You are performing active reconnaissance on a web application and want to enumerate parameters accepted by a search endpoint. The application uses a REST API. Which technique is most effective?

Use Burp Suite's Intruder to fuzz the query string with a parameter wordlist

Send a DELETE request to the endpoint to see if it is accepted

Read the API documentation from a public source

A web application is built with a custom framework that does not reveal its identity in headers or error pages. You need to identify the framework to assess known vulnerabilities. Which combination of techniques is most likely to succeed?

Use Nmap's http-fingerprint script with a large database

Query the domain's WHOIS records for the framework name

Send a series of malformed HTTP requests to trigger framework-specific error messages

Analyze the structure of URLs and cookies, and search for framework-specific file signatures in the page source

What is the goal of mapping the application attack surface?

To identify all entry points and data flows that could be potential attack vectors

To create a backup of the application's source code

To test the application's performance under load

To determine the physical location of the servers

A penetration tester is performing active reconnaissance on a web application that is protected by a Web Application Firewall (WAF). The tester has already triggered a temporary IP block by sending too many requests during directory brute-forcing. The tester needs to continue enumerating parameters on a specific endpoint without being blocked again. Which approach is most effective?

Abandon active enumeration and rely solely on passive sources to map the parameters.

Switch to a different IP address or use a proxy rotation service to bypass the WAF's IP-based blocking.

Use a more targeted wordlist and manually craft requests to the specific endpoint, reducing the number of requests.

Wait for the block to expire, then resume the same brute-force with a slower rate and random delays.

A penetration tester wants to identify subdomains of a target domain without sending any traffic to the target's servers. Which passive technique is most appropriate?

Using Nmap to scan the target's IP range

Running a brute-force subdomain enumeration tool

Using certificate transparency logs

GIAC Web Application Penetration Tester

Domain 2Objective 1

Reconnaissance and Mapping GWAPT Practice Questions (Page 3)

Part of the Information Gathering and Tooling domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 11–19 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

7concepts

Questions 11–15

11application · medium
You are performing active reconnaissance on a web application and want to enumerate parameters accepted by a search endpoint. The application uses a REST API. Which technique is most effective?
Select an answer first
12expert · hard
A web application is built with a custom framework that does not reveal its identity in headers or error pages. You need to identify the framework to assess known vulnerabilities. Which combination of techniques is most likely to succeed?
Select an answer first
13foundation · easy
What is the goal of mapping the application attack surface?
Select an answer first
14expert · hard
A penetration tester is performing active reconnaissance on a web application that is protected by a Web Application Firewall (WAF). The tester has already triggered a temporary IP block by sending too many requests during directory brute-forcing. The tester needs to continue enumerating parameters on a specific endpoint without being blocked again. Which approach is most effective?
Select an answer first
15foundation · easy
A penetration tester wants to identify subdomains of a target domain without sending any traffic to the target's servers. Which passive technique is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWAPT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWAPT” is a trademark of its owner, used for identification only.