During a penetration test, a tester notices that the target web application returns a custom 404 error page that includes the text 'Powered by WordPress'. The tester also observes that the main page HTML includes a link to '/wp-content/themes/twentyseventeen/'. However, the HTTP header 'X-Powered-By: PHP/7.4' is present. Which conclusion is most accurate?

The application is running PHP, but the WordPress indicators are irrelevant because they are only in error pages.

The application is definitely running WordPress with PHP 7.4.

The application likely runs WordPress on PHP, but the tester should verify by checking for other WordPress-specific files like wp-login.php.

The application is not WordPress because the X-Powered-By header only shows PHP.

What is the primary purpose of content discovery in web application reconnaissance?

To determine the IP address of the target server

To identify hidden or unlinked resources such as directories and files

To analyze the target's SSL certificate chain

To identify the operating system of the target server

During content discovery, you find that the application returns a 200 OK with a custom 'Not Found' page for non-existent paths. You need to distinguish real resources from false positives. Which approach is most reliable?

Compare the response body length of each discovered path to the baseline 404 page

Trust any response with a 200 OK status code

Check the response headers for a 'X-Custom-404' header

Use a larger wordlist to reduce false positives

An authorized penetration tester is performing active reconnaissance against a web application. The tester wants to enumerate the technologies used without causing disruption. The tester has access to Burp Suite and Nmap. Which combination of actions is most appropriate for this phase?

Send benign HTTP requests through Burp to observe responses, and use Nmap with a service-version detection script on the web port.

Run a DNS enumeration tool to find subdomains and then use a directory brute-forcer with a huge wordlist.

Use only search engines and WHOIS to gather technology information, avoiding any direct contact.

Use Nmap to scan all TCP ports on the web server and then run a full vulnerability scan with Burp's active scanner.

You are mapping an application's attack surface and need to identify all entry points, including API endpoints and file uploads. Which activity is most comprehensive?

Review the robots.txt file for disallowed paths

Spider the application and record all URLs and forms

Combine spidering with API documentation review and parameter fuzzing

Run a port scan to identify all services

GIAC Web Application Penetration Tester

Domain 2Objective 1

Reconnaissance and Mapping GWAPT Practice Questions (Page 7)

Part of the Information Gathering and Tooling domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 11–19 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

7concepts

Questions 31–35

31application · medium
During a penetration test, a tester notices that the target web application returns a custom 404 error page that includes the text 'Powered by WordPress'. The tester also observes that the main page HTML includes a link to '/wp-content/themes/twentyseventeen/'. However, the HTTP header 'X-Powered-By: PHP/7.4' is present. Which conclusion is most accurate?
Select an answer first
32foundation · easy
What is the primary purpose of content discovery in web application reconnaissance?
Select an answer first
33application · medium
During content discovery, you find that the application returns a 200 OK with a custom 'Not Found' page for non-existent paths. You need to distinguish real resources from false positives. Which approach is most reliable?
Select an answer first
34application · medium
An authorized penetration tester is performing active reconnaissance against a web application. The tester wants to enumerate the technologies used without causing disruption. The tester has access to Burp Suite and Nmap. Which combination of actions is most appropriate for this phase?
Select an answer first
35application · medium
You are mapping an application's attack surface and need to identify all entry points, including API endpoints and file uploads. Which activity is most comprehensive?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWAPT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWAPT” is a trademark of its owner, used for identification only.