Security