Web Application Penetration Testing CPENT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A penetration tester wants to identify the web server software, version, and operating system of a target web application without sending any packets directly to the target. Which technique would be most appropriate?

   • ARunning Nmap with the -sV flag against the target
   • BUsing the Shodan search engine to query for the target's IP address
   • CSending an HTTP OPTIONS request to the target
   • DUsing netcat to connect to port 80 and read the banner
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which type of injection attack targets a database that stores data in JSON-like documents and uses queries that resemble JavaScript syntax?

   • ASQL injection
   • BNoSQL injection
   • CCommand injection
   • DLDAP injection
   Reveal Solution Discussion Select an answer first
4. 18expert · medium

   You are threat modeling a web application that handles financial transactions. The application has a user role and an admin role. You have identified that the 'transfer funds' function is available to both roles, but the admin role has additional features. You need to prioritize vulnerabilities based on business logic and technical exposure. Which vulnerability should be prioritized as the highest risk?

   • AA horizontal privilege escalation in the 'transfer funds' function allowing users to transfer from other users' accounts
   • BA verbose error message revealing database schema
   • CA missing security header (e.g., CSP) on the login page
   • DA reflected XSS in the search function
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A REST API uses OAuth 2.0 with the implicit grant flow for a single-page application. The API returns sensitive user data and uses CORS with a wildcard origin. You discover that the API does not validate the 'state' parameter. Which combination of vulnerabilities is most critical?

   • ACSRF via missing state parameter and unauthorized data access via wildcard CORS
   • BBroken authentication and rate limiting
   • CExcessive data exposure and mass assignment
   • DToken leakage via the implicit grant and weak token entropy
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   During the reconnaissance phase of a web application penetration test, a tester uses the website's robots.txt file and sitemap.xml to discover hidden directories and endpoints. Which type of information gathering technique is being employed?

   • AVulnerability scanning
   • BSocial engineering
   • CPassive information gathering
   • DActive information gathering
   Reveal Solution Discussion Select an answer first