A vulnerability scanner reports a critical SQL injection vulnerability in a web application. The security team wants to confirm the finding before reporting it to management. Which action is most appropriate?

Re-run the scanner with more aggressive settings to see if it still reports the vulnerability.

Ignore the finding because vulnerability scanners often produce false positives.

Immediately report the finding to management as confirmed.

Manually test the vulnerability using a safe, non-destructive payload to confirm it exists.

During a network scan, a tester first sends ICMP echo requests to a range of IP addresses, then performs a TCP SYN scan on responsive hosts. Which sequence of scanning phases does this represent?

Host discovery followed by port scanning

Reconnaissance followed by fingerprinting

Vulnerability scanning followed by exploitation

Port scanning followed by service enumeration

A security team is using a vulnerability scanner to assess a web application. The scanner reports a cross-site scripting (XSS) vulnerability in a search field. The team wants to confirm the vulnerability before remediation. Which action is most appropriate?

Re-run the scanner with a higher intensity setting.

Ignore the finding because XSS vulnerabilities are low risk.

Immediately patch the application based on the scanner's report.

Manually test the search field with a harmless XSS payload to confirm the vulnerability.

A security analyst is performing an authorized external assessment of a customer's DMZ. The customer has asked the analyst to identify which web servers are running an outdated version of Apache that is vulnerable to a known remote code execution flaw. The analyst must avoid disrupting the web services and must not rely on banner grabbing because the servers are configured to hide version information. Which approach should the analyst use?

Run a full TCP connect scan on all 65535 ports of each host, then use the HTTP OPTIONS method to fingerprint the server.

Perform a SYN scan on common web ports, then send crafted HTTP requests that trigger version-specific responses to identify the Apache version.

Use a vulnerability scanner with default credentials to log in to the web server and read the Apache configuration file.

Conduct a UDP scan on port 80 to detect the web service, then use the Server header from a normal HTTP response to determine the version.

GIAC Offensive AI Analyst

Domain 2Objective 2

Network Scanning and Vulnerability Detection GOAA Practice Questions (Page 5)

Part of the AI-Driven Offensive Operations domain, which makes up ~40% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~20–32 in this domain), expect 5–8 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

6concepts

Questions 21–25

21application · medium
A vulnerability scanner reports a critical SQL injection vulnerability in a web application. The security team wants to confirm the finding before reporting it to management. Which action is most appropriate?
Select an answer first
22foundation · easy
Which port scanning technique completes the full TCP three-way handshake and is therefore more likely to be logged by the target application, but does not require raw socket privileges?
Select an answer first
23foundation · easy
During a network scan, a tester first sends ICMP echo requests to a range of IP addresses, then performs a TCP SYN scan on responsive hosts. Which sequence of scanning phases does this represent?
Select an answer first
24application · medium
A security team is using a vulnerability scanner to assess a web application. The scanner reports a cross-site scripting (XSS) vulnerability in a search field. The team wants to confirm the vulnerability before remediation. Which action is most appropriate?
Select an answer first
25application · medium
A security analyst is performing an authorized external assessment of a customer's DMZ. The customer has asked the analyst to identify which web servers are running an outdated version of Apache that is vulnerable to a known remote code execution flaw. The analyst must avoid disrupting the web services and must not rely on banner grabbing because the servers are configured to hide version information. Which approach should the analyst use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOAA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOAA” is a trademark of its owner, used for identification only.

Network Scanning and Vulnerability Detection GOAA Practice Questions (Page 5)

Questions 21–25

A vulnerability scanner reports a critical SQL injection vulnerability in a web application. The security team wants to confirm the finding before reporting it to management. Which action is most appropriate?

Which port scanning technique completes the full TCP three-way handshake and is therefore more likely to be logged by the target application, but does not require raw socket privileges?

During a network scan, a tester first sends ICMP echo requests to a range of IP addresses, then performs a TCP SYN scan on responsive hosts. Which sequence of scanning phases does this represent?

A security team is using a vulnerability scanner to assess a web application. The scanner reports a cross-site scripting (XSS) vulnerability in a search field. The team wants to confirm the vulnerability before remediation. Which action is most appropriate?

Keep studying — AI-Driven Offensive Operations