Using AI for Web Exploitation GOAA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team is using an AI-assisted vulnerability scanner to test a web application that is behind a Web Application Firewall (WAF). The scanner is generating a high number of false positives because the WAF is intercepting and blocking the scanner's requests. The team wants to reduce false positives while still discovering real vulnerabilities. Which approach is most effective?

   • AIncrease the scanner's request rate to overwhelm the WAF and force it to allow the traffic.
   • BUse the scanner's default payload set without modification to ensure compatibility with the WAF.
   • CConfigure the scanner to use WAF evasion techniques, such as payload encoding and request rate limiting, to avoid being blocked.
   • DDisable the WAF during the scan to allow the scanner to test the application without interference.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team wants to use AI to automate the discovery of vulnerabilities in a large web application with thousands of endpoints. The team has limited time and needs to prioritize the most likely vulnerable endpoints. Which approach should they take?

   • ARandomly select endpoints to scan to avoid bias.
   • BUse AI to generate a list of all possible vulnerabilities and manually test each one.
   • CRun a full vulnerability scan on every endpoint using an AI-powered scanner.
   • DUse an AI model trained on historical vulnerability data to score endpoints by likelihood of vulnerability, then run deeper scans on the top-scored endpoints.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A red team is automating a web exploitation workflow that includes scanning, exploitation, and data exfiltration. The workflow must be able to pause and resume if a step fails, and it must log all AI decisions for later review. Which architecture best supports these requirements?

   • AA manual workflow where a tester executes each step and records decisions in a spreadsheet.
   • BA single monolithic script that runs all steps sequentially and exits on the first error.
   • CA state-machine-based workflow where each step is a separate module that saves its state and can be retried independently.
   • DA containerized pipeline that restarts from the beginning if any step fails.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A penetration tester is assessing a custom web application that uses a search endpoint which reflects user input into an error message. The tester wants to use an AI-assisted tool to quickly identify injection points and generate a proof-of-concept payload. The tester must minimize false positives and ensure the payload is tailored to the application's backend. What should the tester do?

   • ARun a generic AI-powered fuzzer with a large wordlist of common SQL payloads and rely on the tool's built-in scoring to rank results.
   • BUse an AI model trained only on public vulnerability databases to generate a payload without providing any application-specific information.
   • CFeed the AI tool the application's source code and HTTP request/response pairs, then ask it to generate a context-specific SQL injection payload and validate it against the endpoint.
   • DManually craft a payload based on the error message and then use an AI tool to automate the exploitation of all other endpoints.
   Reveal Solution Discussion Select an answer first
6. 25foundation · medium

   Which component is typically part of an AI-powered automated exploitation workflow?

   • AA fixed set of payloads that never change
   • BA manual step that requires a human to approve every action
   • CA separate network that is isolated from the target
   • DA feedback loop that uses results to adjust subsequent actions
   Reveal Solution Discussion Select an answer first