GIAC WEB APPLICATION DEFENDER
(GWEB) EXAM WITH QUESTIONS AND
VERIFIED ANSWERS, PLUS DETAILED
RATIONALES/EXPERT VERIFIED FOR
GUARANTEED PASS 2026/LATEST
UPDATE/INSTANT DOWNLOAD PDF
1.
A web application receives a user_id parameter and uses it to retrieve an
account record. The developer validates that the parameter contains only
digits before converting it to an integer. Which security property is
MOST directly provided by this validation?
A. It guarantees that the authenticated user owns the requested account.
B. It reduces the possibility of injecting arbitrary SQL syntax through
that parameter.
C. It prevents session fixation.
D. It guarantees confidentiality of the returned account data.
Answer: B
Rationale: Numeric allowlisting constrains the input to an expected
representation and therefore makes SQL metacharacters and arbitrary
SQL syntax much harder to introduce through that parameter.
However, input validation alone does not establish authorization; an
attacker could potentially request another valid numeric account ID.
Authorization must separately determine whether the authenticated
principal is permitted to access that account.
2.
A developer constructs a database query as follows:
1
,SELECT * FROM users WHERE username = 'INPUT' AND password
= 'INPUT'
The application attempts to defend against SQL injection by removing
strings such as OR, UNION, and -- from user input. Why is this defense
fundamentally weak?
A. SQL injection can only occur through HTTP headers.
B. Attackers can often bypass blacklists through alternate syntax,
encoding, case variations, or unexpected database behavior.
C. SQL databases automatically ignore malicious characters.
D. Blacklists prevent SQL injection only when HTTPS is disabled.
Answer: B
Rationale: Blacklist filtering attempts to identify known malicious
patterns rather than enforcing what the application actually expects.
Attackers can frequently exploit alternate representations, database-
specific syntax, encoding transformations, or application parsing
differences. Parameterized queries are substantially stronger because
data is structurally separated from SQL code.
3.
An application uses a prepared statement:
SELECT * FROM accounts WHERE account_id = ?
and binds the user-supplied account ID as a parameter. What is the
PRIMARY security advantage?
A. The database cannot execute SELECT statements.
B. User input is treated as data rather than being interpreted as part of
the SQL statement structure.
C. The application automatically encrypts the database.
D. The application automatically verifies authorization.
2
,Answer: B
Rationale: Parameterized queries establish a separation between SQL
instructions and parameter data. Even if an attacker supplies SQL
metacharacters, the database driver treats the parameter as a value
rather than modifying the intended SQL syntax. Prepared statements
do not, by themselves, solve authorization, authentication, or every
possible SQL-related design problem.
4.
A web application displays a user's profile name directly inside an
HTML page without context-appropriate output encoding. An attacker
stores a malicious script in the profile name, and the script executes
whenever another user views the profile. What vulnerability is MOST
accurately described?
A. Stored XSS
B. Reflected XSS
C. CSRF
D. SQL injection
Answer: A
Rationale: Stored cross-site scripting occurs when attacker-controlled
content is persisted by the application and later delivered to victims.
Reflected XSS generally involves malicious input being reflected
immediately in a response without persistent storage. The critical
defensive control is context-appropriate output encoding, combined
with safe handling and validation of input.
5.
A search page accepts a q parameter and returns:
3
, Search results for: <user input>
The input is immediately reflected in the HTTP response and is not
stored server-side. An attacker crafts a URL that causes JavaScript to
execute when a victim visits it. What type of XSS is this?
A. Stored XSS
B. Reflected XSS
C. DOM-only SQL injection
D. Persistent CSRF
Answer: B
Rationale: The malicious input is reflected directly from the request
into the response rather than being persistently stored. This is the
classic reflected-XSS pattern. Proper context-aware output encoding is
a primary defense, while input validation and Content Security Policy
can provide additional layers.
6.
Which control is generally the MOST appropriate primary defense when
displaying untrusted text inside an HTML element?
A. HTML-context output encoding
B. Base64 encoding
C. MD5 hashing
D. IP address filtering
Answer: A
Rationale: Output encoding converts characters with special meaning
in the relevant output context into safe representations. The encoding
method must match the context—for example, HTML, HTML
attribute, JavaScript, CSS, or URL contexts have different escaping
4
(GWEB) EXAM WITH QUESTIONS AND
VERIFIED ANSWERS, PLUS DETAILED
RATIONALES/EXPERT VERIFIED FOR
GUARANTEED PASS 2026/LATEST
UPDATE/INSTANT DOWNLOAD PDF
1.
A web application receives a user_id parameter and uses it to retrieve an
account record. The developer validates that the parameter contains only
digits before converting it to an integer. Which security property is
MOST directly provided by this validation?
A. It guarantees that the authenticated user owns the requested account.
B. It reduces the possibility of injecting arbitrary SQL syntax through
that parameter.
C. It prevents session fixation.
D. It guarantees confidentiality of the returned account data.
Answer: B
Rationale: Numeric allowlisting constrains the input to an expected
representation and therefore makes SQL metacharacters and arbitrary
SQL syntax much harder to introduce through that parameter.
However, input validation alone does not establish authorization; an
attacker could potentially request another valid numeric account ID.
Authorization must separately determine whether the authenticated
principal is permitted to access that account.
2.
A developer constructs a database query as follows:
1
,SELECT * FROM users WHERE username = 'INPUT' AND password
= 'INPUT'
The application attempts to defend against SQL injection by removing
strings such as OR, UNION, and -- from user input. Why is this defense
fundamentally weak?
A. SQL injection can only occur through HTTP headers.
B. Attackers can often bypass blacklists through alternate syntax,
encoding, case variations, or unexpected database behavior.
C. SQL databases automatically ignore malicious characters.
D. Blacklists prevent SQL injection only when HTTPS is disabled.
Answer: B
Rationale: Blacklist filtering attempts to identify known malicious
patterns rather than enforcing what the application actually expects.
Attackers can frequently exploit alternate representations, database-
specific syntax, encoding transformations, or application parsing
differences. Parameterized queries are substantially stronger because
data is structurally separated from SQL code.
3.
An application uses a prepared statement:
SELECT * FROM accounts WHERE account_id = ?
and binds the user-supplied account ID as a parameter. What is the
PRIMARY security advantage?
A. The database cannot execute SELECT statements.
B. User input is treated as data rather than being interpreted as part of
the SQL statement structure.
C. The application automatically encrypts the database.
D. The application automatically verifies authorization.
2
,Answer: B
Rationale: Parameterized queries establish a separation between SQL
instructions and parameter data. Even if an attacker supplies SQL
metacharacters, the database driver treats the parameter as a value
rather than modifying the intended SQL syntax. Prepared statements
do not, by themselves, solve authorization, authentication, or every
possible SQL-related design problem.
4.
A web application displays a user's profile name directly inside an
HTML page without context-appropriate output encoding. An attacker
stores a malicious script in the profile name, and the script executes
whenever another user views the profile. What vulnerability is MOST
accurately described?
A. Stored XSS
B. Reflected XSS
C. CSRF
D. SQL injection
Answer: A
Rationale: Stored cross-site scripting occurs when attacker-controlled
content is persisted by the application and later delivered to victims.
Reflected XSS generally involves malicious input being reflected
immediately in a response without persistent storage. The critical
defensive control is context-appropriate output encoding, combined
with safe handling and validation of input.
5.
A search page accepts a q parameter and returns:
3
, Search results for: <user input>
The input is immediately reflected in the HTTP response and is not
stored server-side. An attacker crafts a URL that causes JavaScript to
execute when a victim visits it. What type of XSS is this?
A. Stored XSS
B. Reflected XSS
C. DOM-only SQL injection
D. Persistent CSRF
Answer: B
Rationale: The malicious input is reflected directly from the request
into the response rather than being persistently stored. This is the
classic reflected-XSS pattern. Proper context-aware output encoding is
a primary defense, while input validation and Content Security Policy
can provide additional layers.
6.
Which control is generally the MOST appropriate primary defense when
displaying untrusted text inside an HTML element?
A. HTML-context output encoding
B. Base64 encoding
C. MD5 hashing
D. IP address filtering
Answer: A
Rationale: Output encoding converts characters with special meaning
in the relevant output context into safe representations. The encoding
method must match the context—for example, HTML, HTML
attribute, JavaScript, CSS, or URL contexts have different escaping
4
