- The Exam Snapshot: Numbers You Must Memorize
- Confirming Which GWEB This Is
- Fees, Access Window, and Proctoring Rules
- Open-Book Rules and What Goes in Your Paper Index
- The 18 Domains at a Glance
- High-Value Facts by Domain Cluster
- The XSS Defense Heading Caveat
- Who Uses This Credential
- Validity and Renewal Math
- Scheduling Domains Across Your Access Window
- Frequently Asked Questions
- GWEB is GIAC Certified Web Application Defender: one proctored exam, 75 questions, 3 hours, 68% minimum passing score.
- The exam is open book with paper references only; electronic materials and materials containing exam or practice Q&A are prohibited.
- Exam fee is USD 999, retake USD 899, renewal USD 499, and the certification stays valid for 4 years.
- GIAC publishes 18 objective headings but no percentage weights, so study breadth matters more than guessing weightings.
The Exam Snapshot: Numbers You Must Memorize
This one-page review is built around the facts GIAC actually publishes for the GIAC Certified Web Application Defender credential. If you only have ten minutes before a study session, start with the table below, then work through the domain clusters. For a slower, narrative walkthrough of preparation, pair this page with the GWEB study guide.
| Item | Fact |
|---|---|
| Credential | GIAC Certified Web Application Defender (GWEB) |
| Issuer | GIAC Certifications; administered by GIAC, LLC |
| Format | One web-based proctored exam |
| Questions | 75 |
| Time limit | 3 hours |
| Minimum passing score | 68% (applies to exam versions released on or after 2011-04-01) |
| Reference policy | Open book, paper references only |
| Prerequisites | None required to begin; training optional |
| Validity | 4 years |
| Initial attempt access | 120 days from activation (standalone attempt); extensions available |
A quick calculation worth doing now: 75 questions in 180 minutes leaves roughly 2.4 minutes per question on average. That sounds generous until you account for lookups in a paper index. Candidates who rely heavily on their books tend to feel the clock, which is why index design gets its own section below. For a deeper look at the scoring threshold, see our page on the GWEB passing score.
Confirming Which GWEB This Is
The acronym GWEB is used by more than one credential in the wider industry. This site and this cheat sheet cover only the GIAC Certified Web Application Defender. If a fee, date, or domain list you find does not mention GIAC, web application defense, and the 18 objective headings below, it likely belongs to something else. If you are new to the name, the explainers on what GWEB is and what GWEB stands for give the background.
Fees, Access Window, and Proctoring Rules
Price sheet (USD, excluding tax)
| Item | Price |
|---|---|
| Certification exam | $999 |
| Retake | $899 |
| Optional practice exam | $399 |
| Renewal | $499 |
Prices come from GIAC's published pricing page and exclude applicable tax. Training such as SANS SEC522 is a separate, optional purchase and is not included in these figures. The full breakdown, including how the retake and practice exam fit around a first attempt, is in the GWEB certification cost guide.
Access window and scheduling
A standalone attempt is available for 120 days from activation, and GIAC offers extensions. That window is your real deadline, so treat activation as the start of a clock rather than a formality. The practical details of testing windows are covered in GWEB exam dates.
Proctoring
The exam is web-based and proctored. GIAC delivers through Pearson VUE (onsite) and ProctorU (remote), subject to the modality GIAC assigns to your attempt. Your GIAC account's Certification Information governs the specific objectives, question types, format, and passing score for the attempt you purchased, so check it after activation instead of assuming.
Open-Book Rules and What Goes in Your Paper Index
GWEB is open book, but only with paper references. Electronic references and internet access are prohibited, and so are materials containing exam or practice Q&A. Read GIAC's Proctored Exam Reference Guide before test day, because proctors enforce what is on the table, not what you assumed was fine.
What an effective paper index covers
- Term-to-page mappings for acronyms and header names you will not remember exactly (CSP directives, CORS headers, HSTS parameters, JWT claims).
- Attack-to-defense pairs so a scenario question about a symptom leads you straight to the control (for example, an attack class on one line and the mitigations on the next).
- Protocol flow references for OAuth, OIDC, and SAML, since these questions often hinge on which party sends which artifact.
- Status codes and header behavior from the HTTP foundations material.
Key Takeaway
An index is a lookup tool, not a substitute for understanding. With about 2.4 minutes per question, you can afford a handful of lookups, not dozens. Build the index so the answer to "which domain is this?" is obvious within seconds.
The 18 Domains at a Glance
GIAC publishes 18 exam-objective headings and does not publish percentage weights for them. That means no domain can be safely skipped on the strength of a guessed weighting. The headings below are reproduced in GIAC's source order. For topic-level detail on each, read the complete guide to all 18 GWEB content areas.
- Access Control
- AI/LLM and Microservices Security
- Authentication
- Browser Security Features and Clickjacking
- Cloud Security and SSRF
- Cross-Site Scripting and Cross-Site Request Forgery
- Deserialization, Business Logic, and Concurrency
- HTTP Protocol Introduction
- Injection Foundations
- MLSecOps and Threat Modeling
- Oauth, OIDC, JWT, and SAML
- REST and GraphQL API Security
- Same Origin Policy, CORS, and Cross-Origin Attacks
- Transport Security and Cryptography
- Unicode and Internationalization Security
- Web Architecture and Configuration
- Web Services Security
- XSS Defense and Client-Side Supply Chain
High-Value Facts by Domain Cluster
Rather than treating 18 headings as 18 islands, group them. Many questions cross headings, and clustering helps you recognize which family of controls a scenario is testing.
Foundations: HTTP, Web Architecture, Injection
Covers HTTP Protocol Introduction, Web Architecture and Configuration, and Injection Foundations.
- Know how requests, responses, headers, cookies, and methods behave, because nearly every later domain assumes it.
- Understand how configuration choices in the web tier create or remove attack surface.
- Be able to explain why injection happens at a boundary where data becomes interpreted instructions, and which defense maps to which interpreter.
Identity and Access: Authentication, Access Control, Federation
Covers Authentication, Access Control, and Oauth, OIDC, JWT, and SAML.
- Distinguish authentication failures from authorization failures; scenario questions often test whether you can tell them apart.
- Know the roles and artifacts in OAuth, OIDC, and SAML flows, and what each token or assertion is meant to prove.
- Understand common JWT handling mistakes and how validation should work.
Browser-Side Defense: XSS, CSRF, SOP, CORS, Browser Features
Covers Cross-Site Scripting and Cross-Site Request Forgery, Same Origin Policy, CORS, and Cross-Origin Attacks, Browser Security Features and Clickjacking, and XSS Defense and Client-Side Supply Chain.
- Be able to say what the same-origin policy blocks and what CORS selectively relaxes.
- Match each browser-enforced control to the attack it addresses, including clickjacking defenses.
- Know how output handling, Content Security Policy, and Trusted Types fit together on the client side.
Service and API Layer: REST, GraphQL, Web Services, Microservices, Cloud
Covers REST and GraphQL API Security, Web Services Security, AI/LLM and Microservices Security, and Cloud Security and SSRF.
- Know why APIs shift risk toward object-level authorization and input handling.
- Understand server-side request forgery as a trust problem, especially in cloud environments where internal metadata services are reachable.
- Be ready for questions that apply classic web defenses to newer service patterns.
Application Logic and Data Handling: Deserialization, Business Logic, Unicode, Crypto
Covers Deserialization, Business Logic, and Concurrency, Unicode and Internationalization Security, and Transport Security and Cryptography.
- Understand why untrusted deserialization is dangerous and what safer patterns look like.
- Recognize race conditions and logic flaws that scanners miss.
- Know how character encoding and normalization can defeat filters, and how transport protections such as TLS configuration and HSTS fit in.
Process and Design: MLSecOps and Threat Modeling
This cluster is easy to under-prepare because it feels less hands-on.
- Practice applying a threat-modeling approach to a described system and identifying which control addresses which threat.
- Connect MLSecOps concepts to the secure-development practices you already know.
If you are wondering how demanding this breadth is in practice, the GWEB difficulty guide discusses where candidates most often feel stretched.
The XSS Defense Heading Caveat
Practically, this means you should study XSS defense and client-side supply chain risk as a topic in its own right. Do not rely on the outcome blurb to tell you what the heading covers.
Who Uses This Credential
GWEB targets people who defend web applications rather than only attack them: application security engineers, secure-code reviewers, DevSecOps practitioners, and developers moving into security-focused roles. Teams that run APIs, microservices, and cloud-hosted web properties tend to value the combination of browser-side, identity, and service-layer topics this exam spans. Because we do not have published salary or hiring data tied to specific figures, we avoid quoting numbers here; for qualitative discussion, see the GWEB jobs overview, the GWEB salary guide, and the ROI analysis.
Validity and Renewal Math
| Renewal Item | Detail |
|---|---|
| Validity period | 4 years |
| CPE route | 36 approved CPE credits earned during the active four-year cycle |
| Exam route | Pass a renewal exam |
| Renewal fee | $499 (applies in either case, per GIAC's renewal guidance) |
Start logging CPE-eligible activity early in the cycle. Thirty-six credits is easier to collect across four years than in the last few months, and GIAC's renewal guide explains what counts as approved.
Scheduling Domains Across Your Access Window
The 120-day access window is the one place where a schedule earns its keep, so tie it to domain order rather than a generic template. The plan below is a suggestion, not an official GIAC sequence.
Foundations first
- HTTP Protocol Introduction, Web Architecture and Configuration, Injection Foundations.
- Why first: every later domain assumes you can read a request and reason about a trust boundary.
Identity and browser controls
- Authentication, Access Control, Oauth, OIDC, JWT, and SAML, then the browser-side cluster.
- Why here: these are dense and protocol-heavy, and they reward repetition.
Services, cloud, and logic
- REST and GraphQL API Security, Web Services Security, Cloud Security and SSRF, Deserialization, Business Logic, and Concurrency, Unicode and Internationalization Security, Transport Security and Cryptography.
Newer topics, index, and timed practice
- AI/LLM and Microservices Security, MLSecOps and Threat Modeling.
- Finalize your paper index, then run timed sets against the 75-question, 3-hour format on the GWEB practice test site.
If you buy GIAC's optional practice exam ($399), save it for the final stretch so it measures readiness rather than teaching content. For additional timed drills, our practice questions help you rehearse pacing without touching any prohibited materials on exam day. Recommended training, if you choose it, is SANS SEC522: Application Security: Securing Web Applications, APIs, and Microservices; its course hours, labs, and capstones are separate from the proctored exam time. More on options is on the GWEB training page.
Frequently Asked Questions
The GIAC Certified Web Application Defender exam has 75 questions and a 3-hour time limit, delivered as a web-based proctored exam. Your GIAC account's Certification Information governs the specifics of your purchased attempt.
The minimum passing score is 68%, applicable to exam versions released on or after 2011-04-01. GIAC publishes this score but does not publish a candidate pass rate on its cited exam page.
Yes, it is open book, but only paper references are allowed. Electronic references, internet access, and materials containing exam or practice Q&A are prohibited. Review GIAC's Proctored Exam Reference Guide before test day.
No. GIAC publishes 18 exam-objective headings but no percentage weights in the cited source, so this article assigns none. Study all 18 rather than betting on a guessed weighting.
The certification is valid for 4 years. Renew by earning 36 approved CPE credits during the active cycle or by passing a renewal exam, and pay the $499 renewal fee. See GIAC's renewal how-to guide for what counts as approved.
For a broader introduction to the credential itself, start with GWEB certification, then return to this cheat sheet as a final-week refresher.