A penetration tester is assessing a web application that uses a third-party authentication library. The tester wants to determine if the library is vulnerable to a known exploit. Which approach is most effective?

Run a generic vulnerability scanner and rely on its results.

Assume the library is secure because it is widely used.

Replace the library with a different one and re-test.

Check the library version against public vulnerability databases and then test the specific exploit against the application.

A company is planning a security test for a web application that is in continuous development. The team wants to identify vulnerabilities early but also wants to avoid disrupting the development pipeline. Which testing strategy best balances these needs?

Integrate automated security scanning into the CI/CD pipeline and run manual penetration tests on release candidates.

Run manual penetration tests only on the production environment.

Perform a single comprehensive penetration test after each major release.

Use only automated scanners and avoid manual testing to save time.

A penetration tester has completed a test and found a critical vulnerability that allows an attacker to read arbitrary files from the web server. The tester has documented the finding with a proof of concept. What is the MOST important element to include in the report to help the development team fix the issue?

The business impact of the vulnerability.

The name of the tool used to find the vulnerability.

The CVSS score of the vulnerability.

The exact HTTP request and response that demonstrates the vulnerability.

A security team is planning a test for a web application that handles personal data. The test must comply with data protection regulations. Which measure is most important to include in the test plan?

Use only automated tools to avoid human error.

Run the test during off-peak hours to minimize disruption.

Limit the test to a single tester to reduce exposure.

Ensure that any data used during testing is anonymized or synthetic.

A company is planning a penetration test for its new web application. The test must not disrupt the live environment, and the team wants to ensure the test is legally authorized. Which element is essential to include in the rules of engagement?

A schedule of when the test will be conducted.

A list of vulnerabilities the testers should look for.

The names of the testers and their certifications.

A clear definition of the authorized test scope, including allowed IP ranges and systems.

GIAC Certified Web Application Defender

Domain 5Objective 1

Security Testing GWEB Practice Questions (Page 10)

Part of the Security Testing and Cryptography domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 5–8 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

6concepts

Questions 46–50

46application · medium
A penetration tester is assessing a web application that uses a third-party authentication library. The tester wants to determine if the library is vulnerable to a known exploit. Which approach is most effective?
Select an answer first
47expert · hard
A company is planning a security test for a web application that is in continuous development. The team wants to identify vulnerabilities early but also wants to avoid disrupting the development pipeline. Which testing strategy best balances these needs?
Select an answer first
48application · medium
A penetration tester has completed a test and found a critical vulnerability that allows an attacker to read arbitrary files from the web server. The tester has documented the finding with a proof of concept. What is the MOST important element to include in the report to help the development team fix the issue?
Select an answer first
49application · medium
A security team is planning a test for a web application that handles personal data. The test must comply with data protection regulations. Which measure is most important to include in the test plan?
Select an answer first
50application · medium
A company is planning a penetration test for its new web application. The test must not disrupt the live environment, and the team wants to ensure the test is legally authorized. Which element is essential to include in the rules of engagement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.