What is the purpose of SSL/TLS testing tools like sslyze or testssl.sh?

To brute-force login credentials over HTTPS

To intercept and modify HTTPS traffic

To enumerate subdomains using certificate transparency logs

To assess the SSL/TLS configuration of a server for weak ciphers, protocols, and certificate issues

Which of the following is a common finding from an SSL/TLS testing tool?

The server has a valid and trusted certificate

The server supports SSLv3, which is deprecated and vulnerable

The server uses a strong and modern cipher suite

The server is running the latest version of TLS 1.3

A tester is investigating a web application that uses HTTPS and has a login form. The tester wants to see the exact request sent when the login form is submitted, including the password field, and then modify the request to test for SQL injection. Which tool is most appropriate?

Burp Suite with intercept enabled

Browser developer tools' network tab

What is the primary purpose of an automated vulnerability scanner in web application testing?

To enumerate subdomains and DNS records

To automatically identify potential security vulnerabilities by sending test requests and analyzing responses

To decode and encode data for bypassing filters

To manually intercept and modify individual requests in real time

What is the primary function of a web crawler or spider in web application testing?

To brute-force login credentials

To analyze SSL/TLS certificates

To exploit SQL injection vulnerabilities

To automatically discover and map the pages and endpoints of a web application

GIAC Web Application Penetration Tester

Domain 2Objective 2

Web Application Testing Tools GWAPT Practice Questions (Page 4)

Part of the Information Gathering and Tooling domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 11–19 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

12concepts

Questions 16–20

16foundation · easy
What is the purpose of SSL/TLS testing tools like sslyze or testssl.sh?
Select an answer first
17foundation · easy
Which of the following is a common finding from an SSL/TLS testing tool?
Select an answer first
18application · medium
A tester is investigating a web application that uses HTTPS and has a login form. The tester wants to see the exact request sent when the login form is submitted, including the password field, and then modify the request to test for SQL injection. Which tool is most appropriate?
Select an answer first
19foundation · easy
What is the primary purpose of an automated vulnerability scanner in web application testing?
Select an answer first
20foundation · easy
What is the primary function of a web crawler or spider in web application testing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWAPT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWAPT” is a trademark of its owner, used for identification only.