Which log entry is most indicative of a brute-force login attack?

A single successful login from a new IP

A GET request for a static image

Multiple failed login attempts from the same IP in a short time

Which characters are the primary target for HTTP header injection?

Carriage return (\r) and line feed (\n)

Single quote (') and double quote (")

A security analyst is investigating a series of failed login attempts against a web application that uses a reverse proxy in front of an origin server. The proxy forwards requests with the header 'Content-Length' stripped and instead relies on 'Transfer-Encoding: chunked'. The origin server, however, honors both headers. During analysis, the analyst notices a request where the proxy saw a single request but the origin server processed it as two separate requests. The second request contained a 'Cookie: session=admin' header. Which HTTP attack technique is most consistent with this observation?

HTTP header injection to add a second Host header

HTTP response splitting via CRLF injection in the Cookie header

HTTP request smuggling via CL.TE discrepancy

HTTP parameter pollution causing the origin to process duplicate parameters

What is the result of a successful CRLF injection into an HTTP header?

The attacker can add arbitrary headers or split the response

The client's browser is redirected to a phishing site

GIAC Security Operations Certified

Domain 2Objective 3

HTTP(S) Analysis and Attacks GSOC Practice Questions (Page 8)

Part of the Network and Event Analysis domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 77 practice questions to prepare you well beyond it. (estimate)

77questions here

16free pages

23concepts

23 Concepts in This Objective

HTTP Request Structure
HTTP Response Structure
HTTP Methods and Status Codes
HTTP Headers and Their Significance
HTTP Session and Cookies
HTTPS and TLS Basics
TLS Handshake and Certificate Validation
HTTP Authentication Mechanisms
HTTP Request Smuggling
HTTP Response Splitting
SQL Injection via HTTP
Cross-Site Scripting (XSS)
Cross-Site Request Forgery (CSRF)
HTTP Header Injection
Directory Traversal and Path Manipulation
HTTP Parameter Pollution
Malicious File Uploads
Web Shells and Backdoors
HTTP Botnets and Command & Control
HTTP Tunneling and Covert Channels
HTTP Anomaly Detection
HTTP Log Analysis
Tools for HTTP Analysis

Questions 36–40

36foundation · easy
Which log entry is most indicative of a brute-force login attack?
Select an answer first
37foundation · easy
Which characters are the primary target for HTTP header injection?
Select an answer first
38foundation · easy
Which part of an HTTP response indicates whether the request was successful?
Select an answer first
39expert · hard
A security analyst is investigating a series of failed login attempts against a web application that uses a reverse proxy in front of an origin server. The proxy forwards requests with the header 'Content-Length' stripped and instead relies on 'Transfer-Encoding: chunked'. The origin server, however, honors both headers. During analysis, the analyst notices a request where the proxy saw a single request but the origin server processed it as two separate requests. The second request contained a 'Cookie: session=admin' header. Which HTTP attack technique is most consistent with this observation?
Select an answer first
40foundation · easy
What is the result of a successful CRLF injection into an HTTP header?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.

HTTP(S) Analysis and Attacks GSOC Practice Questions (Page 8)

Questions 36–40

Which log entry is most indicative of a brute-force login attack?

Which characters are the primary target for HTTP header injection?

Which part of an HTTP response indicates whether the request was successful?

What is the result of a successful CRLF injection into an HTTP header?

Keep studying — Network and Event Analysis