A web service receives XML documents from external partners. Which vulnerability is most directly associated with processing XML that references external entities?

Cross-Site Request Forgery (CSRF)

XML External Entity (XXE) injection

What is the primary purpose of using TLS for web service communications?

To prevent distributed denial-of-service attacks.

To ensure that the server is running the latest software version.

To authenticate the client to the server using passwords.

To provide confidentiality and integrity of data in transit.

A SOAP web service is vulnerable to XML signature wrapping. An attacker can modify a signed SOAP message while keeping the signature valid. What is the most effective defense?

Validate the structure of the SOAP message and ensure the signed elements are the ones actually processed

Use a longer RSA key for the XML signature

Disable TLS on the SOAP endpoint

Require the client to send the signature in a separate header

What is the primary goal of an XML signature wrapping attack?

To encrypt the XML payload so that only the attacker can read it.

To move the signed element into a different part of the document while keeping the signature valid, so the application processes an unsigned malicious element.

To inject malicious XML tags that break the parser's schema validation.

To cause the XML parser to consume excessive memory and CPU.

Which testing activity is most likely to be performed by a penetration tester to identify authentication flaws in a web service?

Running a vulnerability scanner to check for outdated TLS versions.

Reviewing the source code for hardcoded credentials.

Attempting to bypass authentication by manipulating tokens or session identifiers.

Measuring the response time of the API endpoints.

GIAC Certified Web Application Defender

Domain 4Objective 3

Web Services Security GWEB Practice Questions (Page 4)

Part of the Advanced Threats and Defense domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 5–8 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

10concepts

Questions 16–20

16foundation · easy
A web service receives XML documents from external partners. Which vulnerability is most directly associated with processing XML that references external entities?
Select an answer first
17foundation · easy
What is the primary purpose of using TLS for web service communications?
Select an answer first
18application · medium
A SOAP web service is vulnerable to XML signature wrapping. An attacker can modify a signed SOAP message while keeping the signature valid. What is the most effective defense?
Select an answer first
19foundation · easy
What is the primary goal of an XML signature wrapping attack?
Select an answer first
20foundation · easy
Which testing activity is most likely to be performed by a penetration tester to identify authentication flaws in a web service?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.