What is the purpose of static analysis in detecting injection vulnerabilities?

To send malicious payloads to a running application to test for vulnerabilities.

To monitor production traffic for attacks.

To fuzz the application with random inputs.

To analyze source code without executing it to find patterns like unsafe concatenation.

A security team is testing a web application for injection vulnerabilities. They have limited time and want to identify as many injection types as possible. Which testing approach is most efficient?

Use only fuzzing with random input

Use only static analysis to review the source code

Use only dynamic testing with a web application scanner

Use a combination of static analysis, dynamic testing, and fuzzing to cover multiple injection types

Which of the following is a secure coding practice to prevent header injection?

Using user input as the header name.

Using framework functions that automatically sanitize header values.

Allowing all characters except quotes.

Concatenating user input directly into header values.

What is the purpose of ASLR (Address Space Layout Randomization)?

To encrypt memory contents to prevent data theft.

To randomize memory addresses of key data areas, making it harder to predict target addresses for exploitation.

To prevent buffer overflows by adding bounds checking automatically.

To detect buffer overflows and terminate the process.

GIAC Certified Incident Handler

Domain 3Objective 3

Web Application Injection Attacks GCIH Practice Questions (Page 13)

Part of the Web Application Security domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~24–40 in this domain), expect 8–13 from this objective — we provide 80 practice questions to prepare you well beyond it. (estimate)

80questions here

16free pages

25concepts

25 Concepts in This Objective

SQL Injection Fundamentals
SQL Injection Attack Techniques
SQL Injection Mitigation
Command Injection
Command Injection Mitigation
LDAP Injection
LDAP Injection Mitigation
XML Injection
XML Injection Mitigation
NoSQL Injection
NoSQL Injection Mitigation
ORM Injection
ORM Injection Mitigation
XPath Injection
XPath Injection Mitigation
Buffer Overflow Injection
Buffer Overflow Mitigation
Format String Injection
Format String Mitigation
HTTP Header Injection
HTTP Header Injection Mitigation
Email Header Injection
Email Header Injection Mitigation
Injection Attack Detection and Testing
Injection Attack Defense in Depth

Questions 61–65

61foundation · easy
What is the purpose of static analysis in detecting injection vulnerabilities?
Select an answer first
62application · medium
A Node.js application uses MongoDB and constructs a query like this: `db.users.find({ username: userInput, password: passInput })`. An attacker wants to bypass authentication. Which payload in the username field would achieve this?
Select an answer first
63expert · hard
A security team is testing a web application for injection vulnerabilities. They have limited time and want to identify as many injection types as possible. Which testing approach is most efficient?
Select an answer first
64foundation · easy
Which of the following is a secure coding practice to prevent header injection?
Select an answer first
65foundation · easy
What is the purpose of ASLR (Address Space Layout Randomization)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.