What is the primary purpose of a vulnerability scanner in web application security testing?

To provide a guarantee that no vulnerabilities exist

To manually exploit vulnerabilities to gain access

To fix vulnerabilities automatically without human intervention

To automatically identify known vulnerabilities in the application

A threat modeling exercise for a web application that handles credit card payments identifies a potential threat of data interception during transmission. The team is considering using TLS, but also wants to ensure compliance with PCI DSS. Which approach is most appropriate?

Encrypt the data at the application layer before transmission.

Use a VPN for all traffic between the user and the application.

Rely on the network provider's security to protect the data.

Implement TLS with strong ciphers and ensure the application is configured to use HTTPS exclusively.

A security architect is threat modeling a web application that allows users to upload files. The team has limited resources and must prioritize threats. The application is internet-facing and stores files in a cloud bucket. Which threat should be prioritized first?

Malicious file upload leading to stored cross-site scripting (XSS) because it can affect all users who view the file.

Denial-of-service via uploading extremely large files because it can exhaust storage.

Phishing attacks using uploaded HTML files hosted on the same domain.

Unauthorized access to other users' files due to broken access control.

A penetration tester is testing a web application that uses a content management system (CMS) with many plugins. The tester wants to identify vulnerabilities in the plugins efficiently. Which approach is most effective?

Use a specialized scanner that checks for known CMS plugin vulnerabilities, then manually verify the findings.

Disable all plugins and test the core CMS only.

Manually review the source code of every plugin.

Run a generic web vulnerability scanner and rely on its results.

GIAC Certified Web Application Defender

Domain 5Objective 1

Security Testing GWEB Practice Questions (Page 9)

Part of the Security Testing and Cryptography domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 5–8 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

6concepts

Questions 41–45

41foundation · easy
What is the primary purpose of a vulnerability scanner in web application security testing?
Select an answer first
42expert · hard
A threat modeling exercise for a web application that handles credit card payments identifies a potential threat of data interception during transmission. The team is considering using TLS, but also wants to ensure compliance with PCI DSS. Which approach is most appropriate?
Select an answer first
43expert · hard
A security architect is threat modeling a web application that allows users to upload files. The team has limited resources and must prioritize threats. The application is internet-facing and stores files in a cloud bucket. Which threat should be prioritized first?
Select an answer first
44foundation · easy
Which structured approach is commonly used to identify threats by examining how an attacker could misuse the application's features?
Select an answer first
45expert · hard
A penetration tester is testing a web application that uses a content management system (CMS) with many plugins. The tester wants to identify vulnerabilities in the plugins efficiently. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.