PT0-002 Practice Question: A penetration tester is analyzing a Python script…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Directory brute-forcing

  Why it's wrong here

  Directory brute-forcing is incorrect because it enumerates valid resource paths on a web server using GET requests (e.g., /admin, /backup) and analyzes HTTP status codes (200, 403, 404) to identify existing directories or files. The described script sends POST requests with different payloads to a single URL, which is not how path discovery works—there are no paths to brute-force. Additionally, retry with exponential backoff is an anti-rate-limiting measure for repeated login attempts, not a technique used in directory brute-forcing, where speed is prioritized.

• ✓

  Password spraying

  Why this is correct

  Password spraying is correct because the script sends POST requests to a single endpoint (likely a login form) with different password payloads, while the username remains constant or cycles slowly. The retry logic with exponential backoff is specifically designed to evade account lockout policies and rate limiting, allowing the attacker to try multiple passwords across accounts without triggering defenses. This behavior—iterating passwords slowly against one URL—is the signature of password spraying, which uses a few common passwords against many accounts rather than a brute-force of many passwords per account.

• ✗

  SQL injection testing

  Why it's wrong here

  SQL injection testing is wrong because it sends specialized SQL payloads (e.g., single quotes, UNION SELECT, OR 1=1) to observe differences in server responses, database errors, or timing, not generic password strings. The retry with exponential backoff would actually hinder SQLi testing, as a tester needs rapid, repeated requests to map how the application parses injection vectors and tune payloads in real time. Moreover, SQLi is a single-request-per-payload vulnerability check, not a credential-guessing loop, so the script's POST payloads are more consistent with authentication attacks.

• ✗

  Session hijacking

  Why it's wrong here

  Session hijacking is incorrect because it focuses on stealing, fixing, or predicting session identifiers (e.g., session tokens, cookies) to impersonate an authenticated user, not on sending POST payloads to a login endpoint. Implementing exponential backoff in a hijacking attack is nonsensical—there is no credential to guess or lockout to avoid; instead, an attacker would capture tokens via network sniffing, cross-site scripting, or session fixation. The script's behavior of repeatedly sending different payloads via POST with retry logic clearly aligns with authentication brute-forcing or password spraying, not session-based attacks.