A company is deploying MFA for a legacy web application that only supports username/password. The security team is evaluating options: (1) SMS one-time codes, (2) a mobile authenticator app with TOTP, (3) hardware security keys via WebAuthn. The user base includes employees in areas with poor cellular connectivity, and the company cannot issue hardware tokens to all employees immediately. Which option provides the best balance of security and usability under these constraints?

SMS one-time codes, because they work on any phone and do not require an app.

No MFA, because the legacy application cannot be changed.

TOTP via a mobile authenticator app, because it works offline and does not require a hardware token.

Hardware security keys, because they are the most phishing-resistant.

A security auditor is reviewing an authentication system that uses a password and a fingerprint scan. Which statement correctly classifies these factors?

Password is a possession factor, and fingerprint is a knowledge factor.

Both are possession factors because they are stored on the user's device.

Password is a knowledge factor, and fingerprint is an inherence factor.

Both are inherence factors because they are unique to the user.

A web application uses a session cookie to maintain state. The security team wants to ensure that the session token is not exposed to cross-site scripting attacks. Which configuration is most effective?

Set the SameSite attribute to Strict.

Set the HttpOnly flag on the session cookie.

Set the Secure flag on the session cookie.

A user provides a username and password to access an application. After successful verification, the application determines that the user is allowed to view only their own profile and not other users' profiles. Which two security concepts are being demonstrated in this scenario?

Authentication and authorization

Identification and authentication

Authentication and identification

Identification and authorization

A web application currently uses only a username and password for login. After a phishing incident, management mandates that all users must provide a second factor that is not easily phishable. The team wants to minimize friction and avoid requiring users to install a separate app. Which approach best satisfies the requirement?

Send a push notification to a mobile app that the user approves.

Ask the user to answer a set of personal security questions.

Implement WebAuthn with platform authenticators such as Windows Hello or Touch ID.

Require users to enter a one-time code sent via SMS text message.

GIAC Certified Web Application Defender

Domain 2Objective 1

Authentication GWEB Practice Questions (Page 9)

Part of the Authentication and Session Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

10concepts

Questions 41–45

41expert · hard
A company is deploying MFA for a legacy web application that only supports username/password. The security team is evaluating options: (1) SMS one-time codes, (2) a mobile authenticator app with TOTP, (3) hardware security keys via WebAuthn. The user base includes employees in areas with poor cellular connectivity, and the company cannot issue hardware tokens to all employees immediately. Which option provides the best balance of security and usability under these constraints?
Select an answer first
42application · easy
A security auditor is reviewing an authentication system that uses a password and a fingerprint scan. Which statement correctly classifies these factors?
Select an answer first
43application · easy
A web application uses a session cookie to maintain state. The security team wants to ensure that the session token is not exposed to cross-site scripting attacks. Which configuration is most effective?
Select an answer first
44foundation · easy
A user provides a username and password to access an application. After successful verification, the application determines that the user is allowed to view only their own profile and not other users' profiles. Which two security concepts are being demonstrated in this scenario?
Select an answer first
45application · medium
A web application currently uses only a username and password for login. After a phishing incident, management mandates that all users must provide a second factor that is not easily phishable. The team wants to minimize friction and avoid requiring users to install a separate app. Which approach best satisfies the requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.

Authentication GWEB Practice Questions (Page 9)

Questions 41–45

A security auditor is reviewing an authentication system that uses a password and a fingerprint scan. Which statement correctly classifies these factors?

A web application uses a session cookie to maintain state. The security team wants to ensure that the session token is not exposed to cross-site scripting attacks. Which configuration is most effective?

A user provides a username and password to access an application. After successful verification, the application determines that the user is allowed to view only their own profile and not other users' profiles. Which two security concepts are being demonstrated in this scenario?

Keep studying — Authentication and Session Management