CWICP study guide
CWICP · Work through your exam, one topic at a time.
CWICP is a multiple-choice certification aimed at practitioners who test and defend web applications: application security testers, penetration testers moving into web work, SOC and blue-team analysts who triage web findings, and developers or DevOps engineers who need to reason about exploitation rather than just remediation checklists. The exam is structured around ten weighted domains, with input validation and injection testing carrying the largest share, followed by web fundamentals and HTTP, authentication and session management, and authorization. The CWICP study guide has 10 sections and about 4,395 words.
01Web Application Fundamentals and HTTP
The Web Application Fundamentals and HTTP domain establishes the vocabulary the rest of the exam assumes. Questions here ask you to read a raw request/response pair, decide which tier is responsible for an observed behavior (browser, CDN/reverse proxy, application server, framework, database), and reason about how protocol semantics become security consequences.
423 words, about 2 min02Information Gathering and Reconnaissance
Reconnaissance tests whether you can map an organization's external surface methodically, staying in scope, and convert raw data into testable hypotheses. The exam rewards passive-first discipline and precise interpretation of DNS, certificate, and metadata sources.
392 words, about 2 min03Authentication and Session Management Testing
This domain tests whether you can break or validate the full identity lifecycle: enrollment, login, MFA, session issuance, session lifetime, and logout. Expect questions on token formats, cookie flags, and the specific logic flaws that survive otherwise strong cryptography.
444 words, about 2 min04Authorization and Access Control Testing
Authorization questions dominate real engagements and this exam. The domain tests whether you can prove that a request performed by one identity reaches data or functions belonging to another, and whether you can distinguish a genuine control gap from a UI convenience.
454 words, about 2 min05Input Validation and Injection Testing
Injection remains the highest-impact class in web assessments. The exam tests whether you can identify the sink, choose a detection technique that survives filtering, prove impact without damaging data, and name the correct root-cause fix rather than a blacklist.
416 words, about 2 min06Client-Side and Browser Security Testing
This domain tests how well you understand the browser as a security boundary: origin isolation, script execution, framing, and cross-origin data access. Expect questions that require you to decide whether a behavior is exploitable given browser enforcement rules, not just whether a header is missing.
419 words, about 2 min07Cryptography and Transport Security
This domain checks applied cryptography judgement: whether transport is genuinely protected, whether secrets are stored with appropriate algorithms, and whether the failure you found is exploitable or merely non-ideal. Marks are lost for both overclaiming and underclaiming.
473 words, about 2 min08Server Configuration, Hosting, and Infrastructure
This domain tests whether you notice the layers around the application: web server defaults, exposed files, management interfaces, cloud storage, and the metadata services that turn a small SSRF into infrastructure compromise. Many findings here are found by requesting paths that should not exist.
427 words, about 2 min09Web Application Firewalls, Filtering, and Evasion
This domain tests whether you can tell the difference between a filter and a fix, and whether you can demonstrate that a security control is bypassable using techniques that respect scope and avoid destructive traffic. Cloud WAF, reverse-proxy WAF (ModSecurity with the OWASP Core Rule Set), framework-level input filters, and RASP all inspect different things.
481 words, about 2 min10Reporting, Remediation, and Professional Ethics
The final domain tests the professional half of the job: whether your findings are reproducible, correctly rated, actionable, and produced within authorization. A technically correct finding delivered badly, or delivered outside scope, is a failure on this exam.
466 words, about 2 min