PracticeVideosBlogFlashcardsEspañol
All Practice Exams

100+ Free Qualys WAS Practice Questions

Prepare for the Qualys Certified Specialist — Web Application Scanning (WAS) exam with instant access — no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately
Not published Pass Rate
100+ Questions
100% Free

Loading practice questions...

Same family resources

Explore More Qualys Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

Qualys Certified Specialist — Patch Management

Practice Questions

Qualys Certified Specialist — PCI Compliance

Practice Questions

Qualys Certified Specialist — VMDR

Practice Questions

Qualys Endpoint Detection and Response (EDR) Specialist

Practice Questions
2026 Statistics

Key Facts: Qualys WAS Exam

Free

Exam Fee

Qualys (for customers)

Qualys LMS

Delivery Platform

Qualys

200+

API Security Signatures

Qualys WAS API Security

96%

AI Detection Rate

Qualys (with 80% scan time reduction)

150094

Auth Success QID

Qualys WAS

3 types

WAS Scan Types

Discovery, Vulnerability, Auth Test

The Qualys WAS Specialist certification validates expertise in web application DAST scanning using the Qualys platform. Key domains: DAST fundamentals, option profiles and crawl configuration, Selenium-based authentication, OWASP Top 10 detection, REST API scanning (Swagger/OpenAPI/Postman), Burp Suite integration, malware detection, and tag-based reporting. Exam is delivered via Qualys LMS and is free for Qualys customers.

Sample Qualys WAS Practice Questions

Try these sample questions to test your Qualys WAS exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1What are the three scan types available in Qualys Web Application Scanning (WAS)?
A.Discovery, Vulnerability, and Authentication Test
B.Passive, Active, and Hybrid
C.Quick, Full, and Scheduled
D.Internal, External, and Cloud
Explanation: Qualys WAS offers three scan types: Discovery scan (information gathering only, no active attack checks), Vulnerability scan (full active testing for security weaknesses), and Authentication Test (verifies that authentication credentials and scripted logins work correctly before running a full scan).
2Which QID confirms that authentication was successful during a Qualys WAS scan?
A.QID 150095
B.QID 150094
C.QID 150009
D.QID 150001
Explanation: QID 150094 appears in the scan results when authentication was successful in a Qualys WAS scan. This QID is used as a diagnostic confirmation step. QID 150095 is the companion that appears when authentication failed, allowing administrators to verify their credential configuration before launching a full vulnerability scan.
3In a Qualys WAS Selenium authentication script, which placeholder variables are used to parameterize username and password credentials?
A.<<USERNAME>> and <<PASSWORD>>
B.${username} and ${password}
C.@@authusername@@ and @@authpassword@@
D.%user% and %pass%
Explanation: Qualys WAS uses @@authusername@@ and @@authpassword@@ as placeholder tokens inside Selenium HTML scripts. After uploading the script to a WAS Authentication Record and enabling 'Add credentials to Selenium Script,' you supply the actual username and password which WAS substitutes at scan time.
4What tool does Qualys WAS provide to help users create Selenium authentication scripts without writing them from scratch?
A.Qualys IDE Extension
B.Qualys Script Wizard
C.Qualys Proxy Capture
D.Qualys Browser Recorder
Explanation: Qualys provides the Qualys Browser Recorder, a browser extension that records user interactions (clicking, typing, form submission) and exports them as Selenium HTML scripts. These scripts can then be uploaded to WAS Authentication Records to enable scripted login during web application scans.
5Which Qualys WAS feature provides the configuration settings for crawling, sensitive content detection, vulnerability detection, and password brute forcing?
A.Option Profile
B.Authentication Record
C.Web Application Definition
D.Scan Schedule
Explanation: An Option Profile in Qualys WAS bundles all scan behavior settings including crawler configuration (POST/GET behavior, link limits), sensitive content detection, vulnerability detection checks to run, and password brute force settings. Option Profiles are reusable and assigned when launching or scheduling a scan.
6When a Qualys WAS web application has an exclude list only (no allow list), what is the scanner's behavior?
A.Crawl only links that match the exclude list entries
B.Skip all links matching exclude list entries and crawl everything else
C.Stop scanning as soon as any excluded link is encountered
D.Treat all links as excluded and run only vulnerability checks
Explanation: When only an exclude list is configured (no allow list), Qualys WAS skips all links that match the exclude list patterns and crawls everything else. Conversely, if only an allow list is configured, the scanner crawls only those links that match allow list entries. Both lists can be combined for fine-grained scope control.
7Which crawl scope option in Qualys WAS restricts scanning to a specific subdirectory path and all content below it?
A.URL hostname and specified sub-domain
B.URL hostname only
C.Content at or below a URL subdirectory
D.URL hostname and specified domains
Explanation: Qualys WAS provides four crawl scope options. 'Content at or below a URL subdirectory' limits the scan to a specified path prefix, which is useful when you want to scan only a specific application section (e.g., /app/) rather than the entire host. This prevents the scanner from crawling unrelated parts of the web server.
8Which Qualys WAS form submission method is the recommended best practice setting in option profiles to maximize vulnerability detection coverage?
A.HEAD only
B.GET only
C.POST only
D.Post & Get
Explanation: The 'Post & Get' setting is the Qualys WAS recommended best practice for form submission in option profiles. This setting causes the scanner to submit requests to all forms using both POST and GET methods, ensuring maximum reach during vulnerability analysis including SQL injection and XSS testing across all form types.
9What does QID 150009 record in a Qualys WAS scan?
A.The list of links crawled during the scan
B.Authentication success status
C.Detected SQL injection vulnerabilities
D.The list of excluded URLs
Explanation: QID 150009 (Links Crawled) is an informational finding that records all the URLs the Qualys WAS scanner visited during a scan. This is useful for verifying scan coverage, understanding the crawl depth, and identifying whether important application sections were reached during the scan.
10In Qualys WAS, what file format must a valid Selenium script be saved as for it to be accepted as an authentication script?
A.Python .py file
B.HTML file saved from Qualys Browser Recorder
C.JSON file with action commands
D.XML file with driver instructions
Explanation: Qualys WAS requires Selenium scripts to be HTML files saved from the Qualys Browser Recorder. The service validates the script by checking: (a) it is an HTML file from the Browser Recorder, (b) it contains at least one command, and (c) it contains an absolute path to each form requiring authentication. Python, JSON, and XML formats are not accepted.

About the Qualys WAS Exam

The Qualys Certified Specialist — WAS exam validates expertise in using Qualys Web Application Scanning (WAS) to identify, prioritize, and report web application and API vulnerabilities. It covers the full WAS workflow: configuring web applications, option profiles, and authentication records; running discovery and vulnerability scans; detecting OWASP Top 10 and OWASP API Top 10 risks; integrating with Burp Suite; and managing web application assets with tags and dashboards.

Assessment

Question count not published by the exam provider

Time Limit

Not publicly specified

Passing Score

Not publicly specified

Exam Fee

Free (Qualys subscription required) (Qualys)

Qualys WAS Exam Content Outline

~20%

Web App & API Scanning Fundamentals

DAST concepts (black-box testing, active vs. passive), Qualys Cloud Platform SaaS architecture, three scan types (Discovery, Vulnerability, Authentication Test), QID numbering system, authenticated vs. unauthenticated scanning benefits

~20%

WAS Crawl Configuration & Option Profiles

Option profile settings (form submission: Post & Get, performance parallelism, brute force, sensitive content, malware detection), crawl scope options (hostname/subdirectory/specified domains), allow lists, exclude lists (global vs. per-application), JavaScript link extraction for SPAs

~15%

Authentication & Scripted Login

Authentication record types (Form, Basic HTTP, FormOAuth2, Selenium), Qualys Browser Recorder for creating Selenium HTML scripts, @@authusername@@/@@authpassword@@ parameter tokens, authentication verification QIDs 150094 (success) and 150095 (failure), complex multi-step login handling

~20%

OWASP Top 10 Detection

Detection of OWASP Top 10 2021: A01 Broken Access Control, A02 Cryptographic Failures, A03 Injection (SQLi/XSS/CSRF/Blind SQLi/Header XSS), A05 Security Misconfiguration, A06 Vulnerable Components, A07 Authentication Failures, A08 Insecure Deserialization, A10 SSRF; OWASP 2025 update support

~10%

API Security Scanning

REST API scanning via Swagger 2.0/OpenAPI 3.0 file URL targeting, Postman Collection upload, 200+ API-specific detection signatures, OWASP API Top 10 coverage (BOLA/IDOR, Broken Auth, Excessive Data Exposure, BFLA), shadow/rogue API discovery, OpenAPI specification drift detection

~8%

Reporting, Dashboards & Scheduling

Scan scheduling with recurrence (daily/weekly/monthly), three report types (Scorecard by tag, Web Application, Scan), vulnerability lifecycle statuses (New/Active/Fixed/Reopened), OWASP Top 10 mapping in reports, trend numbers, payload/response HTML export for developer remediation

~5%

Burp Suite Integration

Qualys WAS Burp Extension v2 from PortSwigger BApp Store, supported in both Burp Professional and Community editions, importing WAS findings into Burp Repeater for manual validation, centralized automated + manual pen-test findings in WAS module

~7%

Tagging, Asset Management & Malware Detection

Web application tags for grouping, tag-based scorecard reports, malware detection in option profiles, deep learning and behavioral analysis for zero-day web malware, AI-assisted scan clustering for 96% detection rate with 80% time reduction

How to Pass the Qualys WAS Exam

What You Need to Know

  • Passing score: Not publicly specified
  • Assessment: Question count not published by the exam provider
  • Time limit: Not publicly specified
  • Exam fee: Free (Qualys subscription required)

Keys to Passing

  • Work through all 100 available questions
  • Review every answer and explanation
  • Track weak areas and revisit them
  • Use our AI tutor for tough concepts

Qualys WAS Study Tips from Top Performers

1Know the three scan types: Discovery (info-gathering only), Vulnerability (active attack payloads), and Authentication Test (verify credentials)
2Memorize authentication verification QIDs: 150094 = auth success, 150095 = auth failure, 150009 = links crawled
3Understand Option Profile vs. Web Application Definition: Option Profile = HOW to scan; Web App Definition = WHAT and WHERE to scan
4Selenium scripts must be HTML files from Qualys Browser Recorder — use @@authusername@@ and @@authpassword@@ placeholders
5Post & Get form submission is the recommended best practice setting for maximum vulnerability detection coverage
6Allow list + Exclude list behavior: allow list = only crawl matched URLs; exclude list = skip matched URLs; both together = positive scope minus carve-outs
7Vulnerability statuses: New → Active → Fixed → Reopened; statuses are automatically determined by scan results
8Qualys WAS supports Swagger 2.0, OpenAPI 3.0, and Postman Collections for REST API security scanning

Frequently Asked Questions

What is the Qualys WAS certification?

The Qualys Certified Specialist — WAS certification validates expertise in using Qualys Web Application Scanning to identify and report web application and API vulnerabilities. It is delivered via the Qualys LMS and is free for Qualys customers. The exam covers DAST concepts, option profiles, Selenium authentication, OWASP detection, API security scanning, and reporting.

What is the difference between a Discovery scan and a Vulnerability scan in Qualys WAS?

A Discovery scan performs information gathering only — crawling the application to map URLs, forms, and links without sending attack payloads. It is the recommended first step for new applications. A Vulnerability scan actively sends crafted test inputs (SQL injection strings, XSS payloads, etc.) to detect security weaknesses. Both can use authentication records.

How does Selenium authentication work in Qualys WAS?

Selenium authentication uses HTML scripts created with the Qualys Browser Recorder to record and replay multi-step login flows. The script uses @@authusername@@ and @@authpassword@@ placeholders for credentials. After uploading the script to a WAS Authentication Record and enabling credential injection, the scanner replays the login during scans. QID 150094 confirms success; QID 150095 indicates failure.

How does Qualys WAS scan REST APIs?

Qualys WAS supports REST API scanning via Swagger 2.0/OpenAPI 3.0 specification files (URL-based targeting) and Postman Collections (file upload). The scanner parses the API definition to extract endpoints and example values, then tests each endpoint for OWASP API Top 10 vulnerabilities using 200+ API-specific signatures. Shadow and undocumented APIs are also auto-discovered.

What does the Qualys WAS Burp Suite integration do?

The Qualys WAS Burp Extension (installed from PortSwigger BApp Store) enables bidirectional findings exchange: import Burp manual pen-test findings into Qualys WAS for centralized reporting, and import WAS findings into Burp Repeater for manual validation. Version 2 of the extension supports both Burp Professional and Community editions.

How does Qualys WAS malware detection work?

Qualys WAS malware detection uses deep learning models and behavioral analysis to identify injected malicious scripts, drive-by downloads, cryptominer injections, and other web-borne malware in application HTTP responses. This AI-powered approach detects zero-day threats not yet in traditional signature databases, protecting both application integrity and user trust.