Which of the following correctly pairs an authentication factor with an example?

Inherence factor: a fingerprint

Inherence factor: a security question answer

Which of the following is an example of multi-factor authentication?

Entering a PIN and answering a security question

Entering a username and password

Entering a password and then a one-time code sent to your phone

Scanning your fingerprint twice

A developer is implementing session management for a new web app. They want to prevent an attacker from guessing a valid session token. Which approach is most important?

Use a token that expires after a short time.

Use a cryptographically secure random number generator to create the token.

Use a token that is a hash of the user's password.

Use a long token that includes the user's IP address.

A developer is reviewing the session token generation code of a web application. The current implementation uses `random.randint(100000, 999999)` to generate session IDs. What is the primary security concern?

The token has insufficient entropy and is predictable

The token is not rotated after login

The token is not transmitted over HTTPS

The token is not stored in a cookie

A web application's logout function only deletes the session cookie from the user's browser. What is the security flaw in this implementation?

The cookie is not set to Secure

The session remains valid on the server

The session token is not rotated

The logout does not redirect to a login page

GIAC Certified Web Application Defender

Domain 2Objective 1

Authentication GWEB Practice Questions (Page 4)

Part of the Authentication and Session Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

10concepts

Questions 16–20

16foundation · easy
Which of the following correctly pairs an authentication factor with an example?
Select an answer first
17foundation · easy
Which of the following is an example of multi-factor authentication?
Select an answer first
18application · medium
A developer is implementing session management for a new web app. They want to prevent an attacker from guessing a valid session token. Which approach is most important?
Select an answer first
19application · medium
A developer is reviewing the session token generation code of a web application. The current implementation uses `random.randint(100000, 999999)` to generate session IDs. What is the primary security concern?
Select an answer first
20application · medium
A web application's logout function only deletes the session cookie from the user's browser. What is the security flaw in this implementation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.