GWAPT Exam Questions
140 real GWAPT exam questions with expert-verified answers and explanations. Page 3 of 3.
- Question #101
Which of the following is the BEST indicator of a SQL injection vulnerability?
- Question #102
Which tool is effective for analyzing JavaScript vulnerabilities in modern web applications?
- Question #103
What type of SQL injection attack modifies a database without revealing the results to the attacker?
- Question #104
What is the purpose of the "Content-Security-Policy" HTTP header?
- Question #105
A penetration test reveals that session cookies do not have the HttpOnly attribute set. What is the recommended mitigation?
- Question #106
Which of the following measures help mitigate SQL injection risks? (Choose two)
- Question #107
A web application is suspected to have hidden directories and files. Which tool would you use to confirm their existence?
- Question #108
What common configuration errors can expose sensitive data? (Choose two)
- Question #109
During a security assessment, you find that verbose error messages are enabled. What is the immediate action you should recommend?
- Question #110
Which features improve session security in web applications? (Choose two)
- Question #111
Which tool is commonly used as a web application proxy for penetration testing?
- Question #112
A penetration test reveals that the login form is vulnerable to credential stuffing. How can this be mitigated?
- Question #113
What are key practices to prevent session fixation attacks? (Choose two)
- Question #114
Which session attribute helps prevent session hijacking?
- Question #115
Which tool is MOST commonly used during manual web application testing for GWAPT tasks?
- Question #116
What happens if an application uses predictable password reset tokens?
- Question #117
Which of the following are indicators of sensitive information leakage during reconnaissance? (Choose two)
- Question #118
During a penetration test, you discover that a login form is vulnerable to SQL injection. Which payload could you use to bypass authentication?
- Question #119
Which of the following is an example of a client-side scripting language?
- Question #120
What does SameSite cookie attribute help mitigate?
- Question #121
What is the role of fuzzing in web application security testing?
- Question #122
You discover that a web application stores session IDs in URLs. What immediate action should you recommend?
- Question #123
Which of the following are common session management vulnerabilities? (Choose two)
- Question #124
What practices help secure web application authentication mechanisms? (Choose two)
- Question #125
Which of the following is a common indicator of a SQL injection vulnerability?
- Question #126
What is the purpose of spidering during reconnaissance?
- Question #127
What are the outputs of performing a web application mapping process? (Choose two)
- Question #128
Which feature of Burp Suite allows modification of HTTP/HTTPS requests before sending them to the server?
- Question #129
Which encoding method should be used to safely display user input in HTML content?
- Question #130
Which HTTP response code is MOST likely returned after successful authentication?
- Question #131
Which OWASP Top 10 2021 category includes authentication and session flaws?
- Question #132
A web application you are testing has directory listing enabled, exposing sensitive files. What should you recommend to mitigate this?
- Question #133
Which of the following tools can be used to perform reconnaissance on a web application? (Choose two)
- Question #134
What is the primary role of a web server in web applications?
- Question #135
In a Reflected Cross-Site Scripting attack, where is the malicious payload executed?
- Question #136
What is a session fixation attack?
- Question #137
Which steps help prevent clickjacking attacks? (Choose two)
- Question #138
While testing a web application, you notice it accepts HTML input and displays it on a webpage. What additional steps should you take to confirm an XSS vulnerability?
- Question #139
During a penetration test, you find a login form vulnerable to CSRF. What is your next step?
- Question #140
What are common uses of cookies in web applications? (Choose two)