A development team is adopting a secure coding standard. They want to prevent SQL injection, XSS, and command injection in their new web application. Which single practice would be MOST effective across all three vulnerability classes?

Validate and sanitize all user input on the server side

Disable client-side scripting in browsers

Deploy a network intrusion detection system (IDS)

Use HTTPS for all communications

Which security control is specifically designed to prevent the execution of code from non-executable memory regions, such as the stack or heap?

Data Execution Prevention (DEP) / NX bit

Address Space Layout Randomization (ASLR)

Which defense strategy is most effective in preventing cross-site scripting (XSS) attacks?

Disabling cookies in the browser.

Using a Content Security Policy (CSP) that allows inline scripts.

Using HTTPS for all web traffic.

Context-aware output encoding and escaping of user-supplied data.

A company runs a legacy web application that is vulnerable to SQL injection. The application cannot be rewritten in the near term. The security team needs to reduce the risk of exploitation while the application is being replaced. Which control would provide the MOST immediate and effective mitigation?

Disable the database account used by the application

Deploy a Web Application Firewall (WAF) with virtual patching

GIAC Defending Advanced Threats

Domain 1Objective 3

Application Exploitation GDAT Practice Questions (Page 1)

Part of the Initial Access and Execution domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

4concepts

Questions 1–5

1application · medium
A development team is adopting a secure coding standard. They want to prevent SQL injection, XSS, and command injection in their new web application. Which single practice would be MOST effective across all three vulnerability classes?
Select an answer first
2expert · hard
A penetration tester is assessing a web application that uses a REST API. The tester discovers that the API endpoint /api/user/profile accepts a JSON payload with a 'role' field. The application uses this field to determine the user's role in the response. The tester sends a request with 'role': 'admin' and receives an admin response. Which vulnerability class is being exploited?
Select an answer first
3foundation · easy
Which security control is specifically designed to prevent the execution of code from non-executable memory regions, such as the stack or heap?
Select an answer first
4foundation · easy
Which defense strategy is most effective in preventing cross-site scripting (XSS) attacks?
Select an answer first
5application · medium
A company runs a legacy web application that is vulnerable to SQL injection. The application cannot be rewritten in the near term. The security team needs to reduce the risk of exploitation while the application is being replaced. Which control would provide the MOST immediate and effective mitigation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.

Application Exploitation GDAT Practice Questions (Page 1)

Questions 1–5

A development team is adopting a secure coding standard. They want to prevent SQL injection, XSS, and command injection in their new web application. Which single practice would be MOST effective across all three vulnerability classes?

Which security control is specifically designed to prevent the execution of code from non-executable memory regions, such as the stack or heap?

Which defense strategy is most effective in preventing cross-site scripting (XSS) attacks?

Keep studying — Initial Access and Execution