A government agency is deploying a web application that handles classified documents. The application must enforce a policy where documents labeled 'Top Secret' can only be read by users with a 'Top Secret' clearance, regardless of the document owner's wishes. The agency also wants to allow project managers to grant temporary access to specific documents for their team members. Which combination of access control models best meets these requirements?

MAC for the classification labels and DAC for the project manager's temporary grants

DAC for the classification labels and MAC for the temporary grants

ABAC for both the classification and the temporary grants

RBAC for the classification labels and ABAC for the temporary grants

A large web application uses a URL-based access control scheme where each resource is accessed via a path like /api/resource/{id}. The application uses a middleware that checks the user's role for each path prefix (e.g., /api/admin). However, the application also supports a legacy endpoint /api/v1/resource/{id} that does not go through the middleware. A penetration tester finds that by using the legacy endpoint, a regular user can access admin resources. What is the most effective remediation?

Remove the legacy endpoint entirely

Redirect all legacy requests to the new endpoint

Use a WAF to block access to the legacy endpoint

Apply the same authorization middleware to the legacy endpoint

A financial application uses role-based access control (RBAC). A user with the role 'auditor' can view transaction logs but should not be able to modify them. During a penetration test, the auditor role is able to submit a POST request to the log-editing endpoint, which is normally restricted to administrators. The application checks the user's role only on the front-end menu. Which combination of access control principles is most directly violated?

Discretionary access control and object-level authorization

Least privilege and separation of duties

Privilege escalation and centralized enforcement

Mandatory access control and need-to-know

GIAC Certified Web Application Defender

Domain 2Objective 3

Access Control GWEB Practice Questions (Page 3)

Part of the Authentication and Session Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 11–15

11expert · hard
A government agency is deploying a web application that handles classified documents. The application must enforce a policy where documents labeled 'Top Secret' can only be read by users with a 'Top Secret' clearance, regardless of the document owner's wishes. The agency also wants to allow project managers to grant temporary access to specific documents for their team members. Which combination of access control models best meets these requirements?
Select an answer first
12expert · hard
A large web application uses a URL-based access control scheme where each resource is accessed via a path like /api/resource/{id}. The application uses a middleware that checks the user's role for each path prefix (e.g., /api/admin). However, the application also supports a legacy endpoint /api/v1/resource/{id} that does not go through the middleware. A penetration tester finds that by using the legacy endpoint, a regular user can access admin resources. What is the most effective remediation?
Select an answer first
13foundation · easy
Which access control best practice states that access should be denied unless explicitly allowed?
Select an answer first
14application · medium
A financial application uses role-based access control (RBAC). A user with the role 'auditor' can view transaction logs but should not be able to modify them. During a penetration test, the auditor role is able to submit a POST request to the log-editing endpoint, which is normally restricted to administrators. The application checks the user's role only on the front-end menu. Which combination of access control principles is most directly violated?
Select an answer first
15foundation · easy
Which best practice for access control enforcement involves having a single, centralized component that makes all authorization decisions?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.

Access Control GWEB Practice Questions (Page 3)

Questions 11–15

Which access control best practice states that access should be denied unless explicitly allowed?

Which best practice for access control enforcement involves having a single, centralized component that makes all authorization decisions?

Keep studying — Authentication and Session Management