GWAPT Exam Questions

What tools are commonly used to test for Cross-Site Scripting vulnerabilities? (Choose two)

What are key steps to prevent SQL injection attacks? (Choose two)

What is the primary purpose of session management in web applications?

You discover that a web application reflects user input in the URL. How can you confirm a Reflected XSS vulnerability?

A web application uses AJAX for dynamic content updates but has no fallback for older browsers. What is the best course of action?

Which method is most effective in preventing SQL injection attacks?

Which of the following HTTP headers is often used to prevent CSRF attacks?

During an automated scan with OWASP ZAP, you identify several potential XSS vulnerabilities. What is the best follow-up action?

Which of the following are common methods to mitigate Cross-Site Scripting (XSS) vulnerabilities? (Choose two)

Which of the following describes AJAX?

During a web application test, you find that the application echoes back input provided in the "Search" field without sanitizing it. How would you test for a potential reflected XS...

What are key defenses against credential stuffing attacks? (Choose two)

What are the key functionalities of OWASP ZAP? (Choose two)

What are key signs that an application might be vulnerable to SQL injection? (Choose two)

Which of the following is a common misconfiguration in web applications?

What are key features of HTTPS? (Choose two)

You discover that the web server is using an outdated version of Apache with known vulnerabilities. What should you recommend?

What is the primary purpose of a Cross-Site Request Forgery (CSRF) attack?

Which of the following are examples of web application misconfigurations? (Choose two)

Which HTTP method is most commonly used in brute-force attacks against login forms?

What techniques can attackers use in SQL injection attacks? (Choose two)

Which measures can prevent session hijacking? (Choose two)

Which of the following are effective countermeasures against CSRF? (Choose two)

What is the primary purpose of web application testing tools?

Which attribute of cookies helps prevent Cross-Site Scripting (XSS) attacks?

How can a web application developer prevent Reflected XSS vulnerabilities?

Which XSS attack occurs entirely in the client's browser and manipulates the DOM?

Which web technologies are considered part of a web application frontend? (Choose two)

Which features are available in automated web application testing tools? (Choose two)

A web application you are testing uses anti-CSRF tokens but allows GET requests for sensitive operations. How would you verify if it is still vulnerable to CSRF?

You find that a search input field allows SQL injection. Which action should you recommend?

While testing a web application with Burp Suite, you identify that a specific parameter might be vulnerable to SQL injection. What should you do next?

Which methods help prevent session fixation attacks? (Choose two)

What is a potential consequence of improper session management?

What is the primary goal of reconnaissance in web application penetration testing?

While reviewing a web application, you find a comment field vulnerable to stored XSS. How should this be remediated?

What is the primary goal of a SQL injection attack?

Which elements are critical for identifying stored XSS vulnerabilities? (Choose two)

Which features help protect against SQL injection attacks? (Choose two)

What are key objectives of mapping a web application? (Choose two)

What are typical signs of a successful brute-force attack? (Choose two)

What is a common vulnerability in web authentication mechanisms?

Which of the following tools is specifically designed for testing SQL injection vulnerabilities?

Which reconnaissance techniques may expose directory structure vulnerabilities? (Choose two)

A web application does not log users out after a period of inactivity. What is the best way to address this issue?

Which technique is commonly used to identify active services running on a web server?

You discover that a web application stores passwords in plaintext. What is the recommended remediation?

What is the purpose of account lockout policies?

Which configurations can help enhance web application security? (Choose two)

What is the primary goal of a Cross-Site Request Forgery (CSRF) attack?