easyMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester gains access to a web…
A penetration tester gains access to a web application that uses a MongoDB backend. The tester discovers that the search functionality directly interpolates user input into a NoSQL query without sanitization. Which technique should the tester use to extract data from the database?
⚠ Common exam trap
The trap here is that candidates see 'injection' and default to SQL injection (Option A) without recognizing that the backend is MongoDB, a NoSQL database, which requires a different injection technique using JSON operators rather than SQL syntax.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NoSQL injection
The application uses MongoDB, a NoSQL database, and the search functionality directly interpolates user input into a NoSQL query without sanitization. This allows the tester to inject MongoDB operators (e.g., $ne, $regex, $gt) to manipulate the query logic and extract data, which is the core of NoSQL injection. Unlike SQL injection, this technique targets MongoDB's query syntax, such as JSON-based operators, to bypass authentication or retrieve records.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SQL injection
Why it's wrong here
SQL injection targets relational database management systems that interpret SQL statements. MongoDB is a NoSQL document database that does not use SQL syntax; instead, it uses a JSON-like query language with operators such as $gt, $ne, and $where. An attacker's SQL payload like ' OR '1'='1' would be treated as literal data in a MongoDB query, not as executable SQL, so this technique cannot manipulate the database logic.
- ✓
NoSQL injection
Why this is correct
NoSQL injection is the correct technique because MongoDB directly interpolates user-supplied input into its query objects. By submitting input such as username[$ne]=null or password[$gt]=, an attacker can inject MongoDB query operators that alter the intended logic, often bypassing authentication or extracting data. More dangerous is the $where operator, which can execute arbitrary JavaScript expressions, making injection possible without SQL syntax.
- ✗
LDAP injection
Why it's wrong here
LDAP injection is a server-side attack that manipulates Lightweight Directory Access Protocol queries, which use filter strings like (&(uid=user)(password=pass)) to query directory services. MongoDB is a NoSQL database, not an LDAP directory, and has no LDAP filter parser. Therefore, LDAP payloads such as *)(|(objectClass=* would have no effect on MongoDB query construction.
- ✗
Command injection
Why it's wrong here
Command injection vulnerabilities allow an attacker to execute arbitrary operating system commands by injecting shell metacharacters like ;, &&, or | into input that is passed to a system shell. In this scenario, the flaw lies in how the application constructs database queries, not in invoking a shell, so injecting OS commands would not run on the underlying server. The impact is database-specific, not OS-level, making this option incorrect.
Go deeper
Related to this question
About these practice questions
One of 185 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.