- How GIAC Scopes the GWEB Exam
- Exam Format, Fees, and Testing Rules
- Protocol, Architecture, and Configuration
- Identity, Authentication, and Access Control
- Injection, XSS, CSRF, and Client-Side Defense
- Browser Security and Cross-Origin Controls
- APIs, Web Services, Cloud, and SSRF
- AI/LLM, MLSecOps, and Logic Flaws
- Transport Security, Cryptography, and Unicode
- Sequencing the 18 Domains
- Frequently Asked Questions
- GIAC publishes 18 objective headings for GWEB but assigns no official percentage weights to any of them.
- The exam is one proctored sitting: 75 questions, 3 hours, 68% minimum passing score.
- Open book applies to paper references only; electronic materials and practice Q&A content are prohibited.
- No prerequisites exist, and SANS SEC522 training is recommended but optional.
How GIAC Scopes the GWEB Exam
The GIAC Certified Web Application Defender (GWEB) credential is administered by GIAC Certifications. Its public certification page lists 18 exam-objective headings, and those headings are the authoritative scope statement for this article. If you want the bigger picture first, What Is GWEB Certification? covers the credential's purpose, and GWEB Certification offers a quick overview.
Two scoping details matter before you plan anything:
- No published weights. GIAC does not publish percentage weights for these domains, so any article claiming "Domain X is 12% of the exam" is inventing data. Treat all 18 as potentially testable and distribute your time by your own weaknesses.
- No separately versioned outline. The public page does not identify a versioned exam outline. The 68% passing score applies to exam versions released on or after 2011-04-01, which is a score-applicability date, not an outline edition.
Exam Format, Fees, and Testing Rules
GWEB is one web-based, proctored exam with 75 questions and a 3-hour limit. The minimum passing score is 68%. For a deeper look at what that threshold means in practice, see GWEB Passing Score 2026: Exactly What You Need to Pass. GIAC publishes a passing score but not a candidate pass rate, so be wary of any specific pass-rate figure; GWEB Pass Rate 2026: What the Data Shows explains what can and cannot be known.
| Item | GWEB Detail |
|---|---|
| Questions / time | 75 questions, 3 hours |
| Minimum passing score | 68% |
| Exam fee | USD 999 (tax excluded) |
| Retake | USD 899 |
| Optional practice exam | USD 399 |
| Renewal fee | USD 499 |
| Initial attempt access | 120 days from activation; extensions available |
| Proctoring | Pearson VUE onsite or ProctorU remote, per GIAC's assigned modality |
| Validity | 4 years |
The full cost picture, including how training changes the total, is broken down in GWEB Certification Cost 2026: Complete Pricing Breakdown. For scheduling mechanics, see GWEB Exam Dates 2026: Testing Windows, Deadlines & Scheduling.
Open book, with limits
GWEB allows paper references. Electronic references, internet access, and any materials containing exam or practice Q&A are prohibited. In practice this shapes how you prepare: a well-organized paper index of concepts, tools, and header names is valuable, while a pile of copied practice questions is both useless in the room and against the rules. Review GIAC's Proctored Exam Reference Guide before test day so nothing in your materials triggers a problem.
Eligibility
No prerequisites are required to begin the certification process, and training is optional. See GWEB Requirements 2026: Eligibility, Prerequisites & How to Qualify for the details.
Protocol, Architecture, and Configuration
Three domains form the foundation that every later topic builds on: HTTP Protocol Introduction, Web Architecture and Configuration, and Injection Foundations.
Domain 8: HTTP Protocol Introduction
You cannot reason about browser defenses or API attacks without fluency in how requests and responses actually work.
- Methods, status codes, and how servers and intermediaries interpret them
- Headers, cookies, and state management across stateless requests
- How proxies and tooling let you observe and modify traffic
Domain 16: Web Architecture and Configuration
Defenders must understand where a request travels and where misconfiguration creeps in.
- Layered architectures: front ends, application tiers, back-end services
- Secure server and framework configuration versus insecure defaults
- Error handling, information leakage, and hardening decisions
Domain 9: Injection Foundations
This domain establishes the core pattern behind many web vulnerabilities: untrusted data crossing into an interpreter.
- How data becomes code when input is mixed with commands
- Why validation, encoding, and safe APIs each play different roles
- Recognizing injection contexts rather than memorizing payloads
Candidates coming from a development background often find these domains comfortable but should still verify their HTTP detail. Candidates from an infrastructure background should spend extra time on injection reasoning.
Identity, Authentication, and Access Control
Four of the 18 headings concern who a user is and what they may do: Authentication, Access Control, Oauth, OIDC, JWT, and SAML, and, adjacent to them, Web Services Security.
- Authentication asks you to evaluate how identity is proven and where the process breaks: credential handling, session management, and recovery flows.
- Access Control tests whether you can tell authentication from authorization and recognize failures where the server trusts the client to enforce permissions.
- Oauth, OIDC, JWT, and SAML is a protocol-comparison domain. Know what each standard is designed to do, who the parties are, and which tokens carry which claims, and understand where implementations typically go wrong.
Injection, XSS, CSRF, and Client-Side Defense
Two headings deal directly with the browser as an attack surface: Cross-Site Scripting and Cross-Site Request Forgery (Domain 6) and XSS Defense and Client-Side Supply Chain (Domain 18).
Domain 6: Cross-Site Scripting and Cross-Site Request Forgery
The offensive-mechanics side: how these flaws arise and why they work.
- Reflected, stored, and DOM-based script injection and the contexts they exploit
- How CSRF abuses the browser's automatic credential handling
- The conceptual difference between the two: one runs attacker code, the other forges a victim's intent
Domain 18: XSS Defense and Client-Side Supply Chain
The defensive side, including third-party code risk.
- Context-aware output encoding and safe DOM handling
- Content Security Policy and Trusted Types, which the SANS SEC522 syllabus describes as client-side XSS defenses
- Risks introduced by externally loaded scripts and dependencies
Browser Security and Cross-Origin Controls
Browsers enforce much of the web's trust model, and three headings test whether you understand it: Browser Security Features and Clickjacking (Domain 4), Same Origin Policy, CORS, and Cross-Origin Attacks (Domain 13), and the browser-side halves of Domains 6 and 18.
- Same Origin Policy is the baseline: what scripts from one origin may and may not read from another.
- CORS is the controlled relaxation of that policy. Expect to reason about which misconfigurations let an untrusted origin read sensitive responses.
- Browser security features and clickjacking covers response-header and browser-level protections, plus the UI-redressing attack that frames a target page to trick clicks.
A useful mental model: the Same Origin Policy decides what is blocked by default, CORS decides which exceptions the server grants, and headers decide how the browser treats the page itself. Keeping those three layers distinct prevents most confusion.
APIs, Web Services, Cloud, and SSRF
Modern applications are mostly APIs and services, and four headings reflect that: REST and GraphQL API Security (Domain 12), Web Services Security (Domain 17), Cloud Security and SSRF (Domain 5), and AI/LLM and Microservices Security (Domain 2).
Domain 12: REST and GraphQL API Security
APIs move authorization decisions to every endpoint and object.
- How REST and GraphQL differ in attack surface and access-control pitfalls
- Object-level authorization, excessive data exposure, and query abuse
- Why API inventory and schema awareness matter to defenders
Domain 5: Cloud Security and SSRF
Server-side request forgery turns the application into a proxy for the attacker.
- How SSRF reaches internal services that outsiders cannot
- Why cloud-hosted environments raise the stakes of a successful SSRF
- Layered mitigations: validation, network controls, and least privilege
Web Services Security rounds out this group with the older but still examinable service-oriented patterns. Treat it as a distinct heading rather than assuming API knowledge covers it.
AI/LLM, MLSecOps, and Logic Flaws
Some headings go beyond classic web vulnerabilities. AI/LLM and Microservices Security (Domain 2) and MLSecOps and Threat Modeling (Domain 10) address newer architectures, while Deserialization, Business Logic, and Concurrency (Domain 7) targets flaws that scanners rarely find.
- AI/LLM and microservices: understand how model-backed features and distributed services expand trust boundaries and where untrusted input can influence behavior.
- MLSecOps and threat modeling: practice structuring a system, identifying trust boundaries, and reasoning about what could go wrong before code ships.
- Deserialization, business logic, and concurrency: these are about assumptions. Unsafe object reconstruction, workflows that can be skipped or repeated, and race conditions all stem from code trusting a sequence of events that an attacker can disturb.
Key Takeaway
Logic and concurrency flaws are hard to memorize and easy to reason about. For each scenario, ask what the developer assumed would happen in order, then ask what breaks if the order, timing, or count changes.
Transport Security, Cryptography, and Unicode
Two headings are narrower than they look. Transport Security and Cryptography (Domain 14) covers protecting data in transit and applying cryptographic primitives sensibly. Focus on what TLS provides, how certificate and configuration problems undermine it, and which cryptographic choices defenders should and should not make.
Unicode and Internationalization Security (Domain 15) is the heading candidates most often underestimate. Character encodings, normalization, and case mapping can let input slip past filters, then change meaning after validation. The defensive principle is consistency: normalize and validate at the right point, and apply encoding for the output context.
Sequencing the 18 Domains
Since GIAC publishes no weights, sequence by dependency rather than by assumed importance. This is the only study-planning section in this article, and it is tied to the headings above. For a full preparation approach, see GWEB Study Guide 2026: How to Pass on Your First Attempt.
Foundations
- HTTP Protocol Introduction, Web Architecture and Configuration, Injection Foundations
- Build the vocabulary every later domain assumes
Identity and Browser Trust
- Authentication, Access Control, Oauth/OIDC/JWT/SAML
- Same Origin Policy/CORS, Browser Security Features, XSS/CSRF, XSS Defense
Services and Modern Architectures
- REST/GraphQL, Web Services, Cloud and SSRF, AI/LLM and Microservices
- MLSecOps and Threat Modeling, Deserialization/Business Logic/Concurrency
Cross-Cutting Review
- Transport Security and Cryptography, Unicode and Internationalization
- Finalize your paper index and rehearse under timed conditions
If you are weighing whether the effort fits your career, How Hard Is the GWEB Exam? Complete Difficulty Guide 2026 and Is the GWEB Certification Worth It? Complete ROI Analysis 2026 can help. For roles that value this credential, see GWEB Jobs and GWEB Salary Guide 2026: Complete Earnings Analysis. When your concepts are solid, take timed questions on the GWEB practice test site, and use the GWEB Cheat Sheet 2026: One-Page Review of Must-Know Facts for a last-pass review.
Training and renewal
SANS SEC522 (Application Security: Securing Web Applications, APIs, and Microservices) is the recommended preparation, but its sections are an unweighted curriculum and do not define exhaustive exam coverage. Course hours, labs, and capstones are separate from the 3-hour proctored exam. More on options appears in GWEB Training. After passing, the certification is valid for 4 years; renewal requires 36 approved CPE credits earned in the cycle or a passing renewal exam, plus the renewal fee. You can also test your readiness with practice questions before you commit to a testing date.
Frequently Asked Questions
GIAC's public page for GIAC Certified Web Application Defender lists 18 exam-objective headings, from Access Control through XSS Defense and Client-Side Supply Chain. GIAC does not publish percentage weights for them.
One web-based, proctored exam with 75 questions and a 3-hour time limit. The minimum passing score is 68%. Your GIAC account's Certification Information governs the details of your purchased attempt.
Paper references are allowed because the exam is open book. Electronic references, internet access, and materials containing exam or practice Q&A are prohibited. Check GIAC's proctoring guidance before test day.
No. There are no prerequisites to begin the certification process, and training is optional. SANS SEC522 is the recommended preparation, but it is a separate purchase from the exam.
Four years. Renewal requires 36 approved CPE credits earned during the active cycle or a passing renewal exam, plus the USD 499 renewal fee.