A SOC analyst is investigating a cache poisoning incident. The analyst reviews the web server logs and finds a request to /search?q=test%0d%0aSet-Cookie:%20sessionid=attacker%3B%20HttpOnly. The server's response includes the reflected value of the 'q' parameter in the Location header. The response also includes a Set-Cookie header for the attacker's session ID. Which HTTP attack is best indicated by this request and response?

HTTP Response Splitting, because the CRLF injection in the parameter allows the attacker to inject a Set-Cookie header into the response

Cross-Site Scripting (XSS), because the 'q' parameter is reflected in the response

HTTP Parameter Pollution, because the 'q' parameter is used in the Location header

HTTP Request Smuggling, because the request contains a CRLF sequence in the URI

In a reflected XSS attack, where does the malicious script appear in the HTTP response?

In the response body, reflected from the request

Which HTTP request parameter is most commonly targeted in a SQL injection attack?

Query string parameters (e.g., ?id=1)

A SOC analyst is investigating a web application that processes user profile updates. The application uses a back-end API that concatenates multiple parameters with the same name into a comma-separated list. An attacker sends a request to /update_profile?role=user&role=admin&email=attacker@example.com. The application's front-end validates the first 'role' parameter as 'user', but the back-end uses the last 'role' parameter. Which attack is the analyst observing, and what is the key indicator in the HTTP request?

SQL Injection, indicated by the 'email' parameter containing an email address

Cross-Site Scripting (XSS), indicated by the use of multiple parameters in a single request

HTTP Parameter Pollution, indicated by the presence of multiple 'role' parameters with different values

HTTP Request Smuggling, indicated by the use of both GET and POST methods in the request

Which HTTP headers are commonly manipulated in a request smuggling attack?

Content-Length and Transfer-Encoding

GIAC Security Operations Certified

Domain 2Objective 3

HTTP(S) Analysis and Attacks GSOC Practice Questions (Page 6)

Part of the Network and Event Analysis domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 77 practice questions to prepare you well beyond it. (estimate)

77questions here

16free pages

23concepts

23 Concepts in This Objective

HTTP Request Structure
HTTP Response Structure
HTTP Methods and Status Codes
HTTP Headers and Their Significance
HTTP Session and Cookies
HTTPS and TLS Basics
TLS Handshake and Certificate Validation
HTTP Authentication Mechanisms
HTTP Request Smuggling
HTTP Response Splitting
SQL Injection via HTTP
Cross-Site Scripting (XSS)
Cross-Site Request Forgery (CSRF)
HTTP Header Injection
Directory Traversal and Path Manipulation
HTTP Parameter Pollution
Malicious File Uploads
Web Shells and Backdoors
HTTP Botnets and Command & Control
HTTP Tunneling and Covert Channels
HTTP Anomaly Detection
HTTP Log Analysis
Tools for HTTP Analysis

Questions 26–30

26expert · hard
A SOC analyst is investigating a cache poisoning incident. The analyst reviews the web server logs and finds a request to /search?q=test%0d%0aSet-Cookie:%20sessionid=attacker%3B%20HttpOnly. The server's response includes the reflected value of the 'q' parameter in the Location header. The response also includes a Set-Cookie header for the attacker's session ID. Which HTTP attack is best indicated by this request and response?
Select an answer first
27foundation · easy
In a reflected XSS attack, where does the malicious script appear in the HTTP response?
Select an answer first
28foundation · easy
Which HTTP request parameter is most commonly targeted in a SQL injection attack?
Select an answer first
29expert · hard
A SOC analyst is investigating a web application that processes user profile updates. The application uses a back-end API that concatenates multiple parameters with the same name into a comma-separated list. An attacker sends a request to /update_profile?role=user&role=admin&email=attacker@example.com. The application's front-end validates the first 'role' parameter as 'user', but the back-end uses the last 'role' parameter. Which attack is the analyst observing, and what is the key indicator in the HTTP request?
Select an answer first
30foundation · easy
Which HTTP headers are commonly manipulated in a request smuggling attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.

HTTP(S) Analysis and Attacks GSOC Practice Questions (Page 6)

Questions 26–30

In a reflected XSS attack, where does the malicious script appear in the HTTP response?

Which HTTP request parameter is most commonly targeted in a SQL injection attack?

Which HTTP headers are commonly manipulated in a request smuggling attack?

Keep studying — Network and Event Analysis