During a forensic investigation of a web application breach, an analyst needs to collect web server logs as evidence. The logs are stored on a Linux server. Which action is most important to maintain the chain of custody?

Open the log files in a text editor to review the contents and take screenshots.

Email the log files to the legal department for safekeeping.

Create a cryptographic hash of the log files and document the hash value, the collection time, and the collector's identity.

Copy the log files to a USB drive and store the drive in a secure location.

Which of the following is a common source for identifying known vulnerabilities in web application components?

The marketing department's product brochures

The organization's employee handbook

CVE (Common Vulnerabilities and Exposures) database

When conducting forensic analysis of a web application, which of the following is a key artifact to examine?

The organization's employee phone directory

The marketing department's social media posts

What is the primary purpose of maintaining a chain of custody for digital evidence?

To ensure the evidence is stored in a secure location

To make copies of the evidence for backup purposes

To document who handled the evidence and when, ensuring its integrity and admissibility in court

To encrypt the evidence so that only authorized personnel can read it

A developer is implementing file upload validation. The current code checks the file extension against a whitelist of allowed extensions and then saves the file with the original name. A security review found that an attacker can bypass the validation by uploading a file named 'shell.php%00.jpg'. Which bypass technique is being used, and what is the most effective countermeasure?

Content-type spoofing; validate the file's magic bytes.

Double extension; use a blacklist of dangerous extensions.

Path traversal; use a random filename.

Null byte injection; use a whitelist of allowed extensions and reject any filename containing a null byte.

GIAC Certified Web Application Defender

Domain 4Objective 4

File Upload, Response Readiness, Proactive Defense GWEB Practice Questions (Page 9)

Part of the Advanced Threats and Defense domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 5–8 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

10concepts

Questions 41–45

41application · medium
During a forensic investigation of a web application breach, an analyst needs to collect web server logs as evidence. The logs are stored on a Linux server. Which action is most important to maintain the chain of custody?
Select an answer first
42foundation · easy
Which of the following is a common source for identifying known vulnerabilities in web application components?
Select an answer first
43foundation · easy
When conducting forensic analysis of a web application, which of the following is a key artifact to examine?
Select an answer first
44foundation · easy
What is the primary purpose of maintaining a chain of custody for digital evidence?
Select an answer first
45application · medium
A developer is implementing file upload validation. The current code checks the file extension against a whitelist of allowed extensions and then saves the file with the original name. A security review found that an attacker can bypass the validation by uploading a file named 'shell.php%00.jpg'. Which bypass technique is being used, and what is the most effective countermeasure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.