In a reflected XSS attack, where does the malicious payload typically appear in the HTTP response?

In the response body, immediately reflected from the request

In the browser's DOM without any server interaction

Which of the following is a common web application attack vector that involves injecting malicious code into a web application's input fields to manipulate backend queries?

Cross-site request forgery (CSRF)

What is a common WAF evasion technique that involves splitting a malicious payload across multiple HTTP requests?

Using a VPN to change the source IP address.

Request fragmentation or chunked transfer encoding.

Adding extra whitespace to the payload.

A development team is deploying a web application that allows users to upload images and view them in a gallery. The application is built on a serverless architecture using AWS Lambda and S3. Which combination of controls would most effectively mitigate file upload and XSS risks?

Allow any file type but restrict access to authenticated users only.

Store files in a public S3 bucket and rely on the browser's MIME sniffing to render them safely.

Validate file extensions and store files in a private S3 bucket, serving them through a separate domain with Content-Disposition: attachment.

Use a CDN to serve uploaded files and set a permissive Content-Security-Policy.

GIAC Cloud Penetration Tester

Domain 5Objective 2

Web Application Attacks GCPN Practice Questions (Page 1)

Part of the Application and CI/CD Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

10concepts

Questions 1–5

1foundation · easy
In a reflected XSS attack, where does the malicious payload typically appear in the HTTP response?
Select an answer first
2foundation · easy
Which OWASP Top 10 category primarily addresses weaknesses that allow attackers to execute arbitrary commands or access unauthorized data through unsanitized user input?
Select an answer first
3foundation · easy
Which of the following is a common web application attack vector that involves injecting malicious code into a web application's input fields to manipulate backend queries?
Select an answer first
4foundation · easy
What is a common WAF evasion technique that involves splitting a malicious payload across multiple HTTP requests?
Select an answer first
5application · medium
A development team is deploying a web application that allows users to upload images and view them in a gallery. The application is built on a serverless architecture using AWS Lambda and S3. Which combination of controls would most effectively mitigate file upload and XSS risks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.