CWICP

It is delivered as multiple-choice questions covering the ten published domains, with weights ranging from 6% for reporting and ethics up to 16% for input validation and injection. The certifying body's site is the authority for the current delivery method, whether proctored remotely or in a test centre, and any question-count or time-limit figures, so check there before you schedule.

Difficulty is moderate: it rewards people who have actually sent malformed requests and read the responses. The trap is that many questions look like vocabulary checks but hinge on a detail, such as whether a filter runs before or after decoding, or whether a cookie flag is actually enforced by the browser. Hands-on lab time closes that gap faster than reading.

Start with HTTP fundamentals and reconnaissance, because every later domain assumes you can read a request, a response, and a header set fluently. Then take authentication and session management, authorization, and injection as a block, since they share the same mental model of trust boundaries. Add client-side, crypto and transport, and infrastructure next, and finish with WAF evasion and reporting, which draw on everything earlier.

You need working knowledge, not weaponisation. You should be able to explain why a given payload bypasses a given filter, what evidence proves a finding, and how to reproduce it reliably. Questions often present a partial result and ask what it indicates, which theory alone rarely answers well. Practice against intentionally vulnerable applications and keep a lab notebook of what you tried and observed.

Candidates lose marks by skimming the question stem and answering the general case instead of the scenario given, by confusing authentication with authorization, and by treating encoding, escaping, and sanitisation as interchangeable. A second cluster comes from crypto and transport questions where people assume a padlock icon proves the right thing. Read every option before choosing, and eliminate on specific technical grounds.

It is 8%, the same as cryptography and transport and infrastructure, so it deserves real time but not disproportionate effort. Focus on how signatures and normalisation interact: what happens with double encoding, unusual content types, case variation, and comment insertion. Questions usually ask which bypass is plausible against a described rule set rather than requiring memorised payload strings.

Those terms are set by the certifying organisation and change from time to time, so this page does not state them. The official site publishes the current retake rules, any waiting period between attempts, recertification requirements, and validity length. Confirm them there before you pay, and note the date you checked, because policies are revised without much notice.

Everything numeric: the current fee, the number of questions, the time allowed, the passing score, and any pass-rate statistics the body chooses to publish. None of these are stated here because they are not fixed by the domain outline. Also confirm the identity requirements for test day and whether any formula sheet or reference material is permitted.

Use them as diagnostics, not as a curriculum. After each block of questions, write down the underlying rule you missed rather than the answer letter, then go and verify that rule in a lab. Rotating between reading, lab work, and question sets exposes gaps faster than repeating one question bank until the answers feel familiar.