A team is designing a new service that will receive serialized data from multiple external partners. Each partner uses a different serialization format (Java, Python pickle, and .NET BinaryFormatter). The team wants to minimize the risk of deserialization attacks while supporting all partners. Which approach is the most secure?

Encrypt all data in transit and assume that encryption makes it safe

Use a separate deserialization endpoint for each format and apply format-specific allow-lists

Require all partners to send data in a common JSON format with a strict schema

Use a single deserialization library that supports all formats and rely on its default settings

What is a common impact of a successful insecure deserialization attack?

Loss of data integrity due to database corruption

Increased server response time due to larger payloads

Exposure of the application's source code to the client

Arbitrary code execution on the server

A developer is reviewing a Ruby on Rails application that uses Marshal.load() on a cookie value. The cookie is encrypted with a secret key. Is this secure?

Yes, because the cookie is small and cannot contain a full payload

Yes, because the encryption prevents attackers from modifying the cookie

No, because Marshal.load() can execute arbitrary code if an attacker can craft a valid cookie

No, because cookies are always sent over HTTP

A company is migrating a legacy application that uses Java serialization to a new microservices architecture. The new architecture uses JSON for inter-service communication. The team wants to eliminate the risk of insecure deserialization while maintaining backward compatibility with the legacy system. Which approach is the best?

Use a custom ObjectInputFilter that allows all classes from the legacy system's package

Keep the legacy serialization format but add a strong encryption layer

Create a JSON adapter that converts legacy serialized data to JSON and validates it against a strict schema before deserialization

Replace the legacy system entirely and do not support backward compatibility

A company is choosing a serialization library for a new service that will handle untrusted data. The security team requires that the library not automatically instantiate arbitrary classes and that it support schema validation. Which library choice best meets these requirements?

JSON with a strict schema validator such as JSON Schema

Java native serialization with ObjectInputStream

Python pickle with a custom find_class override

XML with DTD processing enabled

GIAC Certified Web Application Defender

Domain 4Objective 2

Modern Application Framework Issues and Serialization GWEB Practice Questions (Page 6)

Part of the Advanced Threats and Defense domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 5–8 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

6concepts

Questions 26–30

26expert · hard
A team is designing a new service that will receive serialized data from multiple external partners. Each partner uses a different serialization format (Java, Python pickle, and .NET BinaryFormatter). The team wants to minimize the risk of deserialization attacks while supporting all partners. Which approach is the most secure?
Select an answer first
27foundation · easy
What is a common impact of a successful insecure deserialization attack?
Select an answer first
28application · medium
A developer is reviewing a Ruby on Rails application that uses Marshal.load() on a cookie value. The cookie is encrypted with a secret key. Is this secure?
Select an answer first
29expert · hard
A company is migrating a legacy application that uses Java serialization to a new microservices architecture. The new architecture uses JSON for inter-service communication. The team wants to eliminate the risk of insecure deserialization while maintaining backward compatibility with the legacy system. Which approach is the best?
Select an answer first
30application · medium
A company is choosing a serialization library for a new service that will handle untrusted data. The security team requires that the library not automatically instantiate arbitrary classes and that it support schema validation. Which library choice best meets these requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.

Modern Application Framework Issues and Serialization GWEB Practice Questions (Page 6)

Questions 26–30

What is a common impact of a successful insecure deserialization attack?

A developer is reviewing a Ruby on Rails application that uses Marshal.load() on a cookie value. The cookie is encrypted with a secret key. Is this secure?

A company is choosing a serialization library for a new service that will handle untrusted data. The security team requires that the library not automatically instantiate arbitrary classes and that it support schema validation. Which library choice best meets these requirements?

Keep studying — Advanced Threats and Defense