A mobile app uses an API that authenticates users with a long-lived API key embedded in the app binary. A security review finds that the key is the same for all users and grants full access to all data. Which change would best address the authentication and authorization issues?

Issue a unique API key per user and enforce object-level permissions.

Use a shared secret for all users to simplify management.

Remove authentication entirely and rely on network security.

Switch to OAuth 2.0 with short-lived tokens and scopes.

A company's API gateway is configured to allow the HTTP method 'DELETE' on a public endpoint that should only support 'GET' and 'POST'. An attacker discovers this and deletes critical data. The security team wants to fix this and prevent similar misconfigurations. Which action is most effective?

Add authentication to the endpoint.

Restrict allowed HTTP methods at the API gateway to only those required.

Change the endpoint's URL to a less predictable path.

Which of the following is a common technique to mitigate API abuse such as credential stuffing or web scraping?

Removing all error messages from responses

Using only API keys for authentication

Disabling all HTTP methods except GET

Implementing rate limiting per user or IP address

A legacy API accepts a 'query' parameter that is used in a SQL query. The development team is under pressure to fix a SQL injection vulnerability quickly. They propose three options: (1) use a WAF to block suspicious patterns, (2) implement a custom input sanitization function that escapes single quotes, (3) rewrite the query to use parameterized statements. The API is critical and cannot have downtime. Which option is the most secure long-term solution?

Deploy the WAF rule first and defer the rewrite to a later sprint.

Rewrite the query to use parameterized statements, even if it requires a short maintenance window.

Disable the 'query' parameter until a fix is implemented.

Use the custom sanitization function that escapes single quotes.

GIAC Certified Incident Handler

Domain 3Objective 2

Web Application API Attacks GCIH Practice Questions (Page 7)

Part of the Web Application Security domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~24–40 in this domain), expect 8–13 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 31–35

31application · medium
A mobile app uses an API that authenticates users with a long-lived API key embedded in the app binary. A security review finds that the key is the same for all users and grants full access to all data. Which change would best address the authentication and authorization issues?
Select an answer first
32expert · hard
A company's API gateway is configured to allow the HTTP method 'DELETE' on a public endpoint that should only support 'GET' and 'POST'. An attacker discovers this and deletes critical data. The security team wants to fix this and prevent similar misconfigurations. Which action is most effective?
Select an answer first
33foundation · easy
Which of the following is a common technique to mitigate API abuse such as credential stuffing or web scraping?
Select an answer first
34foundation · easy
An API returns detailed stack traces and database error messages to clients when an exception occurs. Which of the following is the primary security concern?
Select an answer first
35expert · hard
A legacy API accepts a 'query' parameter that is used in a SQL query. The development team is under pressure to fix a SQL injection vulnerability quickly. They propose three options: (1) use a WAF to block suspicious patterns, (2) implement a custom input sanitization function that escapes single quotes, (3) rewrite the query to use parameterized statements. The API is critical and cannot have downtime. Which option is the most secure long-term solution?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Web Application API Attacks GCIH Practice Questions (Page 7)

Questions 31–35

A mobile app uses an API that authenticates users with a long-lived API key embedded in the app binary. A security review finds that the key is the same for all users and grants full access to all data. Which change would best address the authentication and authorization issues?

A company's API gateway is configured to allow the HTTP method 'DELETE' on a public endpoint that should only support 'GET' and 'POST'. An attacker discovers this and deletes critical data. The security team wants to fix this and prevent similar misconfigurations. Which action is most effective?

Which of the following is a common technique to mitigate API abuse such as credential stuffing or web scraping?

An API returns detailed stack traces and database error messages to clients when an exception occurs. Which of the following is the primary security concern?

Keep studying — Web Application Security