A tester needs to map the structure of a web application to understand its functionality and identify all accessible endpoints. The application uses JavaScript to load content dynamically. Which tool is most effective for this task?

An SSL/TLS scanner like sslscan

A simple HTTP crawler like wget

A directory brute-forcer like DirBuster

A headless browser-based crawler like ZAP's AJAX Spider

A tester is testing a web application that uses HTTP Basic Authentication. The tester wants to brute-force the credentials using a wordlist. The application has rate limiting that locks the account after 5 failed attempts. Which approach is most effective?

Use Burp Intruder with a large payload list and no delay

Use a web crawler to find other authentication endpoints

Use an SSL/TLS scanner to check for weak encryption

Use Hydra with a slow timing option to avoid triggering rate limiting

GIAC Web Application Penetration Tester

Domain 2Objective 2

Web Application Testing Tools GWAPT Practice Questions (Page 5)

Part of the Information Gathering and Tooling domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 11–19 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

12concepts

Questions 21–25

21application · medium
A tester needs to map the structure of a web application to understand its functionality and identify all accessible endpoints. The application uses JavaScript to load content dynamically. Which tool is most effective for this task?
Select an answer first
22expert · hard
A tester is testing a web application that uses HTTP Basic Authentication. The tester wants to brute-force the credentials using a wordlist. The application has rate limiting that locks the account after 5 failed attempts. Which approach is most effective?
Select an answer first
23foundation · easy
A tester wants to view the JavaScript code that runs when a button is clicked on a web page. Which browser developer tools panel is most appropriate?
Select an answer first
24application · medium
You are assessing the SSL/TLS configuration of a web server. You need to identify weak ciphers, certificate issues, and protocol versions supported. Which tool is best for this assessment?
Select an answer first
25foundation · easy
Which tool is commonly used for subdomain enumeration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWAPT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWAPT” is a trademark of its owner, used for identification only.

Web Application Testing Tools GWAPT Practice Questions (Page 5)

Questions 21–25

A tester needs to map the structure of a web application to understand its functionality and identify all accessible endpoints. The application uses JavaScript to load content dynamically. Which tool is most effective for this task?

A tester is testing a web application that uses HTTP Basic Authentication. The tester wants to brute-force the credentials using a wordlist. The application has rate limiting that locks the account after 5 failed attempts. Which approach is most effective?

A tester wants to view the JavaScript code that runs when a button is clicked on a web page. Which browser developer tools panel is most appropriate?

You are assessing the SSL/TLS configuration of a web server. You need to identify weak ciphers, certificate issues, and protocol versions supported. Which tool is best for this assessment?

Which tool is commonly used for subdomain enumeration?

Keep studying — Information Gathering and Tooling