- GWAPT requires a 71% minimum passing score on 82 questions in 3 hours.
- The exam blends multiple-choice items with hands-on CyberLive virtual-machine tasks.
- It's open-book - hardcopy books, notes, and an index are allowed, but no internet or e-references.
- A failed attempt requires a 30-day wait before a $899 retake.
The Exact Passing Score You Need
If you're searching for a single number, here it is: GIAC sets the minimum passing score for the GIAC Web Application Penetration Tester (GWAPT) exam at 71%. That threshold applies to the full 82-question, 3-hour proctored exam, and it is fixed by GIAC rather than curved or adjusted attempt-to-attempt.
There's no partial-credit ambiguity to chase here - you either accumulate enough correct answers across the multiple-choice and CyberLive practical items to clear 71%, or you don't. Understanding what that 71% is actually built from, question by question and domain by domain, is far more useful than treating it as an abstract percentage. That's what the rest of this guide breaks down.
Exam Format: 82 Questions, 3 Hours, CyberLive
The GWAPT exam is a single web-based, proctored assessment - there is no separate practical lab day and no multi-part certification track. Candidates answer 82 questions within a 3-hour window, and the exam mixes traditional multiple-choice questions with CyberLive tasks: live virtual-machine environments where you actually perform actions against a target rather than just recognize the correct answer from a list.
This matters directly for how you should think about the 71% threshold. Multiple-choice questions test recognition and recall of concepts - attack mechanics, protocol behavior, tool syntax. CyberLive tasks test whether you can execute those concepts under time pressure inside a working environment. A candidate who has memorized definitions but never actually run an injection payload or manipulated a session token in a live environment risks losing points specifically on the CyberLive portion, even while feeling confident about the multiple-choice half.
For a deeper walkthrough of what to expect on test day, including how CyberLive tasks are typically structured, see our GWAPT difficulty guide.
Key Takeaway
Split your practice time between concept review and hands-on tool execution. A 71% pass score built entirely on multiple-choice confidence is riskier than one built on demonstrated CyberLive competence.
How the 8 Domains Relate to Your Score
GIAC organizes GWAPT content into eight published certification-objective domains. Your individual exam specification - visible in your candidate account once your attempt is activated - identifies how these domains apply to your specific attempt. In general terms, the domains are:
Domain 1: Cross Site Request Forgery, Cross Site Scripting and Client Injection Attack
Covers CSRF, XSS variants, and client-side injection mechanics - a core offensive skill area tested through both concept questions and live exploitation tasks.
- Distinguishing reflected, stored, and DOM-based XSS
Domain 2: Reconnaissance and Mapping
Tests your ability to enumerate application structure, identify attack surface, and map functionality before exploitation begins.
- Understanding how mapping informs later exploitation choices
Domain 3: Web Application Authentication Attacks
Focuses on breaking or bypassing login mechanisms, credential handling flaws, and authentication logic errors.
- Recognizing weak authentication implementation patterns
Domain 4: Web Application Configuration Testing
Covers misconfigurations in servers, frameworks, and deployment settings that expose applications to attack.
- Identifying default or insecure configuration artifacts
Domain 5: Web Application Overview
Establishes foundational knowledge of how web applications are architected and how components interact.
- Grasping request/response flow and application layering
Domain 6: Web Application Session Management
Tests understanding of session tokens, cookie handling, and the attacks that exploit weak session controls.
- Evaluating session token strength and predictability
Domain 7: Web Application SQL Injection Attacks
Covers SQL injection identification, exploitation techniques, and mitigation awareness.
- Practicing injection detection across different database backends
Domain 8: Web Application Testing Tools
Tests fluency with the tooling used throughout a web app penetration test engagement.
- Knowing which tool fits which testing phase
Because these headings represent GIAC's published objectives rather than a fixed percentage breakdown, don't assume every domain contributes equally to your 82 questions. For a full domain-by-domain study breakdown, read our GWAPT Exam Domains Guide, and cross-check your own attempt specification once it's activated.
Question Types That Affect Scoring
Because GWAPT combines multiple-choice questions with CyberLive practical tasks, your path to 71% runs through two distinct skill sets:
- Multiple-choice questions - assess conceptual knowledge across all eight domains, from client injection theory to session token design.
- CyberLive tasks - require you to work inside a live virtual machine, executing an actual attack step or configuration check rather than selecting a description of one.
A critical mechanical detail: once you submit an answer, it cannot be changed. However, if you skip a question, you can return to it later in the same attempt. This means pacing across 82 questions in 180 minutes is itself a scoring factor - burning too much time on one CyberLive task can crowd out questions you'd otherwise answer correctly. Use the skip-and-revisit mechanic deliberately: work through questions you're confident on first, flag harder items, and return to them with remaining time.
| Exam Element | Detail |
|---|---|
| Total questions | 82 |
| Time allotted | 3 hours |
| Minimum passing score | 71% |
| Question format | Multiple-choice + CyberLive practical tasks |
| Answer changes | Not allowed once submitted; skipped items can be revisited |
| Built-in tools | Calculator and scratch notepad in the exam engine |
Open-Book Rules and What They Mean for 71%
GWAPT is an open-book exam, which changes your prep strategy relative to closed-book certifications. Candidates may bring hardcopy books, printed notes, and a self-created index into the exam. What's prohibited is just as important: no internet access, no personal electronic reference devices, and no practice-question or answer collections of any kind.
The open-book allowance is not a substitute for domain knowledge - with only about 2.2 minutes per question on average across 3 hours, flipping through an unindexed binder will cost you time you don't have. The candidates who benefit most from open-book access are the ones who've built a tight, well-organized index in advance, mapped to the eight domains, so they can locate a syntax reminder or a specific attack sequence in seconds rather than minutes.
Our GWAPT Cheat Sheet is designed as exactly this kind of quick-reference companion, and our GWAPT Study Guide walks through how to build your own index efficiently before test day.
If You Miss 71%: Retake Costs and Waiting Period
If your score falls short of 71%, GIAC requires a 30-day waiting period before you can retake the exam. The retake itself costs $899, separate from the original $999 exam-only attempt fee. A standalone official practice test is available for $399, and if you need more time to complete your attempt window, an extension can be purchased for $479. Your attempt must be completed within 120 days of activation regardless of retakes.
These figures are worth planning around before you ever sit the exam - not after. If you're budgeting for GWAPT from scratch, including training, exam fees, and a possible retake buffer, our GWAPT Certification Cost breakdown lays out the full picture, and GWAPT Requirements covers eligibility and registration mechanics in more depth.
Key Takeaway
Treat the 120-day activation window and 30-day retake wait as scheduling constraints, not just fine print - they directly affect when you can realistically attempt (or re-attempt) the exam.
A Domain-Weighted Prep Schedule
Generic study techniques like spaced repetition and timed drilling only help if they're pointed at the right GWAPT content. Here's a structure that ties preparation weeks directly to the exam's domains and format rather than to abstract study theory:
Foundations and Reconnaissance
- Work through Web Application Overview and Reconnaissance and Mapping domains
- Build your open-book index structure early so it grows with your study
Core Attack Domains
- Drill Cross Site Request Forgery, Cross Site Scripting and Client Injection Attack, plus SQL Injection Attacks
- Practice executing these attacks in a lab, not just reading about them, to prepare for CyberLive tasks
Session and Authentication
- Cover Web Application Authentication Attacks and Session Management
- Time yourself answering practice questions to simulate the 82-question, 3-hour pace
Configuration and Tools
- Finish Web Application Configuration Testing and Testing Tools
- Take the standalone official practice test to gauge readiness against the 71% bar
Full Review and Index Finalization
- Consolidate index across all eight domains
- Run full-length timed drills covering both multiple-choice and hands-on scenarios
For candidates coming through SANS SEC542: Web App Penetration Testing and Ethical Hacking, or preparing via practical work experience and self-paced study, this schedule can be compressed or extended - see GWAPT Training for how formal coursework maps onto these domains. For a broader look at how challenging candidates generally find this exam relative to the 71% bar, our GWAPT difficulty guide and GWAPT Pass Rate breakdown are useful companion reads. You can also start testing your domain knowledge right now with timed practice questions at GWAPT Exam Prep.
Once you're certified, remember GWAPT is valid for 4 years, renewable through 36 CPEs plus a $499 renewal fee, or via a renewal examination route. That's a downstream concern, but it's worth knowing the certification isn't a one-time achievement - plan your CPE tracking alongside your initial exam prep. If you're weighing whether the investment is worthwhile for your career trajectory, our GWAPT ROI analysis and GWAPT Salary Guide go into that in detail, and GWAPT Jobs covers who typically hires for this credential. You can also practice full-length timed sets at our practice test platform to build the pacing needed for the 3-hour window.
FAQ
GIAC sets the minimum passing score at 71% across the 82-question, 3-hour exam.
No. The 71% threshold is fixed by GIAC regardless of how questions are distributed across the eight domains on your specific attempt.
No. Submitted answers are final. However, you can skip a question and return to it later in the same attempt before time expires.
You must wait 30 days before retaking the exam, and the retake costs $899. Your original attempt must still fall within your 120-day activation window.
The exam engine provides a built-in calculator and scratch notepad. Separately, as an open-book exam, hardcopy books, notes, and an index are permitted, but internet access and personal electronic references are not.