A web application includes a third-party library that is known to be vulnerable. The library is only used on the client side and does not handle sensitive data. The application owner wants to deprioritize the fix. What is the best response from the penetration tester?

Remove the library entirely to eliminate the risk

Agree that the risk is lower, but still recommend updating the library to reduce supply-chain risk

Insist that the library must be updated immediately because any vulnerability is critical

Accept the risk and close the finding

Which of the following is a common insecure default in application frameworks?

Content Security Policy enabled

Session cookies marked as HttpOnly

Debug mode enabled in production

A web application uses a JavaScript library that is three years old and has a known critical vulnerability. The library is loaded from the same origin as the application. What is the most appropriate action for the penetration tester to recommend?

Load the library from a CDN to reduce the attack surface

Minify the library to make it harder to exploit

Update the library to the latest patched version

Add a Content Security Policy that restricts script sources

Which of the following is a common weakness in session management configuration?

Session cookies are marked as Secure

Session timeout is set to 30 minutes

Session tokens are long and random

Session tokens not invalidated after logout

A web server allows the OPTIONS method and responds with 'Allow: GET, HEAD, POST, OPTIONS, TRACE'. A security scanner flags TRACE as a vulnerability. The application team argues that TRACE is needed for debugging. What is the best recommendation?

Keep TRACE enabled and add a Content Security Policy

Replace TRACE with the HEAD method

Disable TRACE on the web server and use a different debugging method

Keep TRACE enabled but restrict it to authenticated users

GIAC Web Application Penetration Tester

Domain 3Objective 1

Web Application Configuration Testing GWAPT Practice Questions (Page 8)

Part of the Configuration and Deployment Testing domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 9–16 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

10concepts

Questions 36–40

36expert · hard
A web application includes a third-party library that is known to be vulnerable. The library is only used on the client side and does not handle sensitive data. The application owner wants to deprioritize the fix. What is the best response from the penetration tester?
Select an answer first
37foundation · easy
Which of the following is a common insecure default in application frameworks?
Select an answer first
38application · medium
A web application uses a JavaScript library that is three years old and has a known critical vulnerability. The library is loaded from the same origin as the application. What is the most appropriate action for the penetration tester to recommend?
Select an answer first
39foundation · easy
Which of the following is a common weakness in session management configuration?
Select an answer first
40expert · hard
A web server allows the OPTIONS method and responds with 'Allow: GET, HEAD, POST, OPTIONS, TRACE'. A security scanner flags TRACE as a vulnerability. The application team argues that TRACE is needed for debugging. What is the best recommendation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWAPT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWAPT” is a trademark of its owner, used for identification only.