What is the primary defense against Cross-Site Request Forgery (CSRF) attacks?

Validating the Content-Type header

Disabling cookies in the browser

Including a unique anti-CSRF token in state-changing requests

Using HTTPS for all communications

You are testing a web application protected by a WAF. Your SQL injection payload 'OR 1=1' is blocked. You try 'OR 1=1 --' and it is also blocked. Which technique is most likely to bypass the WAF while still executing the SQL injection?

Using a case variation, e.g., 'Or 1=1'

Using a comment to break the pattern, e.g., 'OR/**/1=1'

Using a hex-encoded payload, e.g., 'OR 0x31=0x31'

Using a tab character instead of a space, e.g., 'OR\t1=1'

After exploiting a stored XSS vulnerability, you want to assess whether the attack would be detected by the organization's security monitoring. Which observation indicates a logging and monitoring gap?

The web server logs include the source IP and user agent for every request

The application logs all login attempts but does not log the content of POST requests

The application sets the HttpOnly flag on session cookies

The SIEM receives alerts for failed login attempts but not for successful ones

Which of the following is an essential component of a penetration testing report?

A copy of the application's source code

A list of all passwords discovered during testing

The tester's personal opinions about the application

Actionable remediation steps for each identified vulnerability

EC-CouncilCertified Penetration Testing Professional

Domain 3Objective 1

Web Application Penetration Testing CPENT Practice Questions (Page 9)

Part of the Web and API Penetration Testing domain, which makes up ~15% of our current practice bank.

63questions here

13free pages

16concepts

16 Concepts in This Objective

Web Application Reconnaissance
Threat Modeling for Web Apps
Authentication and Session Management Testing
Authorization and Access Control Testing
Input Validation and Injection Flaws
Cross-Site Scripting (XSS) Exploitation
Cross-Site Request Forgery (CSRF) Testing
Security Misconfiguration Assessment
File Upload and Download Vulnerabilities
Business Logic Flaws
Web Services and API Security Testing
Client-Side and Server-Side Request Forgery
Web Application Firewall (WAF) Evasion
Cryptographic Weaknesses in Web Apps
Web Application Logging and Monitoring Gaps
Reporting and Remediation Guidance

Questions 41–45

41foundation · easy
A web application allows users to upload profile pictures. A tester uploads a file named 'shell.php' and successfully executes it. Which vulnerability is this?
Select an answer first
42foundation · easy
What is the primary defense against Cross-Site Request Forgery (CSRF) attacks?
Select an answer first
43application · medium
You are testing a web application protected by a WAF. Your SQL injection payload 'OR 1=1' is blocked. You try 'OR 1=1 --' and it is also blocked. Which technique is most likely to bypass the WAF while still executing the SQL injection?
Select an answer first
44application · medium
After exploiting a stored XSS vulnerability, you want to assess whether the attack would be detected by the organization's security monitoring. Which observation indicates a logging and monitoring gap?
Select an answer first
45foundation · easy
Which of the following is an essential component of a penetration testing report?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CPENT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CPENT” is a trademark of its owner, used for identification only.