A security auditor is reviewing a web application that uses HTTPS. The auditor notices that the server's TLS certificate is signed by a certificate authority (CA) that is not trusted by the client's browser. What will happen when a user visits the site?

The browser will display a security warning, and the user may choose to proceed or leave the site.

The browser will block the site entirely and prevent the user from proceeding.

The browser will ignore the certificate and load the site over HTTP instead.

The browser will automatically trust the certificate and load the site without any warning.

A web application's API returns a 304 Not Modified status code for a GET request. What does this indicate to the client?

The server encountered an error while processing the request.

The requested resource has been permanently moved.

The client is not authorized to access the resource.

The client's cached version of the resource is still valid.

Which of the following is the correct structure of an HTTP response message?

Request line, headers, blank line, optional body

Status line, headers, blank line, optional body

Headers, status line, blank line, optional body

Status line, optional body, headers, blank line

GIAC Certified Web Application Defender

Domain 1Objective 1

Web Application and HTTP Basics GWEB Practice Questions (Page 6)

Part of the Web Application Foundations domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 6–10 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

9concepts

Questions 26–30

26expert · medium
A development team is building a RESTful API for a document management system. They need to allow clients to partially update a document's metadata (e.g., only the title) without sending the entire document. Which HTTP method should they use?
Select an answer first
27application · medium
A security auditor is reviewing a web application that uses HTTPS. The auditor notices that the server's TLS certificate is signed by a certificate authority (CA) that is not trusted by the client's browser. What will happen when a user visits the site?
Select an answer first
28foundation · easy
Which HTTP method is typically used to submit form data to a web application for processing, such as a login form?
Select an answer first
29expert · medium
A web application's API returns a 304 Not Modified status code for a GET request. What does this indicate to the client?
Select an answer first
30foundation · easy
Which of the following is the correct structure of an HTTP response message?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.

Web Application and HTTP Basics GWEB Practice Questions (Page 6)

Questions 26–30

A development team is building a RESTful API for a document management system. They need to allow clients to partially update a document's metadata (e.g., only the title) without sending the entire document. Which HTTP method should they use?

A security auditor is reviewing a web application that uses HTTPS. The auditor notices that the server's TLS certificate is signed by a certificate authority (CA) that is not trusted by the client's browser. What will happen when a user visits the site?

Which HTTP method is typically used to submit form data to a web application for processing, such as a login form?

A web application's API returns a 304 Not Modified status code for a GET request. What does this indicate to the client?

Which of the following is the correct structure of an HTTP response message?

Keep studying — Web Application Foundations