Web Application Penetration Testing CPENT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   You have completed a penetration test and found a critical SQL injection in a login form, a medium-severity missing HSTS header, and a low-severity verbose error message. Which reporting approach best communicates the findings to both developers and management?

   • AProvide a technical report only, with no executive summary
   • BList all findings in a single table without risk ratings to avoid bias
   • CProvide a risk-rated report with evidence and remediation steps for each finding, prioritizing the SQL injection
   • DFocus only on the critical SQL injection and omit the lower-severity findings
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which HTTP method is most commonly targeted in CSRF attacks because it changes server state?

   • AOPTIONS
   • BHEAD
   • CPOST
   • DGET
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   During a web application penetration test, you notice that after a user logs out, the session ID remains valid and can be replayed to access the account. The application also allows a logged-in user to change their own role by sending a modified POST request. Which two weaknesses are most directly demonstrated by these observations?

   • AWeak session token entropy and mass assignment
   • BSession fixation and horizontal privilege escalation
   • CMissing CSRF protection and insecure direct object reference
   • DImproper session invalidation and vertical privilege escalation
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which technique is commonly used to bypass a Web Application Firewall (WAF) when injecting SQL payloads?

   • AUsing HTTPS instead of HTTP
   • BSending the payload in a GET request instead of POST
   • CUsing URL encoding or double encoding for special characters
   • DIncreasing the payload length
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   You are starting a web application penetration test. The client has provided only the domain name. Which combination of passive and active reconnaissance techniques would give you the most comprehensive understanding of the attack surface before you begin testing?

   • APort scanning and banner grabbing only
   • BRunning a vulnerability scanner immediately to identify known issues
   • CUsing the Wayback Machine to find old versions of the site
   • DDNS enumeration, search engine dorking, and crawling the site to map endpoints
   Reveal Solution Discussion Select an answer first