GFACT CERTIFICATION EXAM 2026 LATEST
UPDATE QUESTIONS AND CORRECT VERIFIED
ANSWERS ALREADY GRADED A+
How do you mitigate SQL - ANS-It is to not user an insecure method of passing queries to the
database
What is a Session Guessing attack? - ANS-Where an attacker guesses a Session Token and logs
into a site under your information
What is the best way to mitigate a Session Guessing attack? - ANS-To use truly random session
tokens that expire
What is a clickjacking attack? - ANS-Where a user can be tricked into clicking on something
without realizing that they did
How do you mitigate a clickjacking attack? - ANS-Make sure that the web server itself sends
the X-Frame Options header in the HTTP response
What are the three values within a X-Frame Options header in an HTTPS response? - ANS-Deny,
Same Origin, and Allow-FROM
What is a Cross Site Request Forgery? - ANS-Where a user uses unauthorized commands
submitted from a user that the web application trusts
How do you mitigate a Cross Site Request Forgery?
,A) Make sure every HTTP request submitting a form or any other kind of input comes from the
same origin
B) Use a Cross Site Request Forgery Token which is required by every form or input on a site
C) Both A and B
D) None of the above - ANS-Both A and B
Where should the CSRF tokens be located in to keep a user's session from being vulnerable? -
ANS-The POST Request
What is a directory traversal attack? - ANS-A directory traversal attack is an injection of
directory code to try and navigate to a specific directory / file on a computer
What is the Directory Traversal vulnerability used for? - ANS-To read sensitive data within the
web application
What is the best way to mitigate directory traversal attack? - ANS-It is to not use user input
when making file system calls
What is a File Upload Vulnerability? - ANS-A flaw where the user can upload an arbitrary file to
the server and then visit it to execute code
What is used to test web applications?
A) NMAP
B) A scanner
C) A Vulnerability Scanner
D) Nothing - ANS-A Vulnerability Scanner
,When would you go public with a vulnerability found within a business website?
A) After a patch was released
B) Before the patch is released, after you have discussed it with the business
C) Before you tell the business and you go public immediately
D) Never and use it for your own exploits - ANS-After the patch was released
What is Integer Overflow? - ANS-Program assumes that a value is always positive, overflow
makes signed integer wrap and become negative
What is the return pointer?
A) Where the CPU returns to after completing a function
B) Where the CPU goes to next after completing a function
C) Where the CPU goes to after all functions are completed
D) Where the pointer is - ANS-Where the CPU goes to next after completing a function
What is a stack canary? - ANS-It is a value that sits before the return pointer of the stack.
What is Address Space Layout Randomization? - ANS-A protection that involves randomizing
the Memory address that a program gets loaded into each run
What is a Format String Vulnerability? - ANS-It occurs when you run printf in C without a
format string
How do you mitigate a Format String Vulnerability? - ANS-Never use printf without a format
string
, What kind of vulnerability is within a FTP Service?
A) Buffer Overflow
B) Integer Overflow
C) Command Injection
D) Nothing it is completely fine - ANS-Buffer Overflow
What is Metasploit? - ANS-A penetration testing tool used to automatically execute exploits
against targeted systems
What application is used when running Metasploit?
A) Linux
B) Kali Linux
C) Command Prompt
D) Its got its own application window - ANS-Kali Linux
Why are patch cycles important? - ANS-To keep all organizations up to date for all technology
that it uses to protect them against new and old vulnerabilities
Why is end of support for applications or technology important? - ANS-Because you should
never use applications or tech that is no longer supported from developers
What is Social Engineering?
A) Where engineering is done publicly
UPDATE QUESTIONS AND CORRECT VERIFIED
ANSWERS ALREADY GRADED A+
How do you mitigate SQL - ANS-It is to not user an insecure method of passing queries to the
database
What is a Session Guessing attack? - ANS-Where an attacker guesses a Session Token and logs
into a site under your information
What is the best way to mitigate a Session Guessing attack? - ANS-To use truly random session
tokens that expire
What is a clickjacking attack? - ANS-Where a user can be tricked into clicking on something
without realizing that they did
How do you mitigate a clickjacking attack? - ANS-Make sure that the web server itself sends
the X-Frame Options header in the HTTP response
What are the three values within a X-Frame Options header in an HTTPS response? - ANS-Deny,
Same Origin, and Allow-FROM
What is a Cross Site Request Forgery? - ANS-Where a user uses unauthorized commands
submitted from a user that the web application trusts
How do you mitigate a Cross Site Request Forgery?
,A) Make sure every HTTP request submitting a form or any other kind of input comes from the
same origin
B) Use a Cross Site Request Forgery Token which is required by every form or input on a site
C) Both A and B
D) None of the above - ANS-Both A and B
Where should the CSRF tokens be located in to keep a user's session from being vulnerable? -
ANS-The POST Request
What is a directory traversal attack? - ANS-A directory traversal attack is an injection of
directory code to try and navigate to a specific directory / file on a computer
What is the Directory Traversal vulnerability used for? - ANS-To read sensitive data within the
web application
What is the best way to mitigate directory traversal attack? - ANS-It is to not use user input
when making file system calls
What is a File Upload Vulnerability? - ANS-A flaw where the user can upload an arbitrary file to
the server and then visit it to execute code
What is used to test web applications?
A) NMAP
B) A scanner
C) A Vulnerability Scanner
D) Nothing - ANS-A Vulnerability Scanner
,When would you go public with a vulnerability found within a business website?
A) After a patch was released
B) Before the patch is released, after you have discussed it with the business
C) Before you tell the business and you go public immediately
D) Never and use it for your own exploits - ANS-After the patch was released
What is Integer Overflow? - ANS-Program assumes that a value is always positive, overflow
makes signed integer wrap and become negative
What is the return pointer?
A) Where the CPU returns to after completing a function
B) Where the CPU goes to next after completing a function
C) Where the CPU goes to after all functions are completed
D) Where the pointer is - ANS-Where the CPU goes to next after completing a function
What is a stack canary? - ANS-It is a value that sits before the return pointer of the stack.
What is Address Space Layout Randomization? - ANS-A protection that involves randomizing
the Memory address that a program gets loaded into each run
What is a Format String Vulnerability? - ANS-It occurs when you run printf in C without a
format string
How do you mitigate a Format String Vulnerability? - ANS-Never use printf without a format
string
, What kind of vulnerability is within a FTP Service?
A) Buffer Overflow
B) Integer Overflow
C) Command Injection
D) Nothing it is completely fine - ANS-Buffer Overflow
What is Metasploit? - ANS-A penetration testing tool used to automatically execute exploits
against targeted systems
What application is used when running Metasploit?
A) Linux
B) Kali Linux
C) Command Prompt
D) Its got its own application window - ANS-Kali Linux
Why are patch cycles important? - ANS-To keep all organizations up to date for all technology
that it uses to protect them against new and old vulnerabilities
Why is end of support for applications or technology important? - ANS-Because you should
never use applications or tech that is no longer supported from developers
What is Social Engineering?
A) Where engineering is done publicly
