Which access control model allows the owner of a resource to decide which other subjects can access that resource?

Attribute-Based Access Control (ABAC)

Role-Based Access Control (RBAC)

Discretionary Access Control (DAC)

A cloud storage service lets each user create folders and decide who can read or write to each folder. The service also has a system-wide policy that prevents any user from sharing a folder with a user from a blocked country. Which access control models are combined here?

RBAC for user-controlled sharing and ABAC for the country-based restriction

MAC for both sharing and country restriction

ABAC for both sharing and country restriction

DAC for user-controlled sharing and MAC for the country-based restriction

Which principle requires that no single individual should have the ability to perform all steps of a critical process?

Privilege escalation prevention

In which access control model are permissions assigned to roles, and users receive permissions by being assigned to those roles?

Attribute-Based Access Control (ABAC)

Discretionary Access Control (DAC)

Role-Based Access Control (RBAC)

A security tester is performing an access control assessment on a web application. The application has a feature that allows users to export their own data. The tester suspects an IDOR vulnerability. Which testing approach would be most effective in confirming the vulnerability?

Review the source code for missing authorization checks

Use a single account and change the user ID parameter to a random value

Use two different user accounts and exchange the export request tokens between them

Run an automated scanner with a large wordlist of user IDs

GIAC Certified Web Application Defender

Domain 2Objective 3

Access Control GWEB Practice Questions (Page 8)

Part of the Authentication and Session Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 36–40

36foundation · easy
Which access control model allows the owner of a resource to decide which other subjects can access that resource?
Select an answer first
37application · medium
A cloud storage service lets each user create folders and decide who can read or write to each folder. The service also has a system-wide policy that prevents any user from sharing a folder with a user from a blocked country. Which access control models are combined here?
Select an answer first
38foundation · easy
Which principle requires that no single individual should have the ability to perform all steps of a critical process?
Select an answer first
39foundation · easy
In which access control model are permissions assigned to roles, and users receive permissions by being assigned to those roles?
Select an answer first
40expert · hard
A security tester is performing an access control assessment on a web application. The application has a feature that allows users to export their own data. The tester suspects an IDOR vulnerability. Which testing approach would be most effective in confirming the vulnerability?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.