C-SWCM study guide
C-SWCM · Work through your exam, one topic at a time.
The Certified Secure Web Application Engineer (C-SWCM) is a vendor-neutral credential aimed at developers, application security engineers, and penetration testers who need to find, exploit, and fix weaknesses in web applications. It sits at the intersection of offensive testing and defensive engineering: rather than only recognizing vulnerability names, candidates are expected to reason about how a flaw arises in code or configuration, how an attacker chains it, and what remediation actually holds up. The C-SWCM study guide has 9 sections and about 2,684 words.
01Web Application Security Fundamentals and Threat Modeling
A candidate must be fluent in the CIA triad as applied to web apps, the difference between a threat, a vulnerability, and a risk, and the trust-boundary concept: every point where data crosses from an untrusted zone (browser, third-party API, partner) into a trusted one (server logic, database) is a place to validate and authenticate. Know the OWASP Top 10 categories as themes (broken access control, injection, insecure design, misconfiguration, vulnerable components, identification/authentication failures, integrity failures, logging failures, SSRF) rather than memorized rankings, and know STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) as a per-element checklist mapped to data flows.
350 words, about 2 min02Authentication, Authorization, and Session Management
Separate authentication (who you are) from authorization (what you may do) and from session management (how state persists). Know password storage with adaptive hashing (bcrypt, scrypt, Argon2) and per-user salts; MFA categories (something you know/have/are) and why push-based MFA is vulnerable to fatigue attacks; and phishing-resistant factors such as FIDO2/WebAuthn.
295 words, about 1 min03Input Validation and Injection Flaws
Injection happens when untrusted data is interpreted as code or syntax by a downstream interpreter: SQL, NoSQL, OS shell, LDAP, XPath, template engines, and the browser (XSS). The durable defense is context-aware output encoding plus parameterization, not blocklists.
317 words, about 2 min04Cryptography and Secure Data Protection in Web Applications
Know the primitives and when each applies: symmetric encryption (AES-GCM, ChaCha20-Poly1305) for data at rest and bulk transport; asymmetric (RSA, ECDSA, Ed25519) for key exchange and signatures; hashing (SHA-256/384) for integrity; HMAC for authenticity with a shared key; and password hashing (bcrypt, scrypt, Argon2id) which is deliberately slow. Understand authenticated encryption (AEAD) and why encrypt-then-MAC or GCM tags prevent tampering.
290 words, about 1 min05Secure Coding Practices and Application Architecture
Secure coding is a set of defaults: validate at trust boundaries, encode at sinks, fail securely (deny by default), apply least privilege to processes, services, and database accounts, and avoid security-relevant race conditions (TOCTOU) by making checks atomic. Know secure defaults in frameworks: ORM parameterization, auto-escaping templates, CSRF middleware, secure cookie flags, and dependency pinning.
295 words, about 1 min06Web Application Penetration Testing and Vulnerability Assessment
Distinguish vulnerability assessment (breadth, known signatures, prioritized findings) from penetration testing (depth, chained exploitation, business impact). Know the phases: scoping and rules of engagement, reconnaissance, mapping and enumeration, vulnerability discovery, exploitation with proof, post-exploitation, reporting, and retest.
266 words, about 1 min07Web Server, API, and Cloud/Container Security
Know server hardening: minimal installed services, patched components, least-privilege service accounts, disabled directory listing and default pages, TLS configuration with modern ciphers, security headers (HSTS, CSP, X-Content-Type-Options, frame options), and safe error pages. Understand reverse proxies and load balancers as trust boundaries: forwarded headers must be set by the proxy, not the client.
286 words, about 1 min08Secure SDLC, Risk Management, and Compliance
Know the secure SDLC phases and the controls in each: security requirements and abuse cases at design, threat modeling, secure coding standards, code review and SAST in build, DAST and dependency/SCA scanning in test, hardening and configuration review in deploy, and monitoring in operations. Understand shift-left as early detection, not elimination of later testing.
313 words, about 2 min09Incident Response and Application Security Monitoring
Know the incident response lifecycle: preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Understand preparation artifacts: an IR plan, contact tree, playbooks, forensic tooling, and log retention.
272 words, about 1 min