A Python script receives JSON data from an untrusted API and uses json.loads() to parse it. The script then passes the resulting object to a function that uses eval() on a string field. What security issue does this introduce?

SQL injection because the JSON data is used in a database query.

Cross-site scripting because the JSON data is rendered in a web page.

Insecure deserialization and arbitrary code execution via eval().

Denial of service because json.loads() can consume excessive memory.

GIAC Python Coder

Domain 3Objective 2

Website Interaction GPYC Practice Questions (Page 10)

Part of the Network and Web Interaction domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 4–7 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

12concepts

Questions 46–47

46application · medium
A Python script receives JSON data from an untrusted API and uses json.loads() to parse it. The script then passes the resulting object to a function that uses eval() on a string field. What security issue does this introduce?
Select an answer first
47foundation · easy
In the requests library, which parameter is used to send a file as part of a multipart/form-data POST request?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GPYC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPYC” is a trademark of its owner, used for identification only.

Website Interaction GPYC Practice Questions (Page 10)

Questions 46–47

A Python script receives JSON data from an untrusted API and uses json.loads() to parse it. The script then passes the resulting object to a function that uses eval() on a string field. What security issue does this introduce?

In the requests library, which parameter is used to send a file as part of a multipart/form-data POST request?

Keep studying — Network and Web Interaction