GWEB certification: cost, exam format and objectives

What is the GWEB certification?

GWEB stands for GIAC Certified Web Application Defender. GIAC says it validates a practitioner’s expertise in handling the common web application errors that lead to most security problems, with hands-on experience of input validation flaws, cross-site scripting and SQL injection, and an understanding of authentication, access control and session management.

It is a defender’s certification. GIAC names application developers, application security analysts and managers, application architects, penetration testers who want to learn defensive strategies, auditors, and staff at PCI-compliant organisations as the audience.

GIAC lists no prerequisites, so the exam can be booked without a prior certification or course.

Source: GIAC — GIAC Certified Web Application Defender (GWEB). Checked 14 October 2026.

How much does the GWEB certification cost?

GIAC’s pricing page lists a standalone GWEB certification attempt at US$999. A retake costs US$899, an attempt extension US$479, the renewal US$499 and an official practice exam US$399. There are no demo questions for GWEB.

A missed proctored appointment costs a US$175 reseating fee and moves your deadline by seven days. Additional renewals within two years of a full-price renewal cost US$249. All prices are in US dollars and exclude sales tax.

If you take the training route, SANS lists the OnDemand version of SEC522 at US$8,260.

Source: GIAC — Certification pricing and fees. Checked 14 October 2026.

GWEB exam format and passing score

The GWEB exam is one proctored exam with 75 questions and a 3-hour time limit, which gives you about two and a half minutes per question.

GIAC has set the passing score at 68% for all candidates who receive the exam version released on or after 1 April 2011. GIAC asks candidates to check their GIAC account for the passing score that applies to their own attempt.

You can test remotely with ProctorU or onsite at a Pearson VUE test center, although GIAC notes that both options may not be available for every attempt. A standalone attempt is open for 120 days from activation.

Source: GIAC — GIAC Certified Web Application Defender (GWEB). Checked 14 October 2026.

Is the GWEB exam open book?

GIAC exams allow hardcopy material: original course books from training you attended, handwritten or printed notes and an index. They are not open internet or open computer, so no browser, no stored files and no devices.

With 18 objectives, a well-built index is what makes the open-book rule useful. Material that resembles practice or exam questions with answers is not allowed in the testing room.

Source: GIAC — Proctor program overview. Checked 14 October 2026.

What is on the GWEB exam?

GIAC publishes 18 exam certification objectives for GWEB, without weightings. The list has moved well beyond classic injection and XSS: OAuth, OIDC, JWT and SAML, REST and GraphQL APIs, SSRF and cloud metadata services, and AI/LLM security with MLSecOps all have objectives of their own.

• Access Control
• AI/LLM and Microservices Security
• Authentication — web authentication, single sign-on, third-party session sharing
• Browser Security Features and Clickjacking
• Cloud Security and SSRF — egress restrictions and metadata-service protection
• Cross-Site Scripting and Cross-Site Request Forgery
• Deserialization, Business Logic, and Concurrency
• HTTP Protocol Introduction
• Injection Foundations — SQL and command injection, input validation, parameterization
• MLSecOps and Threat Modeling
• OAuth, OIDC, JWT, and SAML — token replay, assertion manipulation, redirect abuse
• REST and GraphQL API Security
• Same Origin Policy, CORS, and Cross-Origin Attacks
• Transport Security and Cryptography — encryption vs tokenization
• Unicode and Internationalization Security
• Web Architecture and Configuration
• Web Services Security — SOAP, XML and WSDL
• XSS Defense and Client-Side Supply Chain

Source: GIAC — GIAC Certified Web Application Defender (GWEB). Checked 14 October 2026.

GWEB training: SANS SEC522

GIAC links GWEB to SANS SEC522: Application Security: Securing Web Applications, APIs, and Microservices. SANS lists it as five days instructor-led or 30 hours self-paced, worth 30 CPEs, with the OnDemand version at US$8,260. SANS notes that the course was streamlined to five days from its 2026 Cloud Security Exchange Summit onwards; earlier sessions ran over six days.

SANS says the class requires a basic understanding of web technology such as HTML and JavaScript, plus familiarity with SQL databases and the scripting languages used in modern web apps. The course is optional for the exam — GIAC does not require training.

Source: SANS Institute — SEC522 course page. Checked 14 October 2026.

GWEB practice test and how to prepare

GIAC sells an official GWEB practice exam for US$399. GIAC states that practice exams simulate the real exam, never include actual exam questions, and draw on a limited bank, so repeated tests can show the same question.

Prepare objective by objective, and for each attack write down the defensive control in your own words: parameterised queries for SQL injection, output encoding and CSP for XSS, signature and audience checks for JWT, egress filtering for SSRF. That list doubles as the core of your exam index.

Avoid exam dumps. GIAC’s exam integrity policy treats any use of or reference to dump sites with actual or possible GIAC questions as a violation, with sanctions up to revocation of GIAC certifications and bans from future GIAC certifications.

Source: GIAC — Exam integrity policy. Checked 14 October 2026.

GWEB renewal

GIAC certifications stay active when you collect 36 credits over four years. The GWEB renewal fee is US$499, and additional renewals within two years of a full-price renewal cost US$249.

Source: GIAC — Certification renewal. Checked 14 October 2026.

GWEB vs GWAPT

GWAPT, the GIAC Web Application Penetration Tester, covers the same territory from the attacker’s side. Its exam has 82 questions in 3 hours and a 71% passing score for the version released on or after 16 May 2016, against 75 questions and 68% for GWEB.

The choice follows your job. Developers, architects and application security teams who fix and design applications fit GWEB; testers who find the flaws fit GWAPT. GIAC publishes no salary figures for either certification.

Source: GIAC — GIAC Web Application Penetration Tester (GWAPT). Checked 14 October 2026.

GWEB practice questions

Certsqill’s GWEB practice questions are expert-developed and mapped to GIAC’s 18 exam objectives, from injection foundations to OAuth, API and AI/LLM security.

Each question comes with an explanation for every answer option, and your results build a readiness score per domain, so you can see whether federated authentication, cross-origin attacks or another objective needs more work before you sit the exam. A 7-day money-back guarantee applies.

GWEB questions people ask

What is the GWEB certification?

The GIAC Certified Web Application Defender, validating expertise in handling the common web application errors that lead to most security problems. Source: GIAC, checked 14 October 2026.

How much does the GWEB exam cost?

US$999 for a standalone attempt; a retake costs US$899 and a practice exam US$399, excluding sales tax. Source: GIAC pricing, checked 14 October 2026.

How many questions are on the GWEB exam?

75 questions in one proctored exam with a 3-hour limit. Source: GIAC GWEB page, checked 14 October 2026.

What is the GWEB passing score?

68% for exam versions released on or after 1 April 2011. Source: GIAC GWEB page, checked 14 October 2026.

Is the GWEB exam open book?

Yes, for printed books and notes; no internet, stored files or devices. Source: GIAC proctor program overview, checked 14 October 2026.

Which SANS course prepares for GWEB?

SEC522: Application Security: Securing Web Applications, APIs, and Microservices — five days instructor-led or 30 hours self-paced. Optional. Source: SANS Institute, checked 14 October 2026.

Are there prerequisites for GWEB?

GIAC lists none. SANS expects basic HTML, JavaScript and SQL knowledge for SEC522. Source: GIAC and SANS, checked 14 October 2026.

What is the difference between GWEB and GWAPT?

GWEB is defensive (75 questions, 68% to pass); GWAPT is web application penetration testing (82 questions, 71%). Both run 3 hours. Source: GIAC, checked 14 October 2026.

How do I renew GWEB?

Collect 36 credits over four years and pay the US$499 renewal fee. Source: GIAC, checked 14 October 2026.