GIAC GISF Exam - Topic 3 Question 67 Discussion

Actual exam question for GIAC's GISF exam

Question #: 67
Topic #: 3

[All GISF Questions]

Web applications play a vital role in deploying different databases with user accessibility on theInternet. Which of the following allows an attacker to get unauthorized access to the database of aWeb application by sending (attacking) user-supplied data to an interpreter as part of a commandor query

AInjection flaw

BMalicious File Execution

CCross Site Request Forgery (CSRF)

DCross Site Scripting

Show Suggested Answer

Suggested Answer: C

by Youlanda at Feb 06, 2025, 05:27 PM

Limited Time Offer

25%

Off

Get Premium GISF Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Janessa

3 months ago

Malicious File Execution sounds like it could be a contender, though.

upvoted 0 times

...

Emilio

3 months ago

Injection flaws are the most dangerous, no doubt about it.

upvoted 0 times

...

Dante

3 months ago

Wait, are we sure it's not CSRF? Seems like it could fit too.

upvoted 0 times

...

Valentine

4 months ago

I agree, injection flaws are super common in web apps.

upvoted 0 times

...

Theron

4 months ago

Definitely an injection flaw! That's a classic attack vector.

upvoted 0 times

...

Dona

4 months ago

I recall a question about injection flaws in our last mock exam. It seems like the most likely answer here, but I’m still a bit unsure.

upvoted 0 times

...

Cecilia

4 months ago

I feel like CSRF and XSS are more about manipulating user sessions and scripts, not directly accessing databases. So, maybe it’s definitely A?

upvoted 0 times

...

Tina

4 months ago

I'm not entirely sure, but I remember something about malicious file execution being a different type of attack. Could it be A?

upvoted 0 times

...

Doug

5 months ago

I think this might be related to SQL injection, which is a type of injection flaw. It sounds familiar from our practice questions.

upvoted 0 times

...

Katie

5 months ago

This is a tricky one, but I think I've got a good strategy. I'll eliminate the options I'm sure aren't correct, then focus on analyzing the remaining choices to find the best answer.

upvoted 0 times

...

Arthur

5 months ago

Okay, let me think this through step-by-step. The key is understanding how an attacker could exploit user-supplied data to gain unauthorized access to the database. I'll need to consider each option carefully.

upvoted 0 times

...

Billy

5 months ago

Injection flaws are definitely the way to go here. I've seen these types of questions before, so I feel pretty confident I can identify the right answer.

upvoted 0 times

...

Earleen

5 months ago

Hmm, I'm a bit confused by the wording here. I'll need to re-read the question and options a few times to make sure I understand the difference between these attack types.

upvoted 0 times

...

Alisha

5 months ago

This looks like a classic injection flaw question. I'll need to carefully analyze the user-supplied data and how it's being used in the application's queries or commands.

upvoted 0 times

...

Skye

10 months ago

Injection flaw? More like 'Injection Flawless'! Am I right, folks? Seriously though, this one's a no-brainer. Gotta keep those databases secure!

upvoted 0 times

Joesph

9 months ago

B) Malicious File Execution

upvoted 0 times

...

Tomas

9 months ago

Definitely! Injection flaws are a major vulnerability that attackers can exploit to access databases.

upvoted 0 times

...

Maryrose

9 months ago

A) Injection flaw

upvoted 0 times

...

Whitney

10 months ago

Cross Site Scripting? That's about injecting malicious scripts into web pages, not directly attacking the database. Injection flaw is the clear winner here.

upvoted 0 times

...

Eladia

10 months ago

Malicious File Execution? That's when an attacker tries to run their own program on the server. Not what this question is asking about. Injection flaw is the way to go!

upvoted 0 times

Julian

9 months ago

No, that's not the correct option for this scenario.

upvoted 0 times

...

Shawn

9 months ago

B) Malicious File Execution

upvoted 0 times

...

Talia

9 months ago

Exactly! Injection flaw allows an attacker to send user-supplied data to a database interpreter.

upvoted 0 times

...

Merri

9 months ago

A) Injection flaw

upvoted 0 times

...

Ollie

10 months ago

Cross Site Request Forgery? Nah, that's more about tricking users into performing unwanted actions on the website. This question is about getting unauthorized access to the database, so it's gotta be injection flaw.

upvoted 0 times

Isidra

9 months ago

Yeah, injection flaw allows attackers to send user-supplied data to the interpreter to access the database.

upvoted 0 times

...

Amina

10 months ago

I agree, injection flaw is the correct answer.

upvoted 0 times

...

Marnie

10 months ago

Injection flaw? That's the one! I remember learning about how attackers can sneak malicious code into user inputs and trick the application into executing it. Gotta watch out for those sneaky SQL injection attacks!

upvoted 0 times

...