Result Analysis PT0-003 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A penetration tester is scanning a network and notices that the scanner is not detecting any open ports on a host that is known to be running a web server. The tester pings the host and receives a response. What is the most likely cause of the scan issue?

   • AThe scanner is using the wrong source IP address.
   • BThe scanner is configured to scan the wrong port range.
   • CThe web server is not running on the host.
   • DThe host's firewall is blocking the scan traffic but allowing ICMP.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A penetration tester receives a vulnerability scan report listing a critical SQL injection in a web application. Which technique is most appropriate to validate this finding without causing damage?

   • AIgnore the finding because SQL injection is a common false positive.
   • BExtract the entire database to prove the vulnerability.
   • CInject a benign payload that causes a harmless error message.
   • DRun the same scanner with default settings again.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A penetration tester is performing an internal assessment. The scanner reports that a critical web server is vulnerable to a remote code execution (RCE) flaw. The tester manually verifies the finding by sending a proof-of-concept payload and successfully executes a command. However, the client's security team insists the server was patched last week. The tester checks the patch level and confirms the patch is installed. What is the most likely explanation?

   • AThe server has been compromised and the attacker re-enabled the vulnerability.
   • BThe tester is exploiting a different vulnerability than the one patched.
   • CThe scanner is producing a false positive because the patch is installed.
   • DThe patch is incomplete or was not applied to all instances of the application.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   During an external penetration test, the tester runs a port scan against a target and finds port 443 open. The tester then runs an SSL/TLS scan and the tool reports that the server supports SSLv3. The tester manually connects with OpenSSL and successfully negotiates SSLv3. However, the client's change management team states that SSLv3 was disabled last month. What is the most likely explanation for this discrepancy?

   • AThe tester is connecting to a cached version of the site.
   • BThe change was applied to a different server or load balancer than the one being tested.
   • CThe scanner is producing a false positive because SSLv3 is disabled.
   • DThe change management team is incorrect because SSLv3 is still enabled.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A vulnerability scanner reports that a web server is vulnerable to a specific denial-of-service (DoS) vulnerability. Manual testing shows that the server does not crash or become unresponsive when the exploit is attempted. How should this finding be classified?

   • ATrue positive, because the scanner detected the vulnerability.
   • BTrue negative, because the server is not vulnerable.
   • CInconclusive, because the scanner and manual testing disagree.
   • DFalse positive, because the vulnerability could not be reproduced.
   Reveal Solution Discussion Select an answer first