A web application team wants to improve its ability to detect and respond to attacks. Which logging practice is MOST effective for detecting a file upload attack?

Log all file upload attempts, including the filename, size, MIME type, user, and the result of validation checks.

Log only successful uploads to reduce storage overhead.

Log the IP address of every user but not the filename.

Log only errors and exceptions to minimize noise.

Why is client-side file upload validation considered insufficient as a security control?

It can be bypassed by sending a request directly to the server, bypassing the client-side checks

It requires a server-side component to function

It is too slow and impacts user experience

It only works for image files, not other types

What is the primary purpose of tuning WAF rules to minimize false positives?

To make the WAF rules more complex

To increase the speed of the WAF

To reduce the number of alerts that security analysts need to investigate

To ensure the WAF blocks all malicious traffic

Which of the following is a key component of an incident response plan for web application attacks?

A detailed network diagram of the entire internet

A list of all employee passwords

A backup of the application's source code on the same server

Defined roles and responsibilities for the incident response team

GIAC Certified Web Application Defender

Domain 4Objective 4

File Upload, Response Readiness, Proactive Defense GWEB Practice Questions (Page 7)

Part of the Advanced Threats and Defense domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 5–8 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

10concepts

Questions 31–35

31foundation · easy
In an incident response plan, which phase involves actions to limit the scope and impact of a security incident?
Select an answer first
32application · medium
A web application team wants to improve its ability to detect and respond to attacks. Which logging practice is MOST effective for detecting a file upload attack?
Select an answer first
33foundation · easy
Why is client-side file upload validation considered insufficient as a security control?
Select an answer first
34foundation · easy
What is the primary purpose of tuning WAF rules to minimize false positives?
Select an answer first
35foundation · easy
Which of the following is a key component of an incident response plan for web application attacks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.