Web Application Penetration Testing CPENT Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   During a TLS assessment, you find that the server supports TLS 1.0 and uses RC4 cipher suites. The application also has a certificate that is not trusted by major browsers. Which issue is the most critical and should be prioritized in the report?

   • AUse of weak TLS versions and ciphers that allow decryption or downgrade attacks
   • BMissing HSTS header that allows SSL stripping
   • CCertificate key size that is too small
   • DUntrusted certificate that causes browser warnings
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the purpose of including a risk rating in a penetration testing report?

   • ATo make the report longer and more detailed
   • BTo replace the need for technical evidence
   • CTo satisfy legal requirements only
   • DTo help stakeholders prioritize remediation efforts based on severity
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   You are testing a web application protected by a WAF. Your SQL injection payload 'UNION SELECT username, password FROM users' is blocked. You try URL encoding, but it is still blocked. Which technique is most likely to bypass the WAF while still executing the SQL injection?

   • AUsing a double-URL-encoded payload
   • BSending the payload in a different HTTP method, e.g., POST instead of GET
   • CInserting inline comments between keywords, e.g., 'UN/**/ION SEL/**/ECT'
   • DSwitching to a NoSQL injection payload
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A WAF blocks requests containing the string 'union select' in the query string. You need to test for SQL injection in a parameter that is reflected in a JSON response. Which technique is most likely to bypass the WAF while still being interpreted as a UNION-based SQL injection by the database?

   • AUse inline comments between keywords, such as 'union/**/select'
   • BChange the case of the keywords, such as 'UNION SELECT'
   • CURL-encode the entire payload, such as %27union%20select%27
   • DUse a double-URL-encoded payload
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following is a primary impact of a successful cross-site scripting (XSS) attack?

   • ASession hijacking by stealing the victim's session cookie
   • BDirectly modifying the server's configuration files
   • CExploiting a buffer overflow in the web server
   • DPerforming a denial-of-service attack on the server
   Reveal Solution Discussion Select an answer first