mediumMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester is analyzing a PowerShell…
A penetration tester is analyzing a PowerShell script that uses Invoke-WebRequest and Invoke-RestMethod to interact with a target web service. The script parses JSON responses to extract session tokens and then uses those tokens in subsequent requests. Which attack technique is this script most likely performing?
⚠ Common exam trap
A common mix-up: candidates confuse the use of Invoke-WebRequest and Invoke-RestMethod with brute-force attacks, but the script's focus on token extraction and reuse points to API parameter manipulation, not credential guessing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Exploiting an API by manipulating request parameters and observing responses.
The script uses Invoke-WebRequest and Invoke-RestMethod to interact with a web service, parsing JSON responses to extract session tokens and reusing them in subsequent requests. This pattern is characteristic of API manipulation, where an attacker modifies request parameters (e.g., headers, query strings, or payload) and observes how the API responds to infer vulnerabilities or escalate privileges, rather than directly attacking authentication or injecting SQL.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Brute-forcing web application login credentials.
Why it's wrong here
Brute-forcing web application login credentials would require repeatedly submitting username/password pairs to an authentication endpoint, often with rate-limiting or lockout considerations. The script's focus on extracting and reusing session tokens indicates it already has authenticated access, and its requests are aimed at API endpoints rather than a login form. Thus, the behavior described aligns with post-authentication API manipulation, not credential guessing.
- ✓
Exploiting an API by manipulating request parameters and observing responses.
Why this is correct
Exploiting an API by manipulating request parameters and observing responses is the correct interpretation. The script dynamically extracts session tokens from prior responses, then reuses them to make authenticated requests while altering parameters such as resource IDs, role fields, or JSON payloads. By analyzing status codes, response bodies, and error messages, the tester can identify authorization flaws (e.g., IDOR), mass assignment, or business logic issues—without needing to bypass authentication itself.
- ✗
Performing a SQL injection attack on a web form.
Why it's wrong here
Performing a SQL injection attack on a web form typically involves injecting SQL metacharacters like `' OR 1=1--` into input fields to alter database queries. The script's use of JSON parsing and token management suggests it interacts with a RESTful API using structured JSON payloads, not traditional form submissions. While parameter manipulation could trigger database errors, the script gives no indication of the error-based, union-based, or time-based payload testing that characterizes SQL injection.
- ✗
Conducting a directory traversal attack to read arbitrary files.
Why it's wrong here
Conducting a directory traversal attack to read arbitrary files would involve manipulating file path parameters, such as `../../etc/passwd`, to escape the web root. The script described focuses on API request parameters and session token reuse, with no mention of file path constructs or reading file content. Directory traversal is typically performed via unvalidated filename parameters in static file-serving endpoints, whereas this script's token-based API interaction points to a different attack vector involving application logic flaws.
Go deeper
Related to this question
About these practice questions
One of 185 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.