Web Application Penetration Testing CPENT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following indicates a weak TLS configuration in a web application?

   • AUsing TLS 1.2 with strong ciphers
   • BEnabling HSTS
   • CSupporting SSLv3 protocol
   • DUsing a valid certificate from a trusted CA
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   You are threat modeling a web application that handles financial transactions. The application has three user roles: customer, support agent, and admin. Customers can initiate transfers, support agents can view customer data, and admins can modify transaction statuses. You have limited testing time. Which attack surface should you prioritize for manual testing?

   • AThe admin's transaction status modification, focusing on CSRF
   • BThe support agent's customer data view, focusing on XSS
   • CThe login form, focusing on brute-force resistance
   • DThe transfer initiation workflow, focusing on business logic and authorization between roles
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   You are testing an e-commerce application. The checkout process has three steps: cart review, shipping address, and payment. You notice that you can manipulate the 'totalPrice' parameter in the payment step to reduce the order total to $0.01. The application also allows you to change the 'shippingAddress' parameter to another user's address. Which two vulnerabilities are present?

   • AAuthentication bypass and session fixation; enforce MFA and rotate session IDs
   • BBusiness logic flaw and IDOR; implement server-side price calculation and object-level access control
   • CMass assignment and CSRF; use allowlists for parameters and anti-CSRF tokens
   • DSQL injection and XSS; use parameterized queries and output encoding
   Reveal Solution Discussion Select an answer first
5. 4expert · medium

   You are performing reconnaissance on a web application. You have identified that the application uses a JavaScript framework (e.g., React) and makes API calls to '/api/v1/users'. You also notice that the server responds with a 'X-Powered-By: Express' header. You want to map the attack surface and identify potential entry points. Which combination of techniques is most effective for this phase?

   • AChecking for the presence of a WAF by sending malicious payloads
   • BPassive DNS enumeration and WHOIS lookup to identify infrastructure
   • CPort scanning the web server for open ports and services
   • DCrawling the application and parsing JavaScript files for API endpoints and parameters
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Why is it important for a web application to log security-relevant events?

   • ATo automatically patch vulnerabilities
   • BTo improve the application's performance
   • CTo enable detection and investigation of attacks
   • DTo reduce the need for input validation
   Reveal Solution Discussion Select an answer first