A penetration tester is analyzing a web application that returns a 500 Internal Server Error when a single quote is added to a search parameter. The error page includes the full SQL query and database error details. Which two security issues are demonstrated?

SQL injection and information disclosure

Session fixation and broken authentication

A developer is fixing a stored XSS vulnerability in a comment form. The application stores user comments in a database and later displays them in HTML. Which combination of controls should the developer implement to most effectively mitigate the issue?

Set the HttpOnly flag on the session cookie

Validate input on the server and encode output in the HTML context

Encode input before storing it in the database

Use client-side JavaScript validation only

A web application has a search feature that reflects user input in the page without output encoding. The application also has a strict Content Security Policy (CSP) that blocks inline scripts and only allows scripts from the application's own domain. A penetration tester wants to demonstrate stored XSS by injecting a script tag into a comment field. The comment is stored and displayed to other users. Which approach is most likely to succeed despite the CSP?

Inject a script tag that loads an external script from the application's own domain

Inject a javascript: URL in an anchor tag

Inject a meta tag that refreshes to an external site

Inject an inline event handler like onmouseover

A developer is implementing a password reset feature. The current implementation sends a reset link to the user's email with a token that is valid for 24 hours. A security review notes that the token is generated using a predictable algorithm. Which change should be made to improve the security of the token?

Generate the token using a cryptographically secure random number generator

Send the token in the email body instead of the URL

Use the user's email address as part of the token

Shorten the token validity period to 30 minutes

A penetration tester observes that after a successful login, the application sets a cookie named 'sessionID' with a value that is the user's username encoded in base64. The cookie does not have the HttpOnly or Secure flags. Which of the following is the most immediate security concern?

Session tokens are predictable and can be forged

The cookie is vulnerable to CSRF attacks

The cookie cannot be read by JavaScript

The cookie will be sent over HTTP and HTTPS

GIAC Web Application Penetration Tester

Domain 1Objective 1

Web Application Overview GWAPT Practice Questions (Page 1)

Part of the Web Application Fundamentals domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 8–13 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

4concepts

Questions 1–5

1application · medium
A penetration tester is analyzing a web application that returns a 500 Internal Server Error when a single quote is added to a search parameter. The error page includes the full SQL query and database error details. Which two security issues are demonstrated?
Select an answer first
2application · medium
A developer is fixing a stored XSS vulnerability in a comment form. The application stores user comments in a database and later displays them in HTML. Which combination of controls should the developer implement to most effectively mitigate the issue?
Select an answer first
3expert · hard
A web application has a search feature that reflects user input in the page without output encoding. The application also has a strict Content Security Policy (CSP) that blocks inline scripts and only allows scripts from the application's own domain. A penetration tester wants to demonstrate stored XSS by injecting a script tag into a comment field. The comment is stored and displayed to other users. Which approach is most likely to succeed despite the CSP?
Select an answer first
4application · medium
A developer is implementing a password reset feature. The current implementation sends a reset link to the user's email with a token that is valid for 24 hours. A security review notes that the token is generated using a predictable algorithm. Which change should be made to improve the security of the token?
Select an answer first
5application · medium
A penetration tester observes that after a successful login, the application sets a cookie named 'sessionID' with a value that is the user's username encoded in base64. The cookie does not have the HttpOnly or Secure flags. Which of the following is the most immediate security concern?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWAPT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWAPT” is a trademark of its owner, used for identification only.