PenTest+ V2 OWASP ZAP For Web App Testing Quiz

1. What is the primary role of the Context feature in OWASP ZAP?

To organize and define the scope of testing targets

To generate fake user credentials

To encrypt traffic between ZAP and the target

To automatically fix identified vulnerabilities

Submit

3. In a PenTest+ V2 assessment, what is the primary value of integrating OWASP ZAP results with remediation workflows?

Enables prioritized fixing of vulnerabilities by severity

Eliminates the need for manual testing

Guarantees no future vulnerabilities

Replaces all other security tools

4. Which encoding/payload type is OWASP ZAP commonly used to test for in input validation?

SQL injection and command injection

Only HTML entities

Base64 encoding only

Hexadecimal numbers exclusively

5. What is the primary benefit of using ZAP's API for automation in penetration testing?

Enable scripted scanning and continuous security testing

Prevent all web vulnerabilities automatically

Replace manual code review entirely

Guarantee 100% vulnerability detection

6. True or False: OWASP ZAP is exclusively a commercial tool requiring paid licensing.

True

False

7. Which OWASP ZAP feature helps identify reflected XSS vulnerabilities?

Active Scanner with XSS payloads

Database connection tool

SSL certificate validator

Network packet sniffer

8. In OWASP ZAP, what does the Session Handling feature allow you to do?

Maintain user sessions across multiple test requests

Delete all session cookies automatically

Monitor only incoming HTTP traffic

Generate random session identifiers

9. How can you configure OWASP ZAP to test authenticated endpoints in a web application?

Use the Authentication feature to define login credentials and session handling

Disable SSL certificate validation entirely

Manually log in and avoid using automated scanning

Change the default proxy port to bypass authentication

10. Which ZAP report format is most suitable for executive stakeholders?

HTML with risk summary and remediation guidance

Raw XML data only

Command-line text output

Binary encoded format

11. What is OWASP ZAP primarily designed for in web application testing?

Automated vulnerability scanning and penetration testing

Database administration and backup management

Network firewall configuration and deployment

Cloud infrastructure monitoring and logging

12. True or False: OWASP ZAP can only be used for external web application testing.

True

False

13. Which OWASP Top 10 vulnerability can be identified using ZAP's injection attack tests?

Cross-Site Scripting (XSS)

Injection

Broken Authentication

Sensitive Data Exposure

14. In OWASP ZAP, what does the Alerts tab display?

Detected vulnerabilities and security issues

Network bandwidth consumption

Server error logs only

User authentication attempts

15. What is a common use case for ZAP's Forced Browse feature?

Discovering hidden directories and files

Encrypting sensitive data in transit

Backing up application databases

Monitoring user session activity

16. How does OWASP ZAP's Active Scanner differ from its Passive Scanner?

Active sends test payloads; Passive only observes traffic

Passive is faster; Active provides detailed reports

Active requires manual configuration; Passive is automatic

Passive detects all vulnerabilities; Active finds none

17. Which of the following is a risk rating level used by OWASP ZAP to classify vulnerabilities?

Critical

High

Medium

All of the above

18. In OWASP ZAP, what is the primary purpose of the Passive Scanner?

To send payloads and test for vulnerabilities

To analyze responses without modifying requests

To brute-force authentication credentials

To establish reverse shells on target servers

19. What does the ZAP Spider tool help identify in web applications?

SQL injection vulnerabilities

Accessible URLs, pages, and endpoints

Malware signatures

Network topology and router configurations

20. Which OWASP ZAP mode allows you to intercept and modify HTTP requests in real time?

Passive Scan mode

Active Scan mode

Spider mode

Proxy mode

PenTest+ V2 OWASP ZAP for Web App Testing Quiz