GWEB by GIAC Actual Free Exam Q&As

Question 1

What is a common risk associated with file uploads in web applications?
Response:

A. Increased bandwidth usage B. Unauthorized execution of malicious files C. Slower page load times D. Inability to process large files

Discussion 0

Correct Answer: B Vote an answer

Question 2

In the context of web application security, what is the purpose of tokenization?
Response:

A. To encrypt data using a token-based system B. To validate data integrity C. To facilitate user authentication D. To replace sensitive data with non-sensitive substitutes

Discussion 0

Correct Answer: D Vote an answer

Question 3

What are common practices for preventing cross-origin attacks in web applications?
(Choose two)
Response:

A. Applying strict validation on cross-origin requests B. Using SameSite cookies C. Allowing all domains in CORS configuration D. Allowing cross-origin access without authentication

Discussion 0

Correct Answer: A,B Vote an answer

Question 4

When responding to incidents in a web application environment, which of the following steps should be taken first?
Response:

A. Conduct a post-mortem analysis to understand the breach's root cause. B. Contain the breach to prevent further unauthorized access. C. Notify the legal department immediately. D. Update the website's content to inform users about the incident.

Discussion 0

Correct Answer: B Vote an answer

Question 5

What are effective strategies for handling file uploads securely in web applications?
(Choose two)
Response:

A. Automatically executing scripts within uploaded files B. Limiting the types of files that can be uploaded C. Storing uploaded files outside the web root D. Using strong encryption algorithms for uploaded files

Discussion 0

Correct Answer: B,C Vote an answer

Question 6

In a typical three-tier web application architecture, the _______ tier is responsible for processing business logic, performing computations, and making decisions.
Response:

A. Presentation B. Data C. Business Logic D. Client

Discussion 0

Correct Answer: C Vote an answer

Question 7

Which vulnerability allows an attacker to bypass the Same-Origin Policy and access restricted resources?
Response:

A. Brute force attacks B. Cross-Origin Resource Sharing (CORS) misconfiguration C. SQL injection D. Directory traversal

Discussion 0

Correct Answer: B Vote an answer

Question 8

In the context of single sign-on (SSO), which of the following statements accurately describe its benefits?
(Choose Two)
Response:

A. SSO reduces the number of passwords users need to remember. B. SSO requires additional authentication steps for each application, enhancing security. C. SSO increases the complexity of password management. D. SSO can reduce help desk costs related to password resets.

Discussion 0

Correct Answer: A,D Vote an answer

Question 9

What is the primary role of a reverse proxy in a web application architecture?
Response:

A. To act as an intermediary for requests from clients seeking resources from servers. B. To encrypt outgoing server responses. C. To distribute load among several servers. D. To provide additional compute resources to a server.

Discussion 0

Correct Answer: A Vote an answer

Question 10

What is the primary defense mechanism against Cross-Site Scripting (XSS) attacks?
Response:

A. Validating and encoding user input B. Enforcing strong password policies C. Implementing strict session management controls D. Regularly updating the web server software

Discussion 0

Correct Answer: A Vote an answer

Question 11

What are best practices when setting up CORS to mitigate risks?
(Choose Two)
Response:

A. Allow credentials in CORS requests to all domains. B. Use Access-Control-Allow-Credentials with care. C. Specify a wildcard (*) in Access-Control-Allow-Origin for maximum compatibility. D. Define explicit origins rather than using wildcards.

Discussion 0

Correct Answer: B,D Vote an answer

Question 12

Which web technology commonly uses serialization to transfer data between client and server?
Response:

A. REST APIs B. XML C. JSON D. WebSockets

Discussion 0

Correct Answer: C Vote an answer

Question 13

Which of the following is a key security risk associated with the deserialization of untrusted data?
Response:

A. Increased latency in data processing B. Arbitrary code execution C. Loss of data granularity D. Unintended data type conversion

Discussion 0

Correct Answer: B Vote an answer

Question 14

Which of the following techniques can be used by an attacker to circumvent the same-origin policy?
(Choose Two)
Response:

A. Cross-site request forgery (CSRF) B. Cross-site scripting (XSS) C. SQL injection D. Phishing

Discussion 0

Correct Answer: A,B Vote an answer

Question 15

What is a key security risk when using SOAP-based web services?
Response:

A. Data corruption during transmission B. Injection attacks due to improper input validation C. Denial of service attacks D. Excessive response latency

Discussion 0

Correct Answer: B Vote an answer

GIAC Certified Web Application Defender - GWEB Exam Practice Test