- What the Published Data Actually Shows
- Why GIAC Publishes a Passing Score, Not a Pass Rate
- The Exam Format Behind Any Pass-Rate Discussion
- What Each Attempt Costs You
- Where Candidates Lose Points: The 18 Domains
- Open Book Does Not Mean Easy
- A Domain-Ordered Preparation Sequence
- Who Sits for GWEB and Who Hires for It
- Frequently Asked Questions
- GIAC publishes a minimum passing score of 68%, not a candidate pass rate, for the GWEB exam.
- The exam is 75 questions in 3 hours, proctored, open book with paper references only.
- An attempt costs USD 999; a retake costs USD 899, so a failed first try is expensive.
- The exam objectives span 18 domains, with no official percentage weights published.
What the Published Data Actually Shows
Candidates searching for a GWEB pass rate usually want one number: the percentage of people who pass GIAC Certified Web Application Defender on their first try. That number is not something GIAC publishes. What the issuer does publish is a precise, verifiable set of exam parameters, and those parameters tell you more about your odds than a rumored percentage ever could.
Here is the verified data for the GIAC Certified Web Application Defender exam:
| Parameter | Published Value |
|---|---|
| Number of questions | 75 |
| Time allowed | 3 hours |
| Minimum passing score | 68% |
| Delivery | Web-based, proctored |
| Exam fee | USD 999 |
| Retake fee | USD 899 |
| Certification validity | 4 years |
| Candidate pass rate | Not published by GIAC |
Any site quoting a specific GWEB pass percentage is either guessing or borrowing a figure from somewhere else. This article will not do either. If you want the cut score in detail, see our dedicated guide to the GWEB passing score.
Why GIAC Publishes a Passing Score, Not a Pass Rate
The distinction matters for how you prepare. A passing score is a fixed standard: on exam versions released on or after 2011-04-01, you need 68% to pass. That is 51 correct answers out of 75 if every question is scored equally. Treat that arithmetic as an illustration of scale rather than a guarantee, because your purchased attempt is governed by the Certification Information inside your GIAC account, which defines the objectives, question types, format, and passing score for that specific attempt.
A pass rate, by contrast, depends on who is sitting the exam. A cohort of seasoned application security engineers who just finished SANS SEC522 will pass at a different rate than a group of generalist IT staff attempting it cold. Even if a number were published, it would describe the population, not you.
The Exam Format Behind Any Pass-Rate Discussion
The format drives difficulty more than any statistic. Seventy-five questions in three hours works out to roughly 2.4 minutes per question on average. That is generous for recall questions and tight for scenario questions that require you to read a request, spot the flaw, and choose the correct defensive control.
Proctoring and delivery
The exam is web-based and proctored. GIAC assigns the testing modality: Pearson VUE onsite or ProctorU remote, subject to GIAC's assignment. Review the GIAC proctoring page before you book so there are no surprises on exam day about your environment, identification, or workspace rules.
Reference materials
The exam is open book with paper references. Electronic references and internet access are prohibited, and materials containing exam or practice Q&A are prohibited too. The rules are laid out in the GIAC Proctored Exam Reference Guide and the proctor knowledge-base article, and you should read both before building your reference set.
Scheduling window
Initial standalone-attempt access is 120 days from activation, and extensions are available under GIAC's Certification Attempt Delivery policy. That window is your real deadline. For scheduling specifics, see our guide to GWEB exam dates and testing windows.
What Each Attempt Costs You
Because no pass rate exists to reassure you, the financial structure is the next best reason to prepare thoroughly. Prices exclude tax.
| Item | Cost (USD) |
|---|---|
| Exam attempt | 999 |
| Retake | 899 |
| Optional practice exam | 399 |
| Renewal | 499 |
A failed first attempt followed by a retake means 999 plus 899 in exam fees alone. That is the strongest argument for treating readiness seriously before you book. For a full breakdown including training, see the GWEB certification cost guide.
Before paying for the official practice exam, you can pressure-test yourself on the domain content with our GWEB practice tests to see which areas need work first.
Where Candidates Lose Points: The 18 Domains
The published scope covers 18 domains. GIAC does not assign official percentage weights in the cited source, so no domain can be declared "worth" a specific share of the exam. What you can do is recognize which domains are conceptually dense and which interlock, because weakness in one often spills into another. Our complete guide to all 18 GWEB content areas covers each one in depth; the clusters below show where the difficulty tends to concentrate.
Identity and Access: Authentication, Access Control, OAuth/OIDC/JWT/SAML
These domains test whether you can reason about who a caller is and what they may do, across both session-based and token-based designs.
- Distinguish authentication failures from authorization failures in a given scenario
- Understand how federation protocols and token formats fail when validation is incomplete
- Recognize access control flaws such as missing function-level checks
Browser-Side Defenses: XSS and CSRF, Browser Security Features and Clickjacking, SOP and CORS
This cluster rewards candidates who understand what the browser enforces versus what the server must enforce.
- Separate reflected, stored, and DOM-based cross-site scripting by where the unsafe data flows
- Know how Same Origin Policy and CORS interact, and how misconfiguration breaks isolation
- Match browser security features to the clickjacking and framing attacks they mitigate
Server-Side Flaws: Injection Foundations, Deserialization/Business Logic/Concurrency, Cloud Security and SSRF
These domains test how untrusted input becomes dangerous once it reaches an interpreter, a deserializer, or an internal network call.
- Trace injection from input to sink and choose the control that removes the root cause
- Reason about business logic and race conditions, which scanners rarely catch
- Understand how server-side request forgery abuses trust in cloud environments
Modern Architecture: AI/LLM and Microservices Security, MLSecOps and Threat Modeling, REST and GraphQL API Security, Web Services Security
These headings reflect how contemporary applications are built. Expect questions that ask you to apply familiar principles to newer surfaces.
- Apply threat modeling to decide where controls belong in a distributed design
- Know the distinct risk patterns of REST and GraphQL endpoints
- Recognize how service-to-service trust assumptions create exposure
Foundations and Edge Topics: HTTP Protocol Introduction, Transport Security and Cryptography, Web Architecture and Configuration, Unicode and Internationalization Security, XSS Defense and Client-Side Supply Chain
Foundational knowledge underpins every other cluster, and the edge topics reward careful reading.
- Read HTTP requests and responses fluently, including headers that carry security meaning
- Understand how character encoding and normalization can bypass input filters
- Know client-side defenses such as CSP and Trusted Types, which the SEC522 syllabus describes
Open Book Does Not Mean Easy
The open-book rule is the single most misread part of the exam. Paper references are permitted, which leads some candidates to assume they can look up everything. At roughly 2.4 minutes per question, you cannot. Flipping through a binder for every item burns time you need for the scenario questions that actually require thought.
The practical approach is to treat your paper references as an index to concepts you already understand, not a substitute for understanding. A reference set organized by the 18 domain headings lets you confirm a detail quickly, such as the exact name of a header or the behavior of a specific control, without hunting. Keep in mind the prohibition on materials containing exam or practice Q&A, and do not build your reference set from such sources.
For a compact set of facts worth committing to memory before you rely on any binder, see our GWEB cheat sheet.
A Domain-Ordered Preparation Sequence
Rather than a generic weekly template, sequence your study by dependency. Foundations first, because later domains assume them. The timeline below is one reasonable ordering built around the published domain names; adjust the length to fit your 120-day access window and your background.
Protocol and Architecture Foundations
- HTTP Protocol Introduction and Web Architecture and Configuration
- Transport Security and Cryptography
- Start building your paper reference index by domain
Identity and Access
- Authentication and Access Control
- OAuth, OIDC, JWT, and SAML
- Practice distinguishing authentication from authorization failures
Browser and Cross-Origin Defenses
- Same Origin Policy, CORS, and Cross-Origin Attacks
- Cross-Site Scripting and Cross-Site Request Forgery
- Browser Security Features and Clickjacking; XSS Defense and Client-Side Supply Chain
Server-Side and Modern Architecture
- Injection Foundations; Deserialization, Business Logic, and Concurrency
- Cloud Security and SSRF; REST and GraphQL API Security; Web Services Security
- AI/LLM and Microservices Security; MLSecOps and Threat Modeling; Unicode and Internationalization Security
Timed Review
- Run full 75-question, 3-hour timed sessions
- Revisit weak domains and tighten your reference index
This ordering is a suggestion, not an official curriculum. For a fuller plan, see our GWEB study guide.
The role of SANS SEC522
GIAC's recommended preparation is SANS SEC522: Application Security: Securing Web Applications, APIs, and Microservices. Training is optional, and no prerequisites are required to begin the certification process. Course hours, labs, and capstones are separate from the proctored exam time, and SEC522 sections are unweighted preparation curriculum rather than a definition of exam coverage. In other words, the course informs your preparation, but the exam objectives on GIAC's page define the scope. More on options in our GWEB training overview, and on eligibility in the GWEB requirements guide.
Key Takeaway
Because the pass rate is unpublished, build your own readiness signal: timed full-length practice under paper-reference conditions, with every domain covered and your weakest clusters revisited before you pay the USD 999 fee.
Who Sits for GWEB and Who Hires for It
Understanding the candidate population helps explain why a single pass rate would be misleading. GWEB targets people who build, test, and defend web applications and APIs: application security engineers, secure-code reviewers, DevSecOps practitioners, and developers moving into security roles. The domain list reflects that, mixing classic web flaws with API, cloud, and AI/LLM topics.
Employers who value this credential tend to be organizations that ship web software and need staff who can reason about its defenses: software companies, financial services firms, consultancies, and teams with security engineering functions. For role-level detail, see GWEB jobs, and for earnings context, the GWEB salary guide. Whether the investment makes sense for you is addressed in Is the GWEB certification worth it.
Keeping the credential current
The certification is valid for 4 years. Renewal requires 36 approved CPE credits earned during the active four-year cycle, or passing a renewal exam, plus the USD 499 renewal fee. If you hold the credential already, plan your CPE activity early rather than scrambling near the end of the cycle.
If you are still deciding whether to pursue it, our overview pages explain what GWEB certification is and how the credential is positioned. When you are ready to measure yourself against the real format, start with a timed session on the main practice test site.
Frequently Asked Questions
No. The cited GIAC exam source publishes a minimum passing score of 68%, not a candidate pass rate. Any specific pass percentage you see elsewhere is not an official GIAC figure.
The minimum passing score is 68%, applicable to exam versions released on or after 2011-04-01. Your GIAC account's Certification Information governs the passing score for your specific purchased attempt, so confirm it there.
The exam has 75 questions and a 3-hour time limit. It is web-based and proctored, delivered through Pearson VUE onsite or ProctorU remote depending on GIAC's assigned modality.
A retake costs USD 899, compared with USD 999 for the initial attempt, with prices excluding tax. Because a second attempt adds substantial cost, it is worth confirming readiness with timed practice before you book.
Yes, paper references are permitted since the exam is open book. Electronic references, internet access, and materials containing exam or practice Q&A are prohibited. Review GIAC's Proctored Exam Reference Guide for the exact rules, and see our GWEB difficulty guide for how open-book conditions affect pacing.