GIAC Web Application Penetration Tester
Domain 2Objective 2
Web Application Testing Tools GWAPT Practice Questions (Page 3)
Part of the Information Gathering and Tooling domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 11–19 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)
58questions here
12free pages
12concepts
Questions 11–15
- 11
A penetration tester is assessing an organization's external attack surface. The tester has identified the main domain and wants to find subdomains that may host development or staging applications. The tester also wants to see if these subdomains are accessible from the internet. Which tool is most appropriate?
Select an answer first - 12
A tester is trying to bypass a web application firewall (WAF) that blocks certain characters in input. The tester wants to encode the payload in a way that the WAF does not recognize but the application decodes. Which tool is most useful for this task?
Select an answer first - 13
You are mapping a web application's structure and need to discover hidden directories and files that are not linked from the main pages. You also want to see which of the discovered resources return a 200 status code. Which tool is most appropriate?
Select an answer first - 14
A security team wants to assess the SSL/TLS configuration of their web server to ensure it does not support weak ciphers or outdated protocols. They also want to verify that the certificate is valid and properly configured. Which tool is best for this assessment?
Select an answer first - 15
A penetration tester is fuzzing a web application's file upload feature. The tester wants to send a large number of malformed file names and content types to see if the server properly validates input. Which tool is best suited for this task?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWAPT” is a trademark of its owner, used for identification only.