GWEB Study Guide 2026: How to Pass on Your First Attempt

What You Are Actually Sitting: GWEB Format and Fees

GWEB stands for GIAC Certified Web Application Defender, issued by GIAC Certifications and administered by GIAC, LLC. If you have seen the same four letters attached to other credentials, set those aside: everything in this guide concerns the GIAC defender exam and nothing else. If you want a broader orientation first, our explainers on what GWEB certification is and what GWEB stands for cover the basics.

The exam itself is straightforward in structure:

Do the arithmetic once, early. Three hours for 75 questions gives you roughly 2.4 minutes per question on average. That sounds generous until you remember that an open-book exam tempts you to look things up, and every lookup costs real time. Our passing score breakdown explains how the 68% threshold applies, and the certification cost guide walks through the full pricing picture.

Reading the 18-Heading Outline Correctly

GIAC publishes its exam objectives as 18 headings. Crucially, the published source does not assign percentage weights to them. Any site that tells you "Domain X is 20% of the exam" is inventing a number. Treat the outline as 18 areas that can each appear, and plan accordingly. For a deeper walkthrough of each area, see our complete guide to all 18 content areas.

The headings, in GIAC's published order:

1. Access Control
2. AI/LLM and Microservices Security
3. Authentication
4. Browser Security Features and Clickjacking
5. Cloud Security and SSRF
6. Cross-Site Scripting and Cross-Site Request Forgery
7. Deserialization, Business Logic, and Concurrency
8. HTTP Protocol Introduction
9. Injection Foundations
10. MLSecOps and Threat Modeling
11. Oauth, OIDC, JWT, and SAML
12. REST and GraphQL API Security
13. Same Origin Policy, CORS, and Cross-Origin Attacks
14. Transport Security and Cryptography
15. Unicode and Internationalization Security
16. Web Architecture and Configuration
17. Web Services Security
18. XSS Defense and Client-Side Supply Chain

Notice how the list is shaped. It mixes durable web-security fundamentals (HTTP, injection, access control, authentication) with newer territory (AI/LLM, MLSecOps, cloud and SSRF). The word "Defender" in the credential name matters: expect questions that ask what control prevents, detects, or mitigates a flaw, not only how an attack works.

Building an Open-Book Index That Works

GWEB is open book, but only with paper references. Electronic references and internet access are prohibited, and so is any material containing exam or practice Q&A. That last rule has a practical consequence: do not paste practice-question content into your binder or index. Build your reference from your own notes, course books, and concept summaries. The rules live in GIAC's Proctored Exam Reference Guide, so read it before test day.

An open-book exam rewards a particular kind of preparation. The book cannot teach you a concept in the 2.4 minutes you have; it can only confirm a detail you already understand. Build your index around details that are easy to forget:

• HTTP header names and their exact directive syntax (security headers, caching, cookies)
• JWT claim names and the validation steps a relying party must perform
• OAuth and OIDC flow names, which parties exchange what, and which flow suits which client type
• Cookie attribute behavior and what each attribute actually restricts
• CORS request and response header pairings
• Injection context rules: which encoding or parameterization fits which output context

Identity, Access, and Token Domains

Four headings cluster around who you are and what you may do: Access Control, Authentication, Oauth, OIDC, JWT, and SAML, and parts of Web Services Security. Candidates often underestimate these because the concepts feel familiar. The exam tends to test the precise failure modes, not the definitions.

Candidates coming from a pen-testing background sometimes know how to break these systems but stumble on the defensive configuration question. Practice saying, for every attack you know, "what single control would have stopped this?"

Injection, Browser, and Cross-Origin Domains

The largest cluster of headings deals with how untrusted input becomes executable behavior and how browsers contain it: Injection Foundations, Cross-Site Scripting and Cross-Site Request Forgery, XSS Defense and Client-Side Supply Chain, Browser Security Features and Clickjacking, Same Origin Policy, CORS, and Cross-Origin Attacks, and Unicode and Internationalization Security.

Injection and output handling

Learn injection as a family, not a list: SQL, command, template, LDAP, XML, and similar flaws share one root cause, which is mixing data with instructions. The defensive pattern is equally consistent: separate the two with parameterization or context-correct encoding, validate input as a secondary layer, and apply least privilege to the interpreter's account. Be ready to choose the right defense for a given output context (HTML body, attribute, JavaScript, URL), since the wrong encoding in the wrong context is a classic trap.

XSS, CSRF, and their defenses

Know the XSS types (reflected, stored, DOM-based) and, more importantly, the layered defenses: output encoding, Content Security Policy, Trusted Types, and safe framework APIs. For CSRF, understand anti-forgery tokens, SameSite cookie behavior, and why token validation must be tied to the user session. The client-side supply chain portion asks you to think about third-party scripts: Subresource Integrity, script inventory, and limiting what a compromised dependency can reach.

The browser as a security boundary

The Same Origin Policy, CORS, framing controls, and browser security headers form a coherent story about what a page may read and do across origins. Misconfigured CORS (reflecting arbitrary origins, trusting null, combining wildcards with credentials) is a recurring defensive finding. Clickjacking defenses revolve around frame-ancestors policy and legacy framing headers.

Unicode surprises

Unicode and Internationalization Security is the heading candidates skip and then regret. Expect concepts such as normalization differences, homoglyph and lookalike characters, case-mapping surprises, and encoding mismatches between validation and use. The common thread: a filter that checks one representation while the backend interprets another.

Architecture, API, Cloud, and Emerging-Tech Domains

Because GIAC does not weight the headings, resist the temptation to skim the newer ones on the theory that they are small. Without published weights, you cannot know they are small.

Using SEC522 and Other Preparation Material

The recommended preparation is SANS SEC522, Application Security: Securing Web Applications, APIs, and Microservices. Training is optional; no prerequisites are required to begin the certification process (see our requirements guide for the full eligibility picture). If you take the course, remember what its materials are and are not. SANS course sections are a preparation curriculum, not an official exam blueprint, so they inform your topics without proving exhaustive exam coverage. Course hours and labs are also entirely separate from the 3-hour proctored exam. Our GWEB training overview covers the options in more detail.

Whether or not you take the class, the principle holds: map every resource back to the 18 headings. After each study session, write which heading it served. Gaps become visible fast, and they are usually in the unglamorous headings like Unicode, Web Services Security, or Web Architecture and Configuration.

For practice, use questions that test judgment rather than recall. Our GWEB practice tests are designed for that purpose, and the difficulty guide explains where candidates typically feel the squeeze. Keep the optional USD 399 GIAC practice exam in mind as a way to experience the real interface, but decide based on your budget; it is optional.

A Domain-Sequenced Study Plan

You have 120 days of initial access from activation for a standalone attempt, and extensions are available under GIAC's attempt delivery policy. Treat the 120 days as a ceiling, not a target, and sequence topics so related ideas reinforce each other. This is one possible eight-week arrangement for someone with working web-security familiarity:

If your schedule is tight, compare timelines in our exam dates and scheduling guide, and size your effort against the difficulty discussion in how hard the GWEB exam is.

Exam Day, Attempt Windows, and Renewal

Your testing modality is assigned by GIAC and delivered through Pearson VUE onsite or ProctorU remote. If you test remotely, confirm your room, equipment, and reference-material arrangement against the proctoring requirements ahead of time; a paper index that violates the rules is worse than none. Bring only permitted paper references.

For pacing, a sensible approach is a first pass that answers what you know quickly, flags what needs a lookup, and reserves the final stretch for flagged items. Because the pass line is 68% of 75 questions, you can afford some uncertainty, but you cannot afford to burn half your time hunting one answer in your index.

On passing, the credential is valid for 4 years. Renewal requires either 36 approved CPE credits earned during the active cycle or passing a renewal exam, plus the USD 499 renewal fee. If you are weighing career value, our ROI analysis, salary guide, and GWEB jobs overview discuss who tends to look for this credential, typically application security engineers, secure-development teams, and defensive web roles, without relying on made-up numbers. On difficulty, remember that GIAC publishes a passing score rather than a candidate pass rate; our pass rate article explains why no honest figure exists.

Frequently Asked Questions