easyMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester has discovered a critical…
A penetration tester has discovered a critical SQL injection vulnerability in a web application. The developer team will fix the issue. Which level of detail is most appropriate for this audience?
⚠ Common exam trap
Candidates often choose a high-level summary (like CVSS score or business impact) thinking it is sufficient for all audiences, but the PT0-002 exam emphasizes tailoring the level of detail to the recipient's role—developers need technical specifics to remediate, not just risk scores or financial context.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Include the full proof-of-concept code and the exact HTTP requests used.
The developer team needs the exact technical details to reproduce and fix the vulnerability. Providing the full proof-of-concept code and exact HTTP requests allows developers to understand the injection point, the payload structure, and the vulnerable parameter, enabling them to implement a precise fix such as parameterized queries or input validation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Provide the CVSS score and a brief description.
Why it's wrong here
A CVSS score condenses severity into a numeric vector, but it omits the vulnerable parameter name, the injection point (e.g., a search box or an HTTP header), the database type, and the exact payload that triggers the flaw. Without these specifics, a developer cannot reproduce the issue in a test environment or locate the corresponding sink in the source code to implement a fix. The score is useful for risk prioritization, not as a remediation guide.
- ✓
Include the full proof-of-concept code and the exact HTTP requests used.
Why this is correct
Including the full proof-of-concept code and the exact HTTP requests (method, URL, headers, body, and parameter) gives developers a step-by-step reproduction recipe. They can run the same request locally under a debugger to trace the data flow from input to the SQL query, confirm the vulnerable code path, and then verify the fix by re-executing the identical payload. This level of detail also eliminates guesswork about which parameter is injectable and demonstrates the actual impact, such as data extraction, without requiring the developer to craft a payload from scratch.
- ✗
Describe the business impact in financial terms.
Why it's wrong here
Describing business impact in financial terms, such as the estimated cost of a data breach, speaks to executive risk management and budget allocation, not to developers who need to write a code patch. Financial figures are often speculative and depend on breach models, and they provide no information about the vulnerable input field, the SQL query structure, or the appropriate defense (e.g., parameterized queries or input validation). For a developer, the primary need is technical traceability, not a dollar amount that does not map to a line of code.
- ✗
List all findings in a bullet-point summary without additional context.
Why it's wrong here
A bullet-point summary such as 'SQL injection in the login form' omits the vulnerable parameter, the HTTP request context, the exact payload, and the database error output or behavior that proves the issue. Without this context, developers may waste time hunting through the codebase and could misinterpret the finding as a generic warning. A bullet list is acceptable for an executive summary, but as the sole documentation for a critical finding, it fails the fundamental requirement of being reproducible and actionable in a code review.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Payload
In IT and cybersecurity, a payload is the core data or malicious code delivered within a packet, file, or attack that performs the actual intended action.
Key term
SQL injection
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries an application makes to its database, often to read, modify, or destroy data.
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.