GIAC Certified Web Application Defender
Domain 1Objective 1
Web Application and HTTP Basics GWEB Practice Questions (Page 1)
Part of the Web Application Foundations domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 6–10 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)
49questions here
10free pages
9concepts
Questions 1–5
- 1
A web application's login form submits credentials via POST. After a successful login, the server responds with a 302 redirect to the dashboard. The client follows the redirect with a GET request. A security analyst notices that the POST request body is visible in the server logs, but the GET request to the dashboard does not contain the credentials. Which HTTP status code class and header combination is responsible for this behavior?
Select an answer first - 2
A developer is debugging an issue where a web application is not receiving the expected data from a form submission. The developer inspects the HTTP request in the browser's developer tools and sees the following request line: POST /submit HTTP/1.1. Which part of the HTTP request is missing from this line?
Select an answer first - 3
A web application uses cookies to maintain session state. The application needs to ensure that the session cookie is only sent over HTTPS connections. Which attribute should be set on the cookie?
Select an answer first - 4
A web application uses session cookies to maintain user login state. The application is accessed over HTTPS. Which combination of cookie attributes provides the strongest protection against session hijacking via network eavesdropping and cross-site scripting (XSS)?
Select an answer first - 5
In the client-server model, what is the primary role of the client in a web application?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.