A development team is building a web application that allows users to upload and share documents. The application is deployed on Kubernetes in a cloud environment. The team wants to mitigate the risk of stored XSS and file upload attacks. Which of the following combinations of controls is the most effective?

Use a CDN to serve uploaded files and rely on the CDN's security features to sanitize content.

Restrict uploads to authenticated users and rely on the application's authentication to prevent attacks.

Serve uploaded files from a separate domain with Content-Disposition: attachment and set a strict CSP that disallows inline scripts.

Store uploaded files in a database as BLOBs and render them inline in the application.

Which of the following is a common technique used to craft a CSRF attack?

Injecting SQL commands into a login form to bypass authentication.

Using a keylogger to capture the victim's credentials.

Exploiting a buffer overflow in the web server software.

Embedding a crafted HTML form or image tag in a malicious webpage that automatically submits a request to the target application.

During a penetration test, you identify a login form that appears vulnerable to SQL injection. The application is protected by a WAF that blocks requests containing 'OR 1=1'. You need to confirm the vulnerability and extract data. Which tool and technique combination is most appropriate?

Use Burp Suite to manually craft a payload like 'admin'--' and observe the response.

Use Nmap's HTTP SQL injection script.

Use Metasploit's auxiliary module for SQL injection.

Use sqlmap with the --tamper=space2comment option to bypass the WAF.

GIAC Cloud Penetration Tester

Domain 5Objective 2

Web Application Attacks GCPN Practice Questions (Page 6)

Part of the Application and CI/CD Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

10concepts

Questions 26–29

26expert · hard
A development team is building a web application that allows users to upload and share documents. The application is deployed on Kubernetes in a cloud environment. The team wants to mitigate the risk of stored XSS and file upload attacks. Which of the following combinations of controls is the most effective?
Select an answer first
27foundation · easy
Which of the following is a common technique used to craft a CSRF attack?
Select an answer first
28application · medium
During a penetration test, you identify a login form that appears vulnerable to SQL injection. The application is protected by a WAF that blocks requests containing 'OR 1=1'. You need to confirm the vulnerability and extract data. Which tool and technique combination is most appropriate?
Select an answer first
29foundation · easy
Which type of injection attack targets NoSQL databases by manipulating query operators such as $gt or $ne?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.

Web Application Attacks GCPN Practice Questions (Page 6)

Questions 26–29

Which of the following is a common technique used to craft a CSRF attack?

During a penetration test, you identify a login form that appears vulnerable to SQL injection. The application is protected by a WAF that blocks requests containing 'OR 1=1'. You need to confirm the vulnerability and extract data. Which tool and technique combination is most appropriate?

Which type of injection attack targets NoSQL databases by manipulating query operators such as $gt or $ne?

Keep studying — Application and CI/CD Security