Examers.io
ExamsOrganizationsHow it worksPricingHelp & FAQ
Sign inStart free
GIAC (SANS)

GIAC Certified Web Application Defender

GWEBGIAC Web Application Defender

The GIAC Certified Web Application Defender (GWEB) certification validates your ability to secure web applications against the most common and dangerous vulnerabilities. It is designed for developers, security analysts, and architects who need hands-on skills to detect and prevent input validation flaws, cross-site scripting, SQL injection, and more. Earning GWEB proves you can implement effective defenses and protect your organization's web assets.

Practice Free Questions

674 practice questions · Updated 2026-07-30

5Domains
15Objectives
121Concepts
674Questions

GWEB Curriculum

Every domain, objective, and concept the GWEB exam measures.

Web Application and HTTP Basics

9 concepts · 49 questions
  1. HTTP Request Structure
  2. HTTP Response Structure
  3. HTTP Methods
  4. HTTP Status Codes
  5. HTTP Headers
  6. HTTP Sessions and Cookies
  7. HTTP and HTTPS
  8. Web Application Architecture
  9. Client-Server Model

Web Architecture and Configuration

10 concepts · 56 questions
  1. Web Architecture Fundamentals
  2. HTTP Protocol Basics
  3. Web Server Configuration
  4. Application Server and Middleware
  5. Client-Side Technologies
  6. Server-Side Technologies
  7. Database Integration
  8. Session and State Management
  9. Web Deployment Environments
  10. Web Security Fundamentals

Authentication

10 concepts · 55 questions
  1. Authentication fundamentals
  2. Authentication factors
  3. Password-based authentication
  4. Multi-factor authentication (MFA)
  5. Session management basics
  6. Session token generation and entropy
  7. Session token transmission and storage
  8. Session fixation and hijacking
  9. Session expiration and logout
  10. Session management best practices

Session Security & Business Logic

12 concepts · 52 questions
  1. Session Security Fundamentals
  2. Session Identifier Generation
  3. Session Identifier Transmission
  4. Session Identifier Storage
  5. Session Lifecycle Management
  6. Session Fixation Prevention
  7. Session Hijacking Prevention
  8. Logout and Session Termination
  9. Business Logic in Session Context
  10. Session-Based Access Control
  11. Session Data Integrity
  12. Session Security Testing

Access Control

7 concepts · 43 questions
  1. Access Control Models
  2. Access Control Mechanisms
  3. Privilege Management
  4. Access Control in Web Applications
  5. Access Control Vulnerabilities
  6. Access Control Testing
  7. Access Control Best Practices

CSRF

4 concepts · 27 questions
  1. CSRF Definition and Impact
  2. CSRF Attack Vectors
  3. CSRF Prevention Techniques
  4. CSRF Detection and Testing

Cross Origin Policy Attacks and Mitigation

7 concepts · 35 questions
  1. Same-Origin Policy
  2. Cross-Origin Resource Sharing (CORS)
  3. CORS Misconfigurations
  4. Cross-Site Request Forgery (CSRF)
  5. CSRF Mitigations
  6. Cross-Origin Policy Attacks
  7. Mitigation Strategies for Cross-Origin Attacks

AJAX Technologies and Security Strategies

8 concepts · 46 questions
  1. AJAX Fundamentals
  2. AJAX Security Risks
  3. Defending AJAX Endpoints
  4. Client-Side Security Controls
  5. Secure Data Transmission
  6. Handling Cross-Origin Requests
  7. AJAX-Specific Attack Mitigation
  8. Monitoring and Logging AJAX Activity

Modern Application Framework Issues and Serialization

6 concepts · 39 questions
  1. Identify Modern Framework Vulnerabilities
  2. Understand Serialization Fundamentals
  3. Detect Insecure Deserialization
  4. Exploit Deserialization Vulnerabilities
  5. Apply Mitigations for Deserialization
  6. Assess Framework-Specific Risks

Web Services Security

10 concepts · 49 questions
  1. Web Services Security Fundamentals
  2. XML Security
  3. JSON Security
  4. API Authentication and Authorization
  5. Web Services Input Validation
  6. Secure Communication for Web Services
  7. Web Services Rate Limiting and Throttling
  8. Web Services Logging and Monitoring
  9. Web Services Security Testing
  10. Web Services Security Best Practices

File Upload, Response Readiness, Proactive Defense

10 concepts · 47 questions
  1. File Upload Attack Vectors
  2. File Upload Validation Techniques
  3. Secure File Storage and Execution
  4. File Upload Defense Bypass Methods
  5. Incident Response Preparation
  6. Forensic Analysis and Evidence Handling
  7. Proactive Defense Strategies
  8. Web Application Firewall (WAF) Configuration
  9. Security Monitoring and Logging
  10. Patch and Vulnerability Management

Security Testing

6 concepts · 50 questions
  1. Security Testing Fundamentals
  2. Threat Modeling
  3. Vulnerability Scanning
  4. Penetration Testing
  5. Security Test Planning
  6. Test Execution and Reporting

Encryption and Protecting Sensitive Data

10 concepts · 51 questions
  1. Encryption Fundamentals
  2. Symmetric Encryption
  3. Asymmetric Encryption
  4. Hashing and Integrity
  5. Digital Signatures
  6. Transport Layer Security (TLS)
  7. Data at Rest Protection
  8. Key Management
  9. Common Cryptographic Attacks
  10. Compliance and Standards

Leading Edge Technologies and Web Security

3 concepts · 31 questions
  1. Identify leading edge technologies
  2. Understand web security implications
  3. Apply security testing to new technologies
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Practice Free Questions

Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for GWEB, so none is invented.