A penetration tester is assessing a web application that uses a combination of URL-based and method-based access control. The tester finds that by sending a DELETE request to /api/items/123, a regular user can delete an item that belongs to another user. The application checks the user's role for the DELETE method but does not check if the item belongs to the user. Which access control flaw is most directly demonstrated?

IDOR because the item ID is directly referenced and no ownership check is performed

Missing function-level access control because the DELETE method is not restricted by role

Privilege escalation because the user is able to escalate their role

Broken session management because the session token is not invalidated

A cloud-based document management system needs to grant access based on the user's department, the document's classification label, and the current time of day. The system must also ensure that a user cannot grant access to a document they do not own. Which access control model best fits these requirements?

Attribute-based access control (ABAC) with policies that evaluate department, classification, and time

Mandatory access control (MAC) with security labels

Role-based access control (RBAC) with roles for each department and document type

Discretionary access control (DAC) where the owner sets permissions for each document

GIAC Certified Web Application Defender

Domain 2Objective 3

Access Control GWEB Practice Questions (Page 6)

Part of the Authentication and Session Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 26–30

26foundation · easy
In a web application, which type of access control checks whether a user is allowed to perform a specific HTTP method (e.g., GET, POST, PUT, DELETE) on a given resource?
Select an answer first
27expert · hard
A penetration tester is assessing a web application that uses a combination of URL-based and method-based access control. The tester finds that by sending a DELETE request to /api/items/123, a regular user can delete an item that belongs to another user. The application checks the user's role for the DELETE method but does not check if the item belongs to the user. Which access control flaw is most directly demonstrated?
Select an answer first
28application · medium
A cloud-based document management system needs to grant access based on the user's department, the document's classification label, and the current time of day. The system must also ensure that a user cannot grant access to a document they do not own. Which access control model best fits these requirements?
Select an answer first
29foundation · easy
Which type of tool can be used to automate the detection of common access control issues, such as missing function-level access control?
Select an answer first
30foundation · easy
Which access control mechanism is an unforgeable token that grants a subject specific rights to an object?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.

Access Control GWEB Practice Questions (Page 6)

Questions 26–30

In a web application, which type of access control checks whether a user is allowed to perform a specific HTTP method (e.g., GET, POST, PUT, DELETE) on a given resource?

Which type of tool can be used to automate the detection of common access control issues, such as missing function-level access control?

Which access control mechanism is an unforgeable token that grants a subject specific rights to an object?

Keep studying — Authentication and Session Management