A company is deploying a new web application that handles sensitive financial data. The security team requires defense in depth against CSRF. Which combination of controls provides the strongest protection?

SameSite=None cookies and a custom header check.

HttpOnly cookies and Secure flag.

SameSite=Strict cookies and a synchronizer token for all state-changing requests.

CORS allowlist and Content-Type validation.

Why is using 'Access-Control-Allow-Origin: *' together with 'Access-Control-Allow-Credentials: true' considered a dangerous CORS misconfiguration?

It only affects non-browser clients, so it is not a security risk for web applications.

It prevents the browser from sending any cross-origin requests, so it is not dangerous.

It permits any website to read responses to requests that include the user's credentials, potentially exposing sensitive data.

It allows any origin to make requests, but the browser will not send cookies, so it is safe.

A web application sets a session cookie with SameSite=Lax. A user is logged in and visits a malicious site that attempts a cross-origin POST request to change the user's password. What happens?

The browser sends the cookie only if the request is a top-level GET navigation.

The browser does not send the cookie with the cross-site POST request, blocking the CSRF attack.

The browser sends the cookie with the POST request, and the CSRF attack succeeds.

The browser blocks the request entirely because the site is cross-origin.

Which of the following is a best practice for mitigating cross-origin policy attacks?

Use a wildcard in Access-Control-Allow-Origin to simplify configuration.

Disable the same-origin policy in the browser to allow all cross-origin requests.

Validate the Origin header against a strict allowlist of trusted domains.

Rely solely on the Referer header to validate request origin.

An application allows users to embed images from other websites using tags. A security analyst warns that this could be abused to leak information. Which attack technique leverages the tag to bypass the same-origin policy?

Cross-site request forgery using the image request to trigger a state change.

DNS rebinding to make the image request go to an internal server.

Using the image's onerror event to infer information about the user's state.

Cross-origin resource sharing to read the image response.

GIAC Certified Web Application Defender

Domain 3Objective 3

Cross Origin Policy Attacks and Mitigation GWEB Practice Questions (Page 1)

Part of the Input Handling and Injection Flaws domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 4–6 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

7concepts

Questions 1–5

1application · medium
A company is deploying a new web application that handles sensitive financial data. The security team requires defense in depth against CSRF. Which combination of controls provides the strongest protection?
Select an answer first
2foundation · easy
Why is using 'Access-Control-Allow-Origin: *' together with 'Access-Control-Allow-Credentials: true' considered a dangerous CORS misconfiguration?
Select an answer first
3application · medium
A web application sets a session cookie with SameSite=Lax. A user is logged in and visits a malicious site that attempts a cross-origin POST request to change the user's password. What happens?
Select an answer first
4foundation · easy
Which of the following is a best practice for mitigating cross-origin policy attacks?
Select an answer first
5application · medium
An application allows users to embed images from other websites using <img> tags. A security analyst warns that this could be abused to leak information. Which attack technique leverages the <img> tag to bypass the same-origin policy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.