Result Analysis PT0-003 Practice Questions (Page 3)

Questions 11–12

1. 11expert · hard

   A tester is performing a scan of a web application and the scanner reports that the application is vulnerable to XML external entity (XXE) injection. The tester manually sends a payload with an external entity and the application returns the contents of a local file. However, the client states that the application is behind a web application firewall (WAF) that should block XXE attacks. What is the most likely explanation?

   • AThe application is not actually vulnerable because the WAF is protecting it.
   • BThe tester is bypassing the WAF by using a different encoding.
   • CThe scanner is producing a false positive because the WAF is present.
   • DThe WAF is not configured to block XXE attacks.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A tester is conducting a scan of a network and notices that the scanner is reporting a host as 'up' but is not detecting any open ports. The tester manually connects to the host on port 22 (SSH) and the connection is successful. What is the most likely cause of the scan issue?

   • AThe scanner is using a protocol that the host does not support.
   • BThe host is not running any services on the scanned ports.
   • CThe host's firewall is blocking the scanner's source IP.
   • DThe scanner is configured to use a port range that does not include port 22.
   Reveal Solution Discussion Select an answer first