100+ Free PWPA Practice Questions
Prepare for the Practical Web Pentest Associate (TCM Security) exam with instant access — no signup required.
Loading practice questions...
Explore More TCM Security Practical Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.
Key Facts: PWPA Exam
2 days
Assessment Window
TCM Security
2 days
Report Submission Window
TCM Security
Practical
Exam Format
TCM Security
Zero flags
Real Vuln Exploitation Required
TCM Security
OWASP Top 10
Core Knowledge Domain
TCM Security PWPA page
Entry-Level
Difficulty Tier
TCM Security
The PWPA from TCM Security is a practical, hands-on web application penetration testing certification. Candidates have 2 days to find and exploit a required set of real vulnerabilities in a target web application, then 2 additional days to write a professional pentest report. The exam tests OWASP Top 10 skills (SQLi, XSS, IDOR, broken auth, misconfiguration), Burp Suite proficiency, authentication and authorization testing, WAF evasion, business logic flaws, and basic API testing. Preparation is through TCM's Practical Bug Bounty course. This practice test covers the theoretical knowledge — the real exam requires live exploitation.
Sample PWPA Practice Questions
Try these sample questions to test your PWPA exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.
1Which HTTP response header is designed to prevent clickjacking attacks by controlling whether a page can be rendered inside an iframe?
2A web application reflects user input in the page without encoding it. An attacker crafts the URL: `?name=<script>alert(1)</script>`. What type of XSS is this?
3During a Burp Suite intercept session you notice the request: `GET /api/users/1234/profile`. You change `1234` to `1235` and receive another user's profile data. What vulnerability is this?
4Which Burp Suite tool is best suited for automating brute-force of a login form's password field across a wordlist?
5A SQL injection payload `' OR '1'='1` is appended to a login form's username field. What is the goal of this payload?
6Which cookie attribute prevents client-side JavaScript from reading a cookie, protecting session tokens from XSS theft?
7What does the Burp Suite Proxy's 'Intercept' function allow a pentester to do?
8An application displays the error message 'ORA-01756: quoted string not properly terminated' after you submit a single quote in a search field. What does this reveal?
9You discover a login page with no account lockout after multiple failed attempts. Which attack does this misconfiguration most directly enable?
10Which ffuf command correctly fuzzes the path component of a URL to discover hidden directories?
About the PWPA Exam
The PWPA (Practical Web Pentest Associate) is TCM Security's entry-level, hands-on web application penetration testing certification. Unlike multiple-choice exams, the PWPA requires candidates to conduct a real-world web application assessment over two days, finding and exploiting vulnerabilities, then writing a professional penetration test report. This practice bank tests the theoretical knowledge that underlies the practical skills: how attacks work, what tools do, and how vulnerabilities are identified and mitigated.
Assessment
Performance-based assessment
Time Limit
2 days assessment + 2 days reporting
Passing Score
Find and exploit the required vulnerabilities (no public numeric threshold)
Exam Fee
Standalone voucher or included with TCM Academy subscription (TCM Security)
PWPA Exam Content Outline
Web Application Architecture & HTTP
HTTP methods, status codes, headers (security headers, CSP, HSTS, X-Frame-Options), cookies (HttpOnly, Secure, SameSite), and web proxy fundamentals
Reconnaissance & Enumeration
ffuf and Gobuster directory brute-forcing, Nikto scanning, JavaScript file analysis, robots.txt review, .git directory exposure, subdomain enumeration, and Burp Suite site mapping
OWASP Top 10 Exploitation
SQL injection (manual, UNION-based, blind, SQLMap), XSS (reflected, stored, DOM-based), IDOR, LFI and path traversal, command injection, file upload attacks, CSRF, SSRF, and open redirects
Authentication & Authorization Testing
Brute-force and credential stuffing, session management review, cookie security attributes, JWT attacks (alg:none), CSRF, privilege escalation, parameter tampering, and BFLA
WAF Evasion & Burp Suite
Burp Suite Proxy, Repeater, Intruder, Decoder, and extensions (Param Miner, Match and Replace); WAF bypass via URL encoding, case manipulation, and comment injection
Business Logic, API Testing & Reporting
Price manipulation, workflow bypass, client-side trust flaws, REST API testing (OWASP API Top 10: BOLA, mass assignment, broken authentication), and professional pentest report writing with CVSS-rated findings
How to Pass the PWPA Exam
What You Need to Know
- Passing score: Find and exploit the required vulnerabilities (no public numeric threshold)
- Assessment: Performance-based assessment
- Time limit: 2 days assessment + 2 days reporting
- Exam fee: Standalone voucher or included with TCM Academy subscription
Keys to Passing
- Work through all 100 available questions
- Review every answer and explanation
- Track weak areas and revisit them
- Use our AI tutor for tough concepts
PWPA Study Tips from Top Performers
Frequently Asked Questions
What is the PWPA exam format?
The PWPA is a fully practical, hands-on web application penetration test. You have 2 full days to conduct the assessment against a real target web application in a remote lab environment, then 2 additional days to write and submit a professional penetration test report. There are zero flags to capture and no multiple-choice questions — you must find and exploit a required set of real-world vulnerabilities.
What topics does the PWPA cover?
The PWPA tests practical web application penetration testing skills: OWASP Top 10 (SQLi, XSS, IDOR, broken auth, security misconfiguration, LFI, command injection, file upload), Burp Suite proficiency, authentication and session testing, cookie security, CSRF, WAF evasion, business logic flaws, and basic API testing. Preparation is through TCM Security's Practical Bug Bounty course.
How should I prepare for the PWPA?
Complete TCM Security's Practical Bug Bounty course — it is the official recommended preparation. Practice hands-on in platforms like DVWA, HackTheBox, or PortSwigger Web Security Academy. Master Burp Suite Proxy, Repeater, and Intruder. Study the OWASP Top 10 and OWASP Web Security Testing Guide. Practice writing pentest reports. Use this practice bank to solidify your theoretical understanding.
Is the PWPA suitable for beginners?
Yes — the PWPA is an associate-level (entry) certification. Some familiarity with networking and computer systems is recommended, but prior hacking experience is not required. It is appropriate for web developers transitioning to security, beginner web app pentesters, and aspiring bug bounty hunters who have completed the Practical Bug Bounty course.
What tools do I need for the PWPA?
Core tools: Burp Suite (Proxy, Repeater, Intruder), ffuf or Gobuster (directory brute-forcing), SQLMap (SQL injection), Nikto (web server scanning), Amass or Sublist3r (subdomain enumeration), and browser developer tools. The Param Miner Burp extension is also useful. The exam environment provides access to the necessary tools.
Is this practice test like the real PWPA?
No — this is a multiple-choice knowledge-preparation bank. The real PWPA requires you to actually exploit vulnerabilities in a live web application. These questions test the conceptual and technical knowledge underlying the practical skills: how attacks work, what tools do, which payloads achieve what, and how vulnerabilities are mitigated. Use this bank to validate understanding, then practice hands-on exploitation in lab environments.