When interpreting the report from an automated vulnerability scanner, why is it important to manually verify each finding?

Scanners cannot detect any vulnerabilities automatically

Scanners always provide a complete list of all vulnerabilities

Scanners can produce false positives that need confirmation

Scanners only report vulnerabilities that are exploitable

A tester needs to send a series of HTTP requests to a web application with different HTTP methods (GET, POST, PUT, DELETE) and custom headers to test how the server handles them. The tester wants to automate this process and easily modify the requests. Which tool is most appropriate?

An SSL/TLS testing tool like testssl.sh

curl with a script that loops through methods and headers

A subdomain enumeration tool like Amass

When using curl to test a web application, what does the '-X POST' option do?

Follows redirects automatically

Adds a custom header to the request

In an intercepting proxy like Burp Suite, what is the primary purpose of the 'Intercept' tab?

To decode Base64-encoded parameters in requests

To display a history of all requests made by the browser

To automatically scan all traffic for SQL injection vulnerabilities

To pause and modify individual HTTP requests and responses before they are forwarded

GIAC Web Application Penetration Tester

Domain 2Objective 2

Web Application Testing Tools GWAPT Practice Questions (Page 11)

Part of the Information Gathering and Tooling domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 11–19 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

12concepts

Questions 51–55

51foundation · easy
When interpreting the report from an automated vulnerability scanner, why is it important to manually verify each finding?
Select an answer first
52foundation · easy
Which tool is specifically designed for directory and file enumeration?
Select an answer first
53application · medium
A tester needs to send a series of HTTP requests to a web application with different HTTP methods (GET, POST, PUT, DELETE) and custom headers to test how the server handles them. The tester wants to automate this process and easily modify the requests. Which tool is most appropriate?
Select an answer first
54foundation · easy
When using curl to test a web application, what does the '-X POST' option do?
Select an answer first
55foundation · easy
In an intercepting proxy like Burp Suite, what is the primary purpose of the 'Intercept' tab?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWAPT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWAPT” is a trademark of its owner, used for identification only.