GCIH Web Application Security & Attacks

Question 1

Which SQL injection technique allows an attacker to infer database information by observing differences in application responses without visible error messages?

Accepted Answer

Boolean-based blind injection

Answer

Boolean-based blind SQL injection infers data by sending queries that return true/false responses and observing behavioral differences in the application's output.

Question 2

Which HTTP security header is most effective at mitigating cross-site scripting (XSS) attacks by controlling which content sources the browser may load?

Accepted Answer

Content-Security-Policy

Answer

Content-Security-Policy (CSP) allows servers to specify trusted content sources, effectively preventing the browser from loading and executing unauthorized scripts.

Question 3

An attacker exploits a web application by injecting malicious scripts that execute in other users' browsers when they visit an affected page. What attack type is this?

Accepted Answer

Cross-Site Scripting (XSS)

Answer

Cross-Site Scripting (XSS) involves injecting client-side malicious scripts into web pages that are subsequently executed in the browsers of other users.

Question 4

Which type of XSS permanently stores the malicious payload in the application's database so every user who views the page is affected?

Accepted Answer

Stored (Persistent) XSS

Answer

Stored (persistent) XSS permanently embeds malicious scripts in the application's database, executing in the browser of every user who views the compromised page.

Question 5

What does a Cross-Site Request Forgery (CSRF) attack exploit to force authenticated users into performing unintended actions?

Accepted Answer

The trust a site has in the user's browser session

Answer

CSRF exploits the trust a web application places in the user's authenticated browser session, tricking it into sending forged requests without the user's knowledge.

(GCIH) GIAC Experienced Incident Handler Practice Test

(GCIH) GIAC Experienced Incident Handler Practice Test

GCIH Web Application Security & Attacks