What is the primary security risk of verbose error messages in a production web application?

They can reveal internal paths, database queries, or stack traces

They make the user interface less user-friendly

A web server is configured to allow the TRACE method. During testing, you send a TRACE request with a custom header and observe the header echoed in the response. What is the primary risk, and what is the recommended remediation?

Cross-Site Tracing can steal HttpOnly cookies; disable TRACE on the server

TRACE allows file uploads; restrict TRACE to authenticated users

TRACE bypasses TLS; force HTTPS for all requests

TRACE reveals server internals; replace TRACE with OPTIONS

Which of the following indicates a weak SSL/TLS configuration?

Using a certificate from a trusted CA

A web application allows users to upload profile pictures. During testing, you find that the server does not validate the file type and stores uploads in a directory that is directly accessible via the web. What is the most effective remediation?

Disable script execution in the upload directory using a .htaccess file.

Validate the file extension and MIME type on the server side.

Generate a random filename for each upload and store it in a database.

Store uploads outside the web root and serve them through a script that sets the correct Content-Type header.

GIAC Web Application Penetration Tester

Domain 3Objective 1

Web Application Configuration Testing GWAPT Practice Questions (Page 9)

Part of the Configuration and Deployment Testing domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 9–16 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

10concepts

Questions 41–44

41foundation · easy
What is the primary security risk of verbose error messages in a production web application?
Select an answer first
42application · medium
A web server is configured to allow the TRACE method. During testing, you send a TRACE request with a custom header and observe the header echoed in the response. What is the primary risk, and what is the recommended remediation?
Select an answer first
43foundation · easy
Which of the following indicates a weak SSL/TLS configuration?
Select an answer first
44application · medium
A web application allows users to upload profile pictures. During testing, you find that the server does not validate the file type and stores uploads in a directory that is directly accessible via the web. What is the most effective remediation?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GWAPT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWAPT” is a trademark of its owner, used for identification only.