A penetration tester is assessing a web application that requires authentication to access most features. The tester has valid low-privileged credentials. The tester wants to identify vulnerabilities that are only visible after login, such as IDOR and privilege escalation. Which approach should the tester use?

Conduct a static analysis of the application source code

Run an unauthenticated scan of the login page and public endpoints

Use a proxy to manually test only the login page

Perform a dynamic scan while authenticated with the provided credentials

CompTIAPenTest+

Domain 3Objective 1

Vulnerability Scans PT0-003 Practice Questions (Page 3)

Part of the Vulnerability discovery and analysis domain, which accounts for 17% of the PT0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~11–19 in this domain), expect 4–6 from this objective — we provide 11 practice questions to prepare you well beyond it. (estimate)

11questions here

3free pages

4concepts

17%of the exam

Questions 11–11

11application · medium
A penetration tester is assessing a web application that requires authentication to access most features. The tester has valid low-privileged credentials. The tester wants to identify vulnerabilities that are only visible after login, such as IDOR and privilege escalation. Which approach should the tester use?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to PT0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “PT0-003” is a trademark of its owner, used for identification only.

Vulnerability Scans PT0-003 Practice Questions (Page 3)

Questions 11–11

Keep studying — Vulnerability discovery and analysis