A company has separate development, testing, and production environments. A developer accidentally used production credentials in a test script. What is the best practice to prevent this from happening again?

Disable the production environment during testing.

Use the same credentials in all environments to simplify management.

Train developers to be more careful when writing scripts.

Use environment-specific configuration files and secret management tools to inject credentials at runtime.

A security analyst is reviewing the HTTP response headers of a web application. They notice that the 'X-Frame-Options' header is missing. What is the primary risk associated with this missing header?

The application's cookies are not protected from XSS.

The application is vulnerable to cross-site request forgery (CSRF).

The application may be embedded in a malicious page and used for clickjacking attacks.

The application is vulnerable to SQL injection.

A development team is preparing to deploy a web application to a production environment. They want to ensure that debugging information and detailed error messages are not exposed to end users, while still allowing support staff to diagnose issues. What should they configure in the production web server?

Disable all error reporting and logging to prevent any information from being leaked.

Redirect all errors to the application's home page so users see a generic page.

Enable custom error pages that display generic messages and log detailed errors to a server-side log file.

Set the server to display detailed error messages only to requests coming from internal IP addresses.

A web application processes sensitive personal data. The security team wants to ensure that data transmitted between the client and server is protected from eavesdropping. Which configuration is the most direct and effective measure?

Implement input validation on all server-side forms

Store passwords using a strong hashing algorithm

Enforce HTTPS with TLS on the web server and redirect all HTTP traffic to HTTPS

Use a strong password policy for user accounts

GIAC Certified Web Application Defender

Domain 1Objective 2

Web Architecture and Configuration GWEB Practice Questions (Page 6)

Part of the Web Application Foundations domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 6–10 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

10concepts

Questions 26–30

26application · medium
A company has separate development, testing, and production environments. A developer accidentally used production credentials in a test script. What is the best practice to prevent this from happening again?
Select an answer first
27application · medium
A team is choosing a server-side technology for a new web application. The application must handle high concurrency, support WebSockets for real-time features, and have a large ecosystem of libraries. The team has experience in JavaScript. Which technology is the most appropriate choice?
Select an answer first
28expert · hard
A security analyst is reviewing the HTTP response headers of a web application. They notice that the 'X-Frame-Options' header is missing. What is the primary risk associated with this missing header?
Select an answer first
29application · medium
A development team is preparing to deploy a web application to a production environment. They want to ensure that debugging information and detailed error messages are not exposed to end users, while still allowing support staff to diagnose issues. What should they configure in the production web server?
Select an answer first
30application · easy
A web application processes sensitive personal data. The security team wants to ensure that data transmitted between the client and server is protected from eavesdropping. Which configuration is the most direct and effective measure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.

Web Architecture and Configuration GWEB Practice Questions (Page 6)

Questions 26–30

A company has separate development, testing, and production environments. A developer accidentally used production credentials in a test script. What is the best practice to prevent this from happening again?

A team is choosing a server-side technology for a new web application. The application must handle high concurrency, support WebSockets for real-time features, and have a large ecosystem of libraries. The team has experience in JavaScript. Which technology is the most appropriate choice?

A security analyst is reviewing the HTTP response headers of a web application. They notice that the 'X-Frame-Options' header is missing. What is the primary risk associated with this missing header?

A web application processes sensitive personal data. The security team wants to ensure that data transmitted between the client and server is protected from eavesdropping. Which configuration is the most direct and effective measure?

Keep studying — Web Application Foundations