GCIH Web App API Attacks Practice Question
Which TWO methods are effective for mitigating Mass Assignment vulnerabilities in RESTful APIs?
⚠ Common exam trap
Students often mistakenly select output encoding or parameterized queries, confusing Mass Assignment (an input binding issue during writes) with SQL injection or Cross-Site Scripting vulnerabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement strict input allow-lists for model binding
Mass Assignment occurs when an API endpoint automatically binds client-provided input to internal data models or database fields without explicit filtering. By using Data Transfer Objects (DTOs) or explicit allow-lists, developers ensure only intended fields are updated. This prevents attackers from overwriting sensitive fields like 'is_admin' or 'account_balance' that should not be exposed to user modification during standard API update operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement strict input allow-lists for model binding
Why this is correct
Defining an explicit allow-list of fields that the API is permitted to bind ensures that unexpected or sensitive fields provided by the client are ignored. This technique creates a secure boundary between external input and internal object properties, effectively neutralizing Mass Assignment risks.
- ✓
Use Data Transfer Objects (DTOs) for input mapping
Why this is correct
DTOs provide an intermediary layer that separates the API's external request schema from the internal database model. By explicitly mapping only safe fields from the DTO to the model, developers prevent unauthorized property modification, maintaining strict control over the data that reaches the backend storage.
- ✗
Always sanitize input for SQL injection patterns
Why it's wrong here
Sanitization is critical for preventing SQL injection but does not mitigate Mass Assignment. Mass Assignment is an architectural flaw in how data is mapped to objects, whereas SQL injection relates to the execution of malicious queries within the database layer.
- ✗
Increase the complexity of the API authentication token
Why it's wrong here
Authentication token complexity improves resistance against brute-force or credential theft attacks. It has no bearing on Mass Assignment, which typically occurs after a user has been successfully authenticated and is interacting with an endpoint that trusts user-provided data fields too implicitly.
- ✗
Disable all write operations on public API endpoints
Why it's wrong here
Disabling write operations would make the API non-functional for intended business purposes. Mitigation must focus on secure coding practices, such as input validation and DTO usage, rather than restricting core functionality, which would violate the availability requirements of the business service.
About these practice questions
This GCIH question is part of Courseiva's 322-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCIH practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCIH exam.