A SOC analyst is investigating a series of alerts from a web application. The logs show a GET request to /search?q=%3Cscript%3Ealert(document.cookie)%3C/script%3E. The response from the server includes the Content-Type: text/html header, and the application reflects the 'q' parameter value directly into the page without encoding. Which combination of HTTP components in the request and response confirms the most likely attack type?

The POST method used in the request and the Set-Cookie header in the response

The URL-encoded script in the URI and the text/html Content-Type in the response

The User-Agent header containing a non-standard browser string and the Content-Length header being large

The Referer header showing the request came from the same origin and the 200 OK status code

A SOC analyst is reviewing a packet capture from a server that is supposed to only serve web pages. The analyst notices a series of HTTP POST requests to /update with a Content-Type of application/x-www-form-urlencoded. The request bodies are unusually large (several megabytes) and contain data that, when decoded, appears to be a series of SSH protocol messages. The responses are all 200 OK. Which HTTP characteristic is the strongest indicator of tunneling or a covert channel?

The large request bodies containing non-HTTP protocol data (SSH) in a form-encoded POST

The request URI being '/update' and the responses being 200 OK

The Content-Type header being application/x-www-form-urlencoded

The use of the POST method and the 200 OK response status code

A SOC analyst is reviewing a web application firewall (WAF) log and finds a request to /redirect?url=https://example.com%0d%0aX-Injected:%20true. The WAF blocked the request. The analyst notices that the application uses the 'url' parameter to construct a Location header for redirects. Which HTTP attack is the WAF most likely blocking?

Directory Traversal, because the 'url' parameter contains a path

Cross-Site Scripting (XSS), because the 'url' parameter is used in a redirect

HTTP Header Injection, because the CRLF sequence in the 'url' parameter is being used to inject a new header

SQL Injection, because the 'url' parameter contains a special character

A SOC analyst is inspecting TLS traffic to a corporate web application. The analyst notices that the server's certificate is signed by a certificate authority that is not in the organization's trusted root store, and the certificate's Subject Alternative Name (SAN) does not match the requested domain. The TLS handshake completes successfully, and the application data is exchanged. Which TLS handshake component should the analyst flag as the primary anomaly?

The cipher suite being used is a weak or deprecated algorithm

The TLS version being used is TLS 1.2 instead of TLS 1.3

The client sending a ClientHello with a session ID for session resumption

The certificate chain validation failing because the CA is untrusted and the SAN does not match the domain

GIAC Security Operations Certified

Domain 2Objective 3

HTTP(S) Analysis and Attacks GSOC Practice Questions (Page 3)

Part of the Network and Event Analysis domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 77 practice questions to prepare you well beyond it. (estimate)

77questions here

16free pages

23concepts

23 Concepts in This Objective

HTTP Request Structure
HTTP Response Structure
HTTP Methods and Status Codes
HTTP Headers and Their Significance
HTTP Session and Cookies
HTTPS and TLS Basics
TLS Handshake and Certificate Validation
HTTP Authentication Mechanisms
HTTP Request Smuggling
HTTP Response Splitting
SQL Injection via HTTP
Cross-Site Scripting (XSS)
Cross-Site Request Forgery (CSRF)
HTTP Header Injection
Directory Traversal and Path Manipulation
HTTP Parameter Pollution
Malicious File Uploads
Web Shells and Backdoors
HTTP Botnets and Command & Control
HTTP Tunneling and Covert Channels
HTTP Anomaly Detection
HTTP Log Analysis
Tools for HTTP Analysis

Questions 11–15

11application · medium
A SOC analyst is investigating a series of alerts from a web application. The logs show a GET request to /search?q=%3Cscript%3Ealert(document.cookie)%3C/script%3E. The response from the server includes the Content-Type: text/html header, and the application reflects the 'q' parameter value directly into the page without encoding. Which combination of HTTP components in the request and response confirms the most likely attack type?
Select an answer first
12expert · hard
A SOC analyst is reviewing a packet capture from a server that is supposed to only serve web pages. The analyst notices a series of HTTP POST requests to /update with a Content-Type of application/x-www-form-urlencoded. The request bodies are unusually large (several megabytes) and contain data that, when decoded, appears to be a series of SSH protocol messages. The responses are all 200 OK. Which HTTP characteristic is the strongest indicator of tunneling or a covert channel?
Select an answer first
13application · medium
A SOC analyst is reviewing a web application firewall (WAF) log and finds a request to /redirect?url=https://example.com%0d%0aX-Injected:%20true. The WAF blocked the request. The analyst notices that the application uses the 'url' parameter to construct a Location header for redirects. Which HTTP attack is the WAF most likely blocking?
Select an answer first
14application · medium
A SOC analyst is inspecting TLS traffic to a corporate web application. The analyst notices that the server's certificate is signed by a certificate authority that is not in the organization's trusted root store, and the certificate's Subject Alternative Name (SAN) does not match the requested domain. The TLS handshake completes successfully, and the application data is exchanged. Which TLS handshake component should the analyst flag as the primary anomaly?
Select an answer first
15foundation · easy
Which HTTP header is commonly used to mitigate CSRF attacks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.

HTTP(S) Analysis and Attacks GSOC Practice Questions (Page 3)

Questions 11–15

Which HTTP header is commonly used to mitigate CSRF attacks?

Keep studying — Network and Event Analysis