hardMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester is analyzing a Python script…
A penetration tester is analyzing a Python script that performs a buffer overflow attack. The script imports the struct module and the socket module. It constructs a payload by packing a pattern of characters, then overwriting a return address with a specific offset. Which of the following is the most critical piece of information the tester must determine before running this script against the target?
⚠ Common exam trap
The trap here is that candidates often focus on network connectivity (IP/port) or OS version, overlooking that the core technical challenge in a buffer overflow exploit is controlling execution flow via a reliable return address like JMP ESP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The exact location of a JMP ESP instruction in memory
The script performs a buffer overflow attack by overwriting a return address. To redirect execution to attacker-controlled shellcode, the tester must overwrite the return address with the address of a JMP ESP instruction (or equivalent) that is reliably located in memory. Without this address, the overwritten return pointer will cause a crash or unpredictable behavior, making exploitation impossible.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The IP address and port of the target service
Why it's wrong here
While necessary to connect, this information is typically obtained during reconnaissance. The script likely already has this or prompts for it. The critical unknown is the address to jump to after overwriting the return address.
- ✓
The exact location of a JMP ESP instruction in memory
Why this is correct
For a buffer overflow where the shellcode is placed in the stack, overwriting the return address with the address of a JMP ESP instruction (which must be at a fixed, predictable address) will redirect execution to the shellcode. Determining this address is crucial for a reliable exploit.
- ✗
The version of the operating system running on the target
Why it's wrong here
While the OS version helps identify the target's defenses and potential instruction set, it does not provide the concrete memory address needed for a reliable return address overwrite. The crucial unknown is the pointer to a 'JMP ESP' or equivalent gadget, which must be resolved by examining loaded modules, ASLR settings, and binary analysis. Even with the correct OS version, you would still need to locate a stable address (e.g., in a non-ASLR DLL) to redirect execution. Thus, OS version alone is insufficient and is secondary to the exact instruction address.
- ✗
The username and password for the target service
Why it's wrong here
Buffer overflow exploits on network services typically target the service's read or parse routine before any authentication is enforced; the malicious payload itself does not require valid credentials. Supplying a username/password would not influence the overwritten stack pointer or return address, and many vulnerable services expose the attack surface anonymously. The precise memory address of a 'JMP ESP' instruction is what determines whether the shellcode gets executed, irrespective of credentials. Authentication bypass, if needed, would be a separate vulnerability—not the core uncertainty in crafting the overflow.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Exploitation
Exploitation is the act of using a vulnerability or weakness in a system, network, or application to gain unauthorized access, cause damage, or extract data.
Key term
Buffer overflow
A buffer overflow is a type of software vulnerability where a program writes more data to a memory buffer than it was designed to hold, causing adjacent memory to be overwritten.
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.