A web application is being designed with a three-tier architecture: presentation, application, and data. The presentation tier is a single-page application (SPA) that communicates with the application tier via REST APIs. What is a key benefit of this architecture?

It reduces the number of HTTP requests between the client and server.

It eliminates the need for input validation on the server side.

The presentation tier can be developed and scaled independently from the application and data tiers.

It guarantees that the application is immune to SQL injection.

A web application allows users to upload profile pictures. The application stores the files on the server and serves them directly. What is the most important security control to implement?

Validate the file type by checking the file content, not just the extension.

Store the files in a database as BLOBs.

Rename the files to a random name with a .txt extension.

A company is deploying a web application to a staging environment that mirrors production. The staging environment uses the same database schema but with synthetic data. What is the primary reason to use synthetic data in staging?

To allow testers to modify data without affecting production.

To ensure the staging environment performs identically to production.

To reduce the cost of storage compared to production data.

To avoid exposing sensitive production data and comply with data protection regulations.

GIAC Certified Web Application Defender

Domain 1Objective 2

Web Architecture and Configuration GWEB Practice Questions (Page 7)

Part of the Web Application Foundations domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 6–10 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

10concepts

Questions 31–35

31application · medium
A web application is being designed with a three-tier architecture: presentation, application, and data. The presentation tier is a single-page application (SPA) that communicates with the application tier via REST APIs. What is a key benefit of this architecture?
Select an answer first
32application · medium
A web application allows users to upload profile pictures. The application stores the files on the server and serves them directly. What is the most important security control to implement?
Select an answer first
33foundation · easy
Which deployment environment is typically used for final validation and is designed to closely mirror the production environment?
Select an answer first
34application · medium
A company is deploying a web application to a staging environment that mirrors production. The staging environment uses the same database schema but with synthetic data. What is the primary reason to use synthetic data in staging?
Select an answer first
35application · medium
A web application uses a Content Security Policy (CSP) header to restrict the sources of scripts. The application also uses inline event handlers in HTML. After deploying the CSP, the inline event handlers stop working. Which CSP directive is most likely causing this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.

Web Architecture and Configuration GWEB Practice Questions (Page 7)

Questions 31–35

A web application is being designed with a three-tier architecture: presentation, application, and data. The presentation tier is a single-page application (SPA) that communicates with the application tier via REST APIs. What is a key benefit of this architecture?

A web application allows users to upload profile pictures. The application stores the files on the server and serves them directly. What is the most important security control to implement?

Which deployment environment is typically used for final validation and is designed to closely mirror the production environment?

A company is deploying a web application to a staging environment that mirrors production. The staging environment uses the same database schema but with synthetic data. What is the primary reason to use synthetic data in staging?

A web application uses a Content Security Policy (CSP) header to restrict the sources of scripts. The application also uses inline event handlers in HTML. After deploying the CSP, the inline event handlers stop working. Which CSP directive is most likely causing this?

Keep studying — Web Application Foundations