hardMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester discovers that a web…
A penetration tester discovers that a web application uses a vulnerable Java deserialization endpoint. The classpath includes the Apache Commons Collections library. Which attack technique is most likely to achieve remote code execution?
⚠ Common exam trap
It's easy for candidates to confuse deserialization attacks with other input-based attacks like SQLi or XSS, failing to recognize that the specific vulnerability is the unsafe deserialization of Java objects using a known gadget library (Commons Collections) to achieve server-side RCE.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Java deserialization of untrusted data (RCE via Commons Collections).
The presence of the Apache Commons Collections library in the classpath, combined with a vulnerable Java deserialization endpoint, enables the classic 'gadget chain' attack. Attackers craft a malicious serialized object that, when deserialized, invokes methods in Commons Collections (e.g., InvokerTransformer) to execute arbitrary system commands, achieving remote code execution (RCE). This is a well-documented exploit chain (e.g., CVE-2015-7501) that directly leverages the library's reflection-based classes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Java deserialization of untrusted data (RCE via Commons Collections).
Why this is correct
The vulnerability is Java deserialization of untrusted data: the endpoint accepts a serialized Java object and passes it directly to ObjectInputStream.readObject() without input validation or class filtering. Because the application's classpath includes Apache Commons Collections, an attacker can use a tool like ysoserial to generate a malicious object graph that chains gadget classes (e.g., InvokerTransformer, TransformedMap) to execute arbitrary system commands during deserialization. This yields remote code execution on the application server, making it the direct and most impactful attack vector.
- ✗
SQL injection.
Why it's wrong here
SQL injection is a database-layer attack where attacker-controlled input is concatenated into SQL statements without prepared statements, allowing queries to be altered. The scenario focuses on an endpoint that deserializes Java objects, not on a SQL query builder; there is no indication that user input reaches a database call. While SQL injection can also lead to data exfiltration or RCE via xp_cmdshell, it would require a distinct entry point and is not triggered by processing byte streams in ObjectInputStream.
- ✗
Cross-site scripting.
Why it's wrong here
Cross-site scripting is a client-side vulnerability where an attacker injects script code that executes in a victim's browser, enabling session hijacking or UI redressing. It does not execute server-side code and cannot trigger deserialization gadget chains to compromise the Java application server. The deserialization flaw occurs before any HTTP response hits the client; the malicious payload is in the serialized byte stream itself, not in rendered HTML.
- ✗
Command injection.
Why it's wrong here
Command injection exploits unsanitized user input that is directly interpolated into system shell commands, typically via Runtime.exec() or ProcessBuilder, causing the operating system to interpret metacharacters like ';' or '&&'. In a deserialization RCE, the attacker does not need to inject shell syntax; instead, the gadget chain uses Java reflection to invoke a command method on a crafted object. The distinction is that command injection relies on shell parsing, whereas deserialization relies on the internal logic of gadget classes found in libraries like Commons Collections.
Go deeper
Related to this question
About these practice questions
One of 185 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.