GIAC Web Application Defender (GWEB) Exam Syllabus
Use this quick start guide to collect all the information about GIAC GWEB Certification exam. This study guide provides a list of objectives and resources that will help you prepare for items on the GIAC Web Application Defender (GWEB) exam. The Sample Questions will help you identify the type and difficulty level of the questions and the Practice Exams will make you familiar with the format and environment of an exam. You should refer this guide carefully before attempting your actual GIAC Certified Web Application Defender (GWEB) certification exam.
The GIAC GWEB certification is mainly targeted to those candidates who want to build their career in Cloud Security domain. The GIAC Certified Web Application Defender (GWEB) exam verifies that the candidate possesses the fundamental knowledge and proven skills in the area of GIAC GWEB.
GIAC GWEB Exam Summary:
| Exam Name | GIAC Certified Web Application Defender (GWEB) |
| Exam Code | GWEB |
| Exam Price | $999 (USD) |
| Duration | 180 mins |
| Number of Questions | 75 |
| Passing Score | 68% |
| Books / Training | SEC522: Application Security: Securing Web Applications, APIs, and Microservices |
| Schedule Exam | PearsonVUE |
| Sample Questions | GIAC GWEB Sample Questions |
| Practice Exam | GIAC GWEB Certification Practice Exam |
GIAC GWEB Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Access Control | - The candidate will demonstrate understanding of access control attacks and mitigation strategies, as well as applying the best practice in avoiding access control issues. |
| AI/LLM and Microservices Security | - The candidate will demonstrate an understanding of best practices for securing AI/LLMs and microservices in the context of web application development. |
| Authentication | - The candidate will demonstrate understanding of web authentication, single sign on methods, third party session sharing and common weaknesses, as well as how to develop test strategies, and apply best practices. |
| Browser Security Features and Clickjacking | - The candidate will demonstrate understanding of methods attackers use to circumvent Same-Origin Policy enforcement and best practices for preventing, detecting or mitigating these attacks in web applications. |
| Cloud Security and SSRF | - The candidate will demonstrate understanding of server-side request forgery and the input validation, egress restrictions, and metadata-service protections. |
| Cross-Site Scripting and Cross-Site Request Forgery | - The candidate will demonstrate understanding of cross-site scripting and cross-site request forgery, the conditions that make them possible, and best practices for preventing and mitigating them. |
| Deserialization, Business Logic, and Concurrency | - The candidate will demonstrate understanding of insecure deserialization, business logic flaws, and concurrency issues such as race conditions, and best practices for preventing, detecting, and mitigating them. |
| HTTP Protocol Introduction | - The candidate will demonstrate understanding of the building blocks of web applications and how components work together to provide HTTP content as well as high level attack trends. |
| Injection Foundations | - The candidate will demonstrate understanding of injection vulnerabilities, including SQL and command injection, and best practices for preventing them through input validation and parameterization. |
| MLSecOps and Threat Modeling | - The candidate will demonstrate an understanding of using MLSecOps and threat modeling in the context of web application development. |
| Oauth, OIDC, JWT, and SAML | - The candidate will demonstrate understanding of how single sign-on delegates authentication across applications using federation protocols and signed tokens or assertions, and the trust validation and configuration controls that defend against assertion manipulation, token replay, and redirect abuse. |
| REST and GraphQL API Security | - The candidate will demonstrate understanding of REST and GraphQL API architecture, common attacks against APIs, and best practices for securing them. |
| Same Origin Policy, CORS, and Cross-Origin Attacks | - The candidate will demonstrate understanding of how the same-origin policy restricts cross-origin interactions, common attacks that abuse or bypass cross-origin mechanisms, and best practices for securely configuring CORS and cross-origin communication. |
| Transport Security and Cryptography | - The candidate will demonstrate understanding of how cryptographic components work together to protect web application data in transit and in storage and also when and where to use encryption or tokenization to protect sensitive information. |
| Unicode and Internationalization Security | - The candidate will demonstrate understanding of Unicode and internationalization security issues, common attacks such as normalization and encoding bypasses, and best practices for handling international text safely. |
| Web Architecture and Configuration | - The candidate will demonstrate an understanding of web application architecture and controls needed to secure servers and services that host web applications. |
| Web Services Security | - The candidate will demonstrate an understanding of Service Oriented Architecture (SOA), common attacks against web services components (SOAP, XML, WSDL, etc) and best practices for securing web services. |
| XSS Defense and Client-Side Supply Chain | - The candidate will demonstrate understanding of best practices for securing AI/LLMs and microservices in the context of web application development. |
To ensure success in GIAC GWEB certification exam, we recommend authorized training course, practice test and hands-on experience to prepare for GIAC Web Application Defender (GWEB) exam.
