A penetration tester is asked to perform configuration testing on a web application. The client wants to know if the application is configured securely. Which of the following is the primary goal of configuration testing?

Measure the performance of the web server under load

Verify that the application meets functional requirements

Identify misconfigurations that could lead to unauthorized access or data disclosure

Ensure the application is compatible with all browsers

Why is it important to identify outdated third-party components during configuration testing?

They are incompatible with modern browsers

They always cause the application to crash

They may contain known vulnerabilities that can be exploited

In a web application security assessment, what is the primary purpose of configuration testing?

To identify misconfigurations that could expose sensitive data or allow unauthorized access

To verify that the application meets functional requirements

To measure the performance of the web server under load

To ensure the application is compatible with all web browsers

During configuration testing, which of the following is an example of a sensitive file that might be exposed by a web application?

A database connection string file

You have completed a configuration test and found several issues. The client's development team is resistant to fixing the issues because they believe the findings are not exploitable. What is the most effective way to communicate the findings?

Prioritize the findings by severity and provide a clear remediation plan.

Explain the business impact of each finding in non-technical terms.

Combine a proof-of-concept for the most critical findings with a business impact analysis for all findings.

Provide a proof-of-concept exploit for each finding to demonstrate the impact.

GIAC Web Application Penetration Tester

Domain 3Objective 1

Web Application Configuration Testing GWAPT Practice Questions (Page 3)

Part of the Configuration and Deployment Testing domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 9–16 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

10concepts

Questions 11–15

11application · medium
A penetration tester is asked to perform configuration testing on a web application. The client wants to know if the application is configured securely. Which of the following is the primary goal of configuration testing?
Select an answer first
12foundation · easy
Why is it important to identify outdated third-party components during configuration testing?
Select an answer first
13foundation · easy
In a web application security assessment, what is the primary purpose of configuration testing?
Select an answer first
14foundation · easy
During configuration testing, which of the following is an example of a sensitive file that might be exposed by a web application?
Select an answer first
15expert · hard
You have completed a configuration test and found several issues. The client's development team is resistant to fixing the issues because they believe the findings are not exploitable. What is the most effective way to communicate the findings?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWAPT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWAPT” is a trademark of its owner, used for identification only.