10 exam-style questions with answers and explanations, straight from our 1,030-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
The GWEB exam has 75 questions and runs 3 hours.
These 10 free GWEB questions are organized by exam domain, so you can see how each part of the GIAC Certified Web Application Defender blueprint is tested. Reveal the answer and explanation under each question.
An invoice leak is traced to a shared cache. Administrators may read invoices only within their own tenant, and invoice numbers can repeat across tenants. Database queries use the tenant from the validated session. Cache keys contain only invoice_number, however, and hits bypass access checks. Where must the tenant boundary be restored while retaining caching?
Correct answer: C - Include the authenticated tenant in cache keys and access checks.
The next queued action of a support assistant would export a customer's private conversation. The customer requested only a read-only answer; an instruction in a retrieved document triggered the export. No data has left the system, and the dispatcher can reject this operation without interrupting permitted retrieval. What should happen before dispatch?
Correct answer: A - Reject the export through application policy; continue permitted retrieval.
For payroll sign-ins, a relying party requires local user verification by PIN or biometric. The enrolled authenticator supports PIN-based user verification. A WebAuthn assertion passes its challenge, origin, RP-ID hash, stored-credential, and signature checks. The authenticator reports user presence (UP)=1 and user verification (UV)=0. How should the relying party assess this result?
Correct answer: B - Reject it because the required user verification was not established.
A user is signed in at https://accounts.example.com with a Secure, host-only session cookie explicitly marked SameSite=Strict. An attacker controls https://pages.example.com and induces the user's browser to submit a form POST to the account's contact-details endpoint. In the tested browser, the cookie accompanies the request and the update succeeds. The endpoint checks only the session. Which added control directly addresses this failure?
Correct answer: D - Validate a session-bound CSRF token before applying the requested change.
One POST enters a reverse proxy, but the backend records that POST followed by another request embedded in bytes the proxy treated as its body. The pooled backend connection uses HTTP/1.1. The forwarded message contains Content-Length and Transfer-Encoding, and inspection confirms different message-ending rules at the two components. The behavior persists with response caching disabled. This finding is best classified as:
Correct answer: A - Request smuggling caused by inconsistent HTTP message framing.
During a code review, a developer argues that binding the tenant value makes this document query safe: SELECT name, created_at FROM documents WHERE tenant_id = :tenant ORDER BY [sort input] The driver safely binds :tenant, but the bracketed text comes directly from the request. The API must retain two sort modes: name means name ASC; newest means created_at DESC. What should the reviewer recommend for the remaining injection risk?
Correct answer: B - Map name and newest to their respective fixed SQL fragments.
An identity provider uses the same trusted signing keys for ID Tokens addressed to web-portal and access tokens addressed to payments-api. The payments API accepts an ID Token with aud=web-portal because its signature, issuer, and validity period all check out. The API is supposed to accept only access tokens addressed to payments-api; no signing key has been exposed. What targeted correction prevents this substitution?
Correct answer: A - Require an access token with the payments-api audience.
An integrator overwhelms a GraphQL reporting service while staying within its HTTP request and query-depth limits. Each operation is shallow but contains hundreds of aliases for expensive reports. Resolver authorization is already enforced. The service must continue accepting newly written authorized queries without registration. Choose the additional control that limits this demand without closing that capability.
Correct answer: B - Enforce an operation cost budget that includes aliased resolver calls.
Replaying an intercepted TLS 1.3 early-data request through a second edge server produces a duplicate payment. No certificate key was compromised. The same API uses early data for read-only catalog requests, whose latency benefit must be retained. Which edge handling policy removes the demonstrated payment replay path?
Correct answer: D - Permit early data for catalog requests but exclude charge operations.
Registration follows this order: look up the submitted name, normalize it to NFC, then store it. The service must accept legitimate composed and decomposed international names and treat canonical equivalents as one identifier. Two sequential registrations succeed: one ends in é (U+00E9), the other in e plus combining acute (U+0065 U+0301). Both are stored with the same spelling. Which revised sequence satisfies the identity rule?
Correct answer: C - Apply NFC before lookup, then store that same value.
The GWEB exam also covers these domains. Drill them in the full free practice test:
The full bank has 1,020 more GWEB questions with explanations.
Continue in the free practice test →
View plans