A user attempts to access a restricted page on a web application. The server responds with a 403 Forbidden status code. What does this status code indicate, and what should the user do?

The requested resource does not exist, and the user should check the URL.

The server encountered an internal error, and the user should try again later.

The request was successful, and the user should refresh the page to see the content.

The server understood the request but refuses to authorize it, and the user should verify their permissions or log in with an authorized account.

Which of the following is the correct order of the main components in a typical HTTP/1.1 request message?

Request line, headers, blank line, optional body

Optional body, request line, headers, blank line

Request line, optional body, headers, blank line

Headers, request line, blank line, optional body

GIAC Certified Web Application Defender

Domain 1Objective 1

Web Application and HTTP Basics GWEB Practice Questions (Page 7)

Part of the Web Application Foundations domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 6–10 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

9concepts

Questions 31–35

31application · medium
A user attempts to access a restricted page on a web application. The server responds with a 403 Forbidden status code. What does this status code indicate, and what should the user do?
Select an answer first
32foundation · easy
Which HTTP response header is used to instruct the browser to disable MIME type sniffing, reducing the risk of certain attacks?
Select an answer first
33foundation · easy
Which of the following is the correct order of the main components in a typical HTTP/1.1 request message?
Select an answer first
34expert · medium
A developer is creating a webhook endpoint that receives JSON payloads from a third-party service. The endpoint needs to parse the payload. Which part of the HTTP request should the developer inspect to extract the JSON data?
Select an answer first
35application · medium
A company is designing a new web application. The front-end will be a single-page application (SPA) that communicates with a back-end API. The back-end API will handle business logic and data storage. Which architectural component is responsible for handling HTTP requests from the SPA and returning JSON responses?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.

Web Application and HTTP Basics GWEB Practice Questions (Page 7)

Questions 31–35

A user attempts to access a restricted page on a web application. The server responds with a 403 Forbidden status code. What does this status code indicate, and what should the user do?

Which HTTP response header is used to instruct the browser to disable MIME type sniffing, reducing the risk of certain attacks?

Which of the following is the correct order of the main components in a typical HTTP/1.1 request message?

A developer is creating a webhook endpoint that receives JSON payloads from a third-party service. The endpoint needs to parse the payload. Which part of the HTTP request should the developer inspect to extract the JSON data?

Keep studying — Web Application Foundations