GIAC GWEB Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC Web Application Defender (GWEB) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GWEB certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GWEB Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC Certified Web Application Defender (GWEB) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC Web Application Defender exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GWEB Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GWEB Sample Questions:
01. Each server in an estate is configured by hand at build time, so insecure defaults and enabled sample features vary from host to host, and no one can say with confidence which settings are in force where.
Which practice best brings the configuration under control?
a) Place the servers behind a WAF that filters malicious requests.
b) Rotate the administrative credentials on each host regularly.
c) Run a dynamic scan against each running application to find exploitable flaws in its behavior at runtime.
d) Harden every host to a documented configuration baseline and verify the defaults were changed.
02. A checkout page pulls in several third-party convenience scripts, a chat widget, two analytics libraries, and a font loader, that each run in the page's own origin with full access to the DOM and the session. The team already pins each file and verifies its integrity on load. A review still rates the payment screen's exposure high, because any one of those providers, if compromised, executes as first-party code on that screen.
Which change most reduces that exposure?
a) Remove the non-essential third-party scripts and self-host or isolate the few that must remain.
b) Add a subresource integrity value so the browser refuses a script whose bytes were altered.
c) Require every third-party script to be delivered over an encrypted connection.
d) Restrict, with a Content Security Policy, which origins the page is permitted to load and execute scripts from.
03. During a live incident, responders are about to wipe and rebuild an affected host to get the service back quickly. The investigation into how the attacker got in has not yet been done.
What should happen before the host is wiped?
a) Notify affected users that an incident occurred.
b) Apply the latest patches and redeploy the host.
c) Restore the host from backup immediately to resume service.
d) Preserve forensic evidence from the host with defensible integrity, capturing and hashing the relevant data before any destructive action.
04. After eradicating an attacker's foothold, the team is deciding whether to return the service to production. Pressure is high to go live at once.
What should the recovery step include before the service is restored?
a) Return the service to production now and schedule the lessons-learned review for a later date, once the immediate pressure to restore has passed.
b) Confirm the exploited weakness is actually closed and monitor the restored service closely around go-live.
c) Force a password reset for all users and go live.
d) Restore the service and consider the incident closed.
05. Behind an API gateway that authenticates every caller, a GraphQL resolver returns a user node and its nested billing records. A caller substitutes another user's id in a nested selection and receives that user's billing data in the response.
Which control most directly closes this?
a) Cap how many records a single query is allowed to return.
b) Rely on the gateway having already authenticated the caller to grant access.
c) Encode the billing fields before returning them in the response.
d) Authorize each resolved object against the caller, not just the request.
06. An application enforces a rate limit and some access decisions using the client IP it reads from a forwarding header in the request. That header can be set by the client, and only the value added by the outermost proxy is trustworthy.
How should the client address be determined for these decisions?
a) Derive it at a trusted hop, ignoring client-supplied forwarding header values.
b) Require the request to arrive over HTTPS.
c) Trust the first value in the forwarding header.
d) Validate that the forwarding header value is a syntactically valid IP address before use.
07. During functional QA the running application is already being driven by the test suites. The team wants a technique that watches from inside the running process, ties an observed vulnerability back to the exact code path, and reports few false positives.
Which testing approach fits that need?
a) Static analysis of the application source performed before the build runs.
b) Software composition analysis of the project's declared third-party dependencies.
c) An external black-box scan driving the running app from the network perimeter.
d) Interactive testing that instruments the running app from within.
08. An upload endpoint accepts files with no size limit. An attacker submits very large files repeatedly, consuming storage and memory until the service degrades.
Which control most directly addresses this?
a) Accept only files whose extension is on an allowlist.
b) Scan each uploaded file for malware signatures.
c) Enforce a maximum accepted file size.
d) Store uploaded files outside the webroot.
09. The application writes the submitted username and the request's user-agent straight into its log lines. A tester submits values containing newline and control characters and succeeds in inserting forged entries that look like legitimate log records.
Which control prevents this?
a) Neutralize newline and control characters in values before writing them to the log.
b) Reject any submitted username that is not strictly alphanumeric before it is recorded anywhere in the application's log lines.
c) Encrypt the log files at rest.
d) Restrict who can read the log files.
10. A single-page app builds its runtime settings by recursively merging a user-supplied JSON document into a shared defaults object, copying every key it encounters. After one crafted document is processed, unrelated objects across the application begin returning an attacker-chosen property that their own code never set.
Which control best addresses this weakness?
a) Serve the settings document only over TLS so it cannot be altered in transit.
b) Confirm the uploaded document is syntactically valid JSON before the merge runs.
c) Allowlist the keys the merge may copy and reject any that target an object's prototype.
d) Encode each value in the document for its output context before writing it into the page.
Answers:
|
Question: 01 Answer: d |
Question: 02 Answer: a |
Question: 03 Answer: d |
Question: 04 Answer: b |
Question: 05 Answer: d |
|
Question: 06 Answer: a |
Question: 07 Answer: d |
Question: 08 Answer: c |
Question: 09 Answer: a |
Question: 10 Answer: c |
Note: For any error in GIAC Certified Web Application Defender (GWEB) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
