Web Application Penetration Testing CPENT Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   You are testing a search feature that reflects user input in an error message. The application is behind a WAF that blocks common SQL injection patterns like ' OR 1=1--. Which technique is most likely to bypass the WAF and still confirm a SQL injection vulnerability?

   • AUse a time-based payload with a long delay, such as ' WAITFOR DELAY '0:0:5'--
   • BSubmit a payload using inline comments to break up the keyword, such as ' O/**/R 1=1--
   • CEncode the entire payload in hexadecimal and send it as the parameter value
   • DChange the HTTP method from GET to POST to avoid WAF inspection
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   Which of the following is a common security issue in REST APIs?

   • ALack of rate limiting, allowing brute-force attacks
   • BReturning data in XML format
   • CUsing JSON for data exchange
   • DUsing HTTP status codes to indicate errors
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   While testing a blog application, you find that the 'author' parameter in the URL is reflected in the page without sanitization. You craft a payload that steals the session cookie and sends it to your server. The payload executes in the browser of any user who clicks your crafted link. Which type of XSS is this, and what is the most direct impact you can demonstrate?

   • AStored XSS; persistent compromise of all visitors to the page
   • BReflected XSS; session hijacking of any user who clicks the link
   • CBlind XSS; payload triggers in an admin panel later
   • DDOM-based XSS; client-side manipulation without server involvement
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   During a penetration test of a corporate web application, you notice that the server responds with detailed stack traces and the HTTP headers reveal the exact web server version and framework. The application also allows weak TLS ciphers. Which finding should be prioritized in your report as the most critical security misconfiguration?

   • AWeak TLS ciphers that allow downgrade attacks
   • BUnnecessary HTTP methods enabled on the server
   • CVerbose error messages that disclose internal paths and framework versions
   • DMissing security headers like CSP and HSTS
   Reveal Solution Discussion Select an answer first
6. 55foundation · easy

   Which of the following is an example of a security misconfiguration in a web application?

   • AThe application uses parameterized queries to prevent SQL injection
   • BThe application uses HTTPS with a valid certificate
   • CThe server returns detailed stack traces to users on errors
   • DThe application has a strong password policy
   Reveal Solution Discussion Select an answer first