An API endpoint that accepts a 'filename' parameter and uses it in a shell command to process files is vulnerable to command injection. The security team wants to fix the vulnerability without changing the functionality. Which approach is the most secure?

Validate the filename against a whitelist of allowed characters and reject any input containing shell metacharacters.

Escape all shell metacharacters in the filename before passing it to the command.

Run the shell command in a sandboxed environment with limited privileges.

Use a blacklist of dangerous commands like 'rm' and 'cat'.

A web API is configured with a CORS policy that allows any origin ('*') and reflects the Origin header in the Access-Control-Allow-Origin response. An attacker discovers that a logged-in user's browser can make cross-origin requests to this API and read the responses. What is the most appropriate fix?

Disable CORS entirely by removing the Access-Control-Allow-Origin header.

Add a CSRF token to all API requests.

Use a custom header like 'X-Requested-With' to validate requests.

Restrict CORS to a specific list of trusted origins and do not reflect arbitrary origins.

Which of the following is an indicator of compromise (IOC) that might suggest an API is being probed for injection vulnerabilities?

A change in the API response format from JSON to XML

A sudden increase in requests containing single quotes or SQL keywords

An increase in requests from a known search engine crawler

A decrease in the number of successful API calls

A financial services company exposes a REST API for account transactions. Each request includes a JWT in the Authorization header. During a review, you notice that the JWT contains the user's role and account ID, and the API trusts these claims without further verification. An attacker has modified the role claim from 'user' to 'admin' and the account ID to another customer's account, and the API accepted the request. Which root cause best explains this vulnerability?

The API fails to validate the JWT signature and issuer.

The API does not implement rate limiting on the authentication endpoint.

The API uses symmetric signing instead of asymmetric signing for JWTs.

The JWT expiration time is set too long.

A mobile app uses a long-lived API key embedded in the app binary to authenticate all requests. The key is extracted by an attacker and used to access the API, which returns sensitive user data. What is the most effective way to mitigate this risk?

Add a certificate pinning to the app to prevent interception.

Use a different API key for each user and store it on the device.

Obfuscate the API key in the app binary using encryption.

Replace the embedded API key with a short-lived token obtained via an authentication flow that requires user credentials.

GIAC Certified Incident Handler

Domain 3Objective 2

Web Application API Attacks GCIH Practice Questions (Page 8)

Part of the Web Application Security domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~24–40 in this domain), expect 8–13 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 36–40

36application · medium
An API endpoint that accepts a 'filename' parameter and uses it in a shell command to process files is vulnerable to command injection. The security team wants to fix the vulnerability without changing the functionality. Which approach is the most secure?
Select an answer first
37application · medium
A web API is configured with a CORS policy that allows any origin ('*') and reflects the Origin header in the Access-Control-Allow-Origin response. An attacker discovers that a logged-in user's browser can make cross-origin requests to this API and read the responses. What is the most appropriate fix?
Select an answer first
38foundation · easy
Which of the following is an indicator of compromise (IOC) that might suggest an API is being probed for injection vulnerabilities?
Select an answer first
39application · medium
A financial services company exposes a REST API for account transactions. Each request includes a JWT in the Authorization header. During a review, you notice that the JWT contains the user's role and account ID, and the API trusts these claims without further verification. An attacker has modified the role claim from 'user' to 'admin' and the account ID to another customer's account, and the API accepted the request. Which root cause best explains this vulnerability?
Select an answer first
40application · medium
A mobile app uses a long-lived API key embedded in the app binary to authenticate all requests. The key is extracted by an attacker and used to access the API, which returns sensitive user data. What is the most effective way to mitigate this risk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Web Application API Attacks GCIH Practice Questions (Page 8)

Questions 36–40

An API endpoint that accepts a 'filename' parameter and uses it in a shell command to process files is vulnerable to command injection. The security team wants to fix the vulnerability without changing the functionality. Which approach is the most secure?

Which of the following is an indicator of compromise (IOC) that might suggest an API is being probed for injection vulnerabilities?

A mobile app uses a long-lived API key embedded in the app binary to authenticate all requests. The key is extracted by an attacker and used to access the API, which returns sensitive user data. What is the most effective way to mitigate this risk?

Keep studying — Web Application Security