A penetration tester is testing an application for IDOR vulnerabilities. The tester has a valid account and is able to access their own order details. Which of the following techniques is most effective for discovering IDOR vulnerabilities?

Use an automated scanner to fuzz all parameters with random values

Review the source code for missing authorization checks

Check if the application uses sequential order IDs

Intercept the request and change the order ID to a different value, then observe the response

A company is implementing a new web application. The security team wants to ensure that a user cannot perform two conflicting actions, such as creating a purchase order and approving it. Which access control principle should be enforced?

Privilege escalation prevention

A security tester is assessing a web application that uses role-based access control. The tester has two accounts: a regular user and an admin. The tester logs in as the regular user, captures the request to view a user profile, then logs in as the admin and captures the same request. The tester then replays the regular user's request while authenticated as the admin. What is the tester primarily testing for?

Privilege escalation by modifying the HTTP method from GET to POST

IDOR by changing the profile ID in the request

Missing function-level access control by comparing responses between roles

Session fixation by reusing the same session ID across accounts

A multinational corporation is deploying a document management system. The system must enforce that only users with a security clearance of 'Top Secret' can access documents labeled 'Top Secret', and this rule cannot be overridden by document owners. Additionally, the system must allow project managers to grant temporary access to their project documents to external consultants. Which access control model(s) should be used to satisfy both requirements?

Use ABAC with policies that include clearance and project attributes

Use RBAC with roles for clearance levels and project managers

Use a single DAC model where owners set all permissions

Use MAC for the classification labels and DAC for project documents

GIAC Certified Web Application Defender

Domain 2Objective 3

Access Control GWEB Practice Questions (Page 1)

Part of the Authentication and Session Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 1–5

1application · medium
A penetration tester is testing an application for IDOR vulnerabilities. The tester has a valid account and is able to access their own order details. Which of the following techniques is most effective for discovering IDOR vulnerabilities?
Select an answer first
2application · medium
A company is implementing a new web application. The security team wants to ensure that a user cannot perform two conflicting actions, such as creating a purchase order and approving it. Which access control principle should be enforced?
Select an answer first
3foundation · easy
Which access control mechanism is a list of permissions attached to an object that specifies which subjects can access it and how?
Select an answer first
4application · medium
A security tester is assessing a web application that uses role-based access control. The tester has two accounts: a regular user and an admin. The tester logs in as the regular user, captures the request to view a user profile, then logs in as the admin and captures the same request. The tester then replays the regular user's request while authenticated as the admin. What is the tester primarily testing for?
Select an answer first
5expert · hard
A multinational corporation is deploying a document management system. The system must enforce that only users with a security clearance of 'Top Secret' can access documents labeled 'Top Secret', and this rule cannot be overridden by document owners. Additionally, the system must allow project managers to grant temporary access to their project documents to external consultants. Which access control model(s) should be used to satisfy both requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.

Access Control GWEB Practice Questions (Page 1)

Questions 1–5

A penetration tester is testing an application for IDOR vulnerabilities. The tester has a valid account and is able to access their own order details. Which of the following techniques is most effective for discovering IDOR vulnerabilities?

A company is implementing a new web application. The security team wants to ensure that a user cannot perform two conflicting actions, such as creating a purchase order and approving it. Which access control principle should be enforced?

Which access control mechanism is a list of permissions attached to an object that specifies which subjects can access it and how?

Keep studying — Authentication and Session Management