After completing a penetration test, a tester needs to report a critical vulnerability to executives who are not technical. Which reporting approach is most effective?

Include the full technical exploit code and detailed HTTP requests in the executive summary.

Present a list of all vulnerabilities without prioritization.

Only state that a critical vulnerability was found and that the team is working on it.

Provide a high-level summary that explains the business risk, potential impact, and recommended remediation in non-technical terms.

What distinguishes penetration testing from vulnerability scanning?

Penetration testing actively exploits vulnerabilities to assess impact

Penetration testing is fully automated and requires no human skill

Penetration testing is performed only during the development phase

Penetration testing only checks for known vulnerabilities

A development team is building a new e-commerce feature that allows users to upload profile pictures. The security lead wants to identify potential threats before coding begins. Which threat modeling approach is most effective for this early stage?

Wait until the feature is deployed and run a vulnerability scanner to identify issues.

Review the OWASP Top 10 list and ensure the feature avoids all listed vulnerabilities.

Ask the developers to write secure code based on their experience and conduct a code review after implementation.

Conduct a STRIDE-based analysis of the upload feature, focusing on spoofing, tampering, and denial-of-service threats.

What is the primary purpose of security testing in the context of web application defense?

To replace the need for secure coding practices during development

To document the application's functionality for end users

To guarantee that the application is completely free of all security flaws

To identify and remediate vulnerabilities before an attacker can exploit them

What is the primary goal of threat modeling in the software development lifecycle?

To identify and prioritize potential threats to the application

To create user stories for the development team

To perform a penetration test on the application

To automate the deployment of security patches

GIAC Certified Web Application Defender

Domain 5Objective 1

Security Testing GWEB Practice Questions (Page 2)

Part of the Security Testing and Cryptography domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 5–8 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

6concepts

Questions 6–10

6application · medium
After completing a penetration test, a tester needs to report a critical vulnerability to executives who are not technical. Which reporting approach is most effective?
Select an answer first
7foundation · easy
What distinguishes penetration testing from vulnerability scanning?
Select an answer first
8application · medium
A development team is building a new e-commerce feature that allows users to upload profile pictures. The security lead wants to identify potential threats before coding begins. Which threat modeling approach is most effective for this early stage?
Select an answer first
9foundation · easy
What is the primary purpose of security testing in the context of web application defense?
Select an answer first
10foundation · easy
What is the primary goal of threat modeling in the software development lifecycle?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.