A development team is redesigning access control for a large web application. They want to ensure that all authorization decisions are made in one place and that new features default to denying access. Which best practice should they implement?

Centralized authorization middleware with a default-deny policy

Use client-side JavaScript to hide unauthorized buttons

Scatter authorization checks throughout the codebase for flexibility

Grant all users the same role and rely on obscurity

A web application uses a capability-based access control system where each user has a list of capabilities (e.g., 'read:file:123') stored in a signed token. The token is issued by the server and includes the user's ID. A security review finds that the token does not expire and can be replayed indefinitely. Which additional control would best mitigate the replay risk?

Store the token in a cookie with the Secure flag

Bind the token to the user's IP address

Add an expiration time to the token and require re-authentication after expiration

A penetration tester wants to identify IDOR vulnerabilities in a web application. Which testing approach is most effective for this purpose?

Review the source code for hardcoded credentials

Test for SQL injection in the login form

Run an automated vulnerability scanner with default settings

Intercept requests with a proxy and change object IDs to see if the response changes

A web application uses a capability-based access control mechanism where each user receives a signed token containing a list of allowed actions (e.g., 'read:file:123', 'write:file:123'). The token is stored in a cookie. A security review finds that the token is not bound to the user's session and can be replayed from another browser. Which additional control would most directly mitigate this issue?

Set the cookie's SameSite attribute to Strict

Bind the capability token to the user's session ID by including the session ID in the token signature

Use a MAC label on the token to enforce mandatory access control

Use HTTPS to encrypt the cookie in transit

GIAC Certified Web Application Defender

Domain 2Objective 3

Access Control GWEB Practice Questions (Page 2)

Part of the Authentication and Session Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 6–10

6foundation · easy
Which method of testing access control involves manually attempting to access restricted resources or functions using different user accounts?
Select an answer first
7application · medium
A development team is redesigning access control for a large web application. They want to ensure that all authorization decisions are made in one place and that new features default to denying access. Which best practice should they implement?
Select an answer first
8expert · hard
A web application uses a capability-based access control system where each user has a list of capabilities (e.g., 'read:file:123') stored in a signed token. The token is issued by the server and includes the user's ID. A security review finds that the token does not expire and can be replayed indefinitely. Which additional control would best mitigate the replay risk?
Select an answer first
9application · medium
A penetration tester wants to identify IDOR vulnerabilities in a web application. Which testing approach is most effective for this purpose?
Select an answer first
10application · medium
A web application uses a capability-based access control mechanism where each user receives a signed token containing a list of allowed actions (e.g., 'read:file:123', 'write:file:123'). The token is stored in a cookie. A security review finds that the token is not bound to the user's session and can be replayed from another browser. Which additional control would most directly mitigate this issue?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.

Access Control GWEB Practice Questions (Page 2)

Questions 6–10

Which method of testing access control involves manually attempting to access restricted resources or functions using different user accounts?

A development team is redesigning access control for a large web application. They want to ensure that all authorization decisions are made in one place and that new features default to denying access. Which best practice should they implement?

A penetration tester wants to identify IDOR vulnerabilities in a web application. Which testing approach is most effective for this purpose?

Keep studying — Authentication and Session Management