Which technique is most effective for preventing injection attacks in web services that accept structured data like XML or JSON?

Encoding all input to base64 before processing.

Validating input against a strict schema that defines allowed fields, types, and values.

Disabling all error messages to hide potential vulnerabilities.

Using blacklist filtering to remove known malicious patterns.

A QA engineer is testing a REST API that accepts a JSON field for a product price. They want to identify unexpected behavior when the API receives malformed or boundary values. Which testing technique is most appropriate?

Performing a TLS certificate validation test

Fuzzing the price field with random, malformed, and boundary values

Reviewing the API documentation for accuracy

Checking the API's rate limit headers

Why is it important to log failed authentication attempts in a web service?

To detect brute-force attacks and unauthorized access attempts.

To provide a backup of user passwords.

To improve the performance of the authentication service.

To comply with data minimization principles.

A company issues API keys to partners. A partner's key is compromised and used to make excessive requests. The company wants to revoke the key immediately and prevent further abuse. Which action is most appropriate?

Increase the rate limit for the compromised key to avoid blocking the partner.

Revoke the compromised API key and issue a new one to the partner.

Disable rate limiting for the partner's account.

Log the incident but continue allowing the key to work.

GIAC Certified Web Application Defender

Domain 4Objective 3

Web Services Security GWEB Practice Questions (Page 9)

Part of the Advanced Threats and Defense domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 5–8 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

10concepts

Questions 41–45

41foundation · easy
Which technique is most effective for preventing injection attacks in web services that accept structured data like XML or JSON?
Select an answer first
42application · medium
A QA engineer is testing a REST API that accepts a JSON field for a product price. They want to identify unexpected behavior when the API receives malformed or boundary values. Which testing technique is most appropriate?
Select an answer first
43foundation · easy
Why is it important to log failed authentication attempts in a web service?
Select an answer first
44application · medium
A company issues API keys to partners. A partner's key is compromised and used to make excessive requests. The company wants to revoke the key immediately and prevent further abuse. Which action is most appropriate?
Select an answer first
45foundation · easy
Which attack involves injecting malicious JSON data that, when parsed by a JavaScript application, modifies the prototype of all objects?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.