What is the primary impact of an XXE (XML External Entity) attack?

Redirecting users to malicious websites.

Reading local files, performing SSRF, or causing denial of service.

Stealing session cookies via JavaScript injection.

Executing arbitrary code on the client's browser.

What is the primary risk associated with a file upload feature that does not validate file types or contents?

The server may run out of disk space due to large files.

The file may not be indexed by search engines.

The file may be corrupted during upload.

An attacker can upload a malicious executable or script that may be executed on the server or by other users.

In a SQL injection attack, what is the primary impact when an attacker successfully exploits a vulnerable input field to alter a WHERE clause?

Forcing the user's browser to send unwanted requests

Execution of client-side JavaScript in the victim's browser

Denial of service by crashing the web server

Unauthorized data retrieval or modification

Which security control is specifically designed to prevent CSRF attacks?

Implementing input validation on the server.

Setting the HttpOnly flag on cookies.

Anti-CSRF tokens (synchronizer tokens) embedded in forms.

Using HTTPS for all communications.

A cloud storage application allows users to upload profile pictures. The application stores files in an S3 bucket and serves them via a CDN. A penetration tester discovers that the filename parameter in the upload request is used to construct the object key without sanitization. Which of the following attacks is most directly enabled by this vulnerability?

Denial of service by uploading a file with an extremely long name.

Command injection in the file processing pipeline.

Path traversal to overwrite other users' files by using '../../' in the filename.

SQL injection in the database that stores file metadata.

GIAC Cloud Penetration Tester

Domain 5Objective 2

Web Application Attacks GCPN Practice Questions (Page 2)

Part of the Application and CI/CD Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

10concepts

Questions 6–10

6foundation · easy
What is the primary impact of an XXE (XML External Entity) attack?
Select an answer first
7foundation · easy
What is the primary risk associated with a file upload feature that does not validate file types or contents?
Select an answer first
8foundation · easy
In a SQL injection attack, what is the primary impact when an attacker successfully exploits a vulnerable input field to alter a WHERE clause?
Select an answer first
9foundation · easy
Which security control is specifically designed to prevent CSRF attacks?
Select an answer first
10application · medium
A cloud storage application allows users to upload profile pictures. The application stores files in an S3 bucket and serves them via a CDN. A penetration tester discovers that the filename parameter in the upload request is used to construct the object key without sanitization. Which of the following attacks is most directly enabled by this vulnerability?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.