GIAC Certified Web Application Defender 認定 GWEB 試験問題:

1. What best practice should be followed when developing secure RESTful APIs?
Response:

A) Avoiding the use of standard HTTP methods
B) Implementing stateful session management
C) Utilizing API keys transmitted over HTTP headers
D) Restricting access with proper authentication and authorization

2. What is the primary function of WSDL (Web Services Description Language)?
Response:

A) To describe the format and communication protocols used by a web service
B) To monitor web service performance
C) To handle exceptions in web services
D) To authenticate users accessing web services

3. What is the primary purpose of using session tokens in web applications?
Response:

A) To increase bandwidth efficiency
B) To encrypt data during transmission
C) To maintain the user's session state between requests
D) To enhance the loading speed of the web application

4. What is the primary goal of implementing anti-automation controls in a web application?
Response:

A) To allow unrestricted access to all site resources
B) To prevent bulk data extraction from the site
C) To enhance the user experience by reducing server load
D) To increase the application's response time

5. Which of the following statements accurately describe the mitigation strategies against access control attacks?
(Choose Three).
Response:

A) Role-Based Access Control (RBAC) should be dynamically adjusted based on ongoing risk assessments.
B) Access logs should be ignored unless there is a known security breach.
C) Regular penetration testing should be conducted to identify and mitigate vulnerabilities.
D) All employees should have access to all systems to facilitate transparency and collaboration.
E) Multi-factor authentication should be used wherever possible.

質問と回答：