What is the primary purpose of multi-factor authentication (MFA)?

To eliminate the need for passwords entirely.

To require users to authenticate from multiple devices.

To provide an additional layer of security by requiring two or more independent authentication factors.

To speed up the authentication process for users.

A developer is building a web application and needs to maintain user state after login. They decide to store the session token in a JavaScript variable. What is the primary security risk?

The token will be lost on page refresh

The token will not have a Secure flag

The token is exposed to XSS attacks

The token will be sent in the URL

Which of the following is an example of the 'possession' authentication factor?

A one-time passcode generated by a hardware token

A personal identification number (PIN)

A web application has a session timeout of 30 minutes. However, users complain that they are logged out while filling out long forms. The product manager wants to reduce user frustration without significantly increasing security risk. Which approach is most appropriate?

Implement a sliding expiration that resets the timeout after each request, but cap the total session length at 8 hours.

Use a JavaScript timer to keep the session alive by sending periodic requests.

Disable the timeout entirely and rely on logout.

Increase the timeout to 2 hours for all users.

A company is implementing MFA for its web application. They want to ensure that even if a user's password is phished, an attacker cannot log in. Which combination of factors should they require?

Password and a hardware security key (FIDO2)

Password and a one-time code sent via SMS

Password and a security question (e.g., mother's maiden name)

GIAC Certified Web Application Defender

Domain 2Objective 1

Authentication GWEB Practice Questions (Page 1)

Part of the Authentication and Session Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

10concepts

Questions 1–5

1foundation · easy
What is the primary purpose of multi-factor authentication (MFA)?
Select an answer first
2application · medium
A developer is building a web application and needs to maintain user state after login. They decide to store the session token in a JavaScript variable. What is the primary security risk?
Select an answer first
3foundation · easy
Which of the following is an example of the 'possession' authentication factor?
Select an answer first
4expert · hard
A web application has a session timeout of 30 minutes. However, users complain that they are logged out while filling out long forms. The product manager wants to reduce user frustration without significantly increasing security risk. Which approach is most appropriate?
Select an answer first
5application · medium
A company is implementing MFA for its web application. They want to ensure that even if a user's password is phished, an attacker cannot log in. Which combination of factors should they require?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.