A SOC analyst is monitoring outbound HTTP traffic from a corporate network. The analyst notices a workstation making requests to 'https://update.example.com/check' every 60 seconds. The requests are POST with a body containing a base64-encoded string. The responses are 200 OK with a body containing a base64-encoded string. The workstation has no legitimate software that should be contacting this domain. The TLS certificate for 'update.example.com' is issued by a CA that is not in the corporate trusted root store, but the workstation's traffic is being intercepted by a corporate TLS inspection proxy. Which conclusion is most consistent with this observation?

The traffic is a legitimate software update that is using a non-standard CA

The traffic is a false positive caused by the TLS inspection proxy re-issuing certificates

The traffic is HTTP tunneling, where the attacker is encapsulating DNS queries in HTTP

The traffic is likely HTTP-based C2 communication, and the analyst should block the domain and investigate the workstation

What is a common indicator of HTTP-based botnet command-and-control (C2) traffic?

Periodic beaconing to a domain with low traffic volume

Large file downloads from a CDN

What is HTTP Parameter Pollution (HPP)?

Injecting SQL into a parameter value

Encrypting parameters to hide them

Sending a very large parameter value

Sending multiple parameters with the same name to confuse the server

GIAC Security Operations Certified

Domain 2Objective 3

HTTP(S) Analysis and Attacks GSOC Practice Questions (Page 11)

Part of the Network and Event Analysis domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 77 practice questions to prepare you well beyond it. (estimate)

77questions here

16free pages

23concepts

23 Concepts in This Objective

HTTP Request Structure
HTTP Response Structure
HTTP Methods and Status Codes
HTTP Headers and Their Significance
HTTP Session and Cookies
HTTPS and TLS Basics
TLS Handshake and Certificate Validation
HTTP Authentication Mechanisms
HTTP Request Smuggling
HTTP Response Splitting
SQL Injection via HTTP
Cross-Site Scripting (XSS)
Cross-Site Request Forgery (CSRF)
HTTP Header Injection
Directory Traversal and Path Manipulation
HTTP Parameter Pollution
Malicious File Uploads
Web Shells and Backdoors
HTTP Botnets and Command & Control
HTTP Tunneling and Covert Channels
HTTP Anomaly Detection
HTTP Log Analysis
Tools for HTTP Analysis

Questions 51–55

51foundation · easy
Which character sequence is used in HTTP response splitting to terminate a header line?
Select an answer first
52foundation · easy
Which type of XSS attack occurs when malicious script is stored on the server and served to other users?
Select an answer first
53expert · hard
A SOC analyst is monitoring outbound HTTP traffic from a corporate network. The analyst notices a workstation making requests to 'https://update.example.com/check' every 60 seconds. The requests are POST with a body containing a base64-encoded string. The responses are 200 OK with a body containing a base64-encoded string. The workstation has no legitimate software that should be contacting this domain. The TLS certificate for 'update.example.com' is issued by a CA that is not in the corporate trusted root store, but the workstation's traffic is being intercepted by a corporate TLS inspection proxy. Which conclusion is most consistent with this observation?
Select an answer first
54foundation · easy
What is a common indicator of HTTP-based botnet command-and-control (C2) traffic?
Select an answer first
55foundation · easy
What is HTTP Parameter Pollution (HPP)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.

HTTP(S) Analysis and Attacks GSOC Practice Questions (Page 11)

Questions 51–55

Which character sequence is used in HTTP response splitting to terminate a header line?

Which type of XSS attack occurs when malicious script is stored on the server and served to other users?

What is a common indicator of HTTP-based botnet command-and-control (C2) traffic?

What is HTTP Parameter Pollution (HPP)?

Keep studying — Network and Event Analysis