Which of the following is a common source of information for identifying vulnerable third-party components?

CVE databases and vendor security advisories

The application's marketing materials

What is the key characteristic of an actionable configuration finding in a penetration test report?

It lists every possible misconfiguration, regardless of relevance

It includes a clear description, evidence, and specific remediation steps

It only includes the risk rating without details

It uses technical jargon without explanation

Which of the following file types is commonly targeted during configuration testing to find sensitive data?

Image files such as .jpg or .png

JavaScript files used for client-side validation

CSS files that define page styling

Backup files with extensions like .bak or .old

Which of the following should be included in the report for a configuration finding to be useful for remediation?

The date the issue was discovered

The exact configuration change needed to fix the issue

The client's budget for fixing the issue

The name of the tester who found the issue

GIAC Web Application Penetration Tester

Domain 3Objective 1

Web Application Configuration Testing GWAPT Practice Questions (Page 1)

Part of the Configuration and Deployment Testing domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 9–16 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

10concepts

Questions 1–5

1foundation · easy
Which HTTP method, if enabled, could allow an attacker to modify or delete files on the web server?
Select an answer first
2foundation · easy
Which of the following is a common source of information for identifying vulnerable third-party components?
Select an answer first
3foundation · easy
What is the key characteristic of an actionable configuration finding in a penetration test report?
Select an answer first
4foundation · easy
Which of the following file types is commonly targeted during configuration testing to find sensitive data?
Select an answer first
5foundation · easy
Which of the following should be included in the report for a configuration finding to be useful for remediation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWAPT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWAPT” is a trademark of its owner, used for identification only.