- GWAPT is a GIAC certification: 82 questions, 3 hours, 71% passing score, with CyberLive hands-on tasks.
- Exam-only registration costs $999; retakes are $899 after a mandatory 30-day wait.
- Eight domains cover recon, auth, session management, SQL injection, XSS/CSRF, config testing, and tools.
- Delivery is via ProctorU remote proctoring or Pearson VUE, within a 120-day activation window.
What GWAPT Actually Certifies
GWAPT stands for GIAC Web Application Penetration Tester, a credential issued by the Global Information Assurance Certification (GIAC) body. It is built around one specific job function: finding and exploiting vulnerabilities in web applications using structured, repeatable methodology rather than ad-hoc guesswork. If you've landed here after searching What Is GWAPT? or GWAPT Meaning, the short version is that it validates hands-on web app pentesting skill, not general security awareness or network-only penetration testing.
This distinction matters because "GWAPT" is sometimes confused with other credentials that share a similar-sounding name. This article covers only the GIAC-issued GWAPT tied to SANS SEC542 coursework. For a deeper breakdown of terminology, see What Does GWAPT Stand For? and What Is A GWAPT?.
Exam Format and Scoring
The GWAPT exam is a single web-based, proctored assessment: 82 questions delivered over 3 hours, combining multiple-choice items with CyberLive hands-on tasks performed on virtual machines. You need a minimum score of 71% to pass. There is no separate "practical" and "written" exam - everything is bundled into one attempt.
- Answer behavior: once you submit an answer, it cannot be changed. Skipped or unanswered questions can be revisited before the exam ends.
- Tools provided: the exam engine includes a built-in calculator and a scratch notepad for working through logic or encoding problems.
- Open-book policy: you may bring hardcopy books, printed notes, and an index. Internet access, personal electronic references, and any collections of practice questions or answers are strictly prohibited during the attempt.
Because the exam mixes recall-based multiple-choice with applied CyberLive tasks, preparation needs to cover both theory and command-line fluency. The GWAPT Study Guide 2026: How to Pass on Your First Attempt walks through how to balance these two study modes, and if you're still evaluating difficulty, How Hard Is the GWAPT Exam? Complete Difficulty Guide 2026 breaks down where most candidates lose points.
Key Takeaway
Build your open-book index around the 8 domains below, not around generic pentesting notes - GIAC's questions map directly to those domain headings.
The 8 GWAPT Domains
GIAC publishes eight domain headings that define exam scope. Each domain represents a cluster of skills you're expected to apply, not just recognize. A full domain-by-domain walkthrough with sub-topics lives in the GWAPT Exam Domains 2026: Complete Guide to All 8 Content Areas, but here is the core of what each one demands.
Domain 1: Cross Site Request Forgery, Cross Site Scripting and Client Injection Attack
Covers exploiting client-side trust relationships and injecting malicious scripts into vulnerable pages.
- Distinguishing reflected, stored, and DOM-based XSS
- Crafting CSRF proof-of-concept requests
Domain 2: Reconnaissance and Mapping
Covers enumerating application structure, hidden endpoints, and technology stack before active testing begins.
- Spidering and content discovery techniques
- Fingerprinting frameworks and server technologies
Domain 3: Web Application Authentication Attacks
Covers weaknesses in login mechanisms, password handling, and multi-step authentication flows.
- Brute-force and credential-stuffing considerations
- Testing password reset and account recovery logic
Domain 4: Web Application Configuration Testing
Covers misconfigurations in servers, frameworks, headers, and deployment settings that expose attack surface.
- Reviewing security headers and TLS configuration
- Identifying default credentials and exposed admin interfaces
Domain 5: Web Application Overview
Covers foundational concepts of how web applications, HTTP, and client-server interactions function.
- HTTP methods, status codes, and request/response structure
- Application architecture basics relevant to testing
Domain 6: Web Application Session Management
Covers how sessions are created, maintained, and potentially hijacked or fixated.
- Cookie attributes and session token strength
- Session fixation and hijacking scenarios
Domain 7: Web Application SQL Injection Attacks
Covers identifying and exploiting injection points in database-driven queries.
- Manual and blind SQL injection techniques
- Extracting and validating injected data
Domain 8: Web Application Testing Tools
Covers the practical use of tooling to support each phase of a web app assessment.
- Proxy-based interception and manipulation workflows
- Automated scanning versus manual verification
Registration, Fees, and Retakes
Registering for GWAPT as an exam-only attempt costs $999 USD before taxes, and training through SANS SEC542: Web App Penetration Testing and Ethical Hacking is purchased separately. Once your attempt is activated, you have 120 days to complete it, and your candidate account will show the exact specifications for your registered attempt.
- Delivery options: ProctorU remote proctoring or a Pearson VUE test center, depending on what's authorized for your registered attempt.
- Retake fee: $899 if you don't pass the first time.
- Waiting period: a failed attempt requires a 30-day wait before you can retake.
- Standalone practice test: $399 for GIAC's official practice questions.
- Attempt extension: $479 if you need more time within your activation window.
For a full breakdown of how these fees stack up against training bundles, read the GWAPT Certification Cost 2026: Complete Pricing Breakdown. If you want to understand exactly what score you're working toward, the GWAPT Passing Score 2026: Exactly What You Need to Pass article covers the 71% threshold in more depth, and GWAPT Exam Dates 2026: Testing Windows, Deadlines & Scheduling explains how the 120-day window interacts with scheduling.
| Item | Cost |
|---|---|
| Exam-only attempt | $999 |
| Retake attempt | $899 |
| Official practice test | $399 |
| Attempt extension | $479 |
| CPE renewal fee | $499 |
Who Hires GWAPT Holders
GWAPT is aimed squarely at people whose job involves manually testing web applications: penetration testers, application security analysts, and consultants who need to demonstrate structured web app assessment skill rather than general infosec knowledge. Because it maps to the SEC542 course content, employers running internal or client-facing web app assessments often look for it alongside broader offensive security experience.
If you're deciding whether the credential fits your career path, GWAPT Jobs covers the kinds of roles that typically list it, and GWAPT Salary Guide 2026: Complete Earnings Analysis discusses compensation considerations without relying on invented figures. For a broader cost-versus-benefit view, see Is the GWAPT Certification Worth It? Complete ROI Analysis 2026.
Preparation Routes
GIAC does not mandate a single path to sit the exam. Recognized preparation routes include:
- Formal training: SANS SEC542, the associated course built specifically around GWAPT's objectives.
- Practical work experience: hands-on web application testing experience in a professional role.
- College coursework: relevant academic study in application security or web technologies.
- Self-paced study: independent study using GIAC's published objectives, official practice tests, and lab practice.
Whichever route you choose, check the eligibility and prerequisite expectations first - GWAPT Requirements 2026: Eligibility, Prerequisites & How to Qualify lays these out clearly. For quick-reference review once you've studied the material, bookmark the GWAPT Cheat Sheet 2026: One-Page Review of Must-Know Facts, and if formal instruction is part of your plan, GWAPT Training compares options.
Key Takeaway
Because the practice-question collections you build yourself are prohibited in the exam room, use them during preparation only - not as reference material on exam day.
A Domain-Aligned Study Schedule
Generic study techniques only help if they're mapped to GWAPT's actual domain weighting and format. Rather than a one-size weekly template, sequence your study around domain dependencies: foundational concepts first, then attack techniques, then tooling fluency.
Foundations and Recon
- Review Domain 5 (Web Application Overview) - HTTP mechanics and architecture
- Work through Domain 2 (Reconnaissance and Mapping) labs
Authentication and Session Attacks
- Practice Domain 3 (Authentication Attacks) scenarios
- Drill Domain 6 (Session Management) cookie/token exercises
Injection and Client-Side Attacks
- Hands-on SQL injection practice for Domain 7
- XSS/CSRF exercises for Domain 1
Tooling and Configuration Review
- Master proxy and scanner workflows for Domain 8
- Practice config-review checklists for Domain 4, then sit the official practice test
This sequencing keeps CyberLive-heavy domains - recon, injection, and tooling - in the weeks with the most lab time available, since those are the sections most likely to require live command execution rather than recall. For a more granular week-by-week plan tied to specific study resources, see the GWAPT Study Guide 2026: How to Pass on Your First Attempt.
Renewal and Long-Term Value
GWAPT certification is valid for 4 years. To keep it active, you have two options:
- CPE renewal route: accumulate 36 CPEs and pay the standard $499 renewal fee.
- Renewal examination route: sit a renewal exam instead of accumulating CPEs.
Planning renewal early avoids a lapse in active status, which matters if your employer or clients require a currently valid credential. If you're weighing whether the 4-year cycle and renewal cost fit your career goals, revisit Is the GWAPT Certification Worth It? Complete ROI Analysis 2026 for a fuller picture, and check GWAPT Pass Rate 2026: What the Data Shows for context on how challenging the initial attempt tends to be relative to the renewal exam option.
Before you register, it's worth practicing with realistic scenario-based questions on our GWAPT practice test platform so you're comfortable with the pacing of 82 questions in 3 hours. Combining timed practice on the main practice site with CyberLive-style lab drills is the most direct way to simulate exam-day conditions.
FAQ
The GWAPT exam has 82 questions delivered over a 3-hour window, combining multiple-choice items with CyberLive hands-on virtual machine tasks.
You need a minimum score of 71% to pass. Full details on how this is calculated are covered in the GWAPT Passing Score 2026 guide.
An exam-only attempt is $999 USD before taxes. Training through SANS SEC542 is purchased separately, and retakes cost $899.
You can sit the exam through ProctorU remote proctoring or at a Pearson VUE test center, depending on what's authorized for your registered attempt.
You must wait 30 days before retaking, and the retake fee is $899. Reviewing the GWAPT Exam Domains 2026 guide can help identify weak areas before you retry.