A web application uses cookies to maintain user sessions. After a user logs in, the application sets a session cookie without the Secure or HttpOnly flags. Which attack is the application most directly vulnerable to?

SQL injection via cookie manipulation

Server-side template injection via cookie values

Session hijacking via cookie theft over unencrypted HTTP

Cross-site request forgery (CSRF) via cookie-based authentication

A company is deploying a web application that uses a PHP front end and a Java-based backend service. The PHP front end communicates with the Java backend via HTTP. The operations team wants to ensure that the Java backend is not directly accessible from the internet. Which architecture should be used?

Use a reverse proxy to expose the Java backend to the internet

Expose the Java backend on a public IP with a strong firewall

Place the Java backend on a private network and allow only the PHP front end to access it

Run the Java backend on the same server as the PHP front end

GIAC Certified Web Application Defender

Domain 1Objective 2

Web Architecture and Configuration GWEB Practice Questions (Page 3)

Part of the Web Application Foundations domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 6–10 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

10concepts

Questions 11–15

11expert · medium
A web application is built with a microservices architecture. Each microservice is a separate application server that exposes REST APIs. The application also has a central API gateway that routes requests to the appropriate microservice. The security team wants to enforce authentication and authorization at a single point. Which component should be responsible for this?
Select an answer first
12foundation · easy
Which of the following is a server-side scripting language commonly used for web development?
Select an answer first
13application · medium
A web application uses cookies to maintain user sessions. After a user logs in, the application sets a session cookie without the Secure or HttpOnly flags. Which attack is the application most directly vulnerable to?
Select an answer first
14application · medium
A company is deploying a web application that uses a PHP front end and a Java-based backend service. The PHP front end communicates with the Java backend via HTTP. The operations team wants to ensure that the Java backend is not directly accessible from the internet. Which architecture should be used?
Select an answer first
15foundation · easy
Which web server setting is commonly used to restrict access to sensitive directories by specifying which clients are allowed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.

Web Architecture and Configuration GWEB Practice Questions (Page 3)

Questions 11–15

Which of the following is a server-side scripting language commonly used for web development?

A web application uses cookies to maintain user sessions. After a user logs in, the application sets a session cookie without the Secure or HttpOnly flags. Which attack is the application most directly vulnerable to?

Which web server setting is commonly used to restrict access to sensitive directories by specifying which clients are allowed?

Keep studying — Web Application Foundations