mediumMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester is analyzing a Python script…
A penetration tester is analyzing a Python script that uses the 'requests' library to send HTTP requests with a custom header that mimics a mobile device. The script also uses 'beautifulsoup4' to parse the response and extract specific data. Which task is this script most likely performing?
⚠ Common exam trap
It's easy for candidates to confuse the use of a custom header with security testing (e.g., fuzzing or brute-forcing), but the presence of BeautifulSoup for HTML parsing clearly indicates data extraction, not injection or authentication bypass.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Web scraping to gather publicly available information.
The script uses the 'requests' library to send HTTP requests with a custom header mimicking a mobile device, and 'beautifulsoup4' to parse the HTML response and extract data. This combination is specifically designed for web scraping, where the custom header helps avoid bot detection by making the request appear to come from a mobile browser, and BeautifulSoup extracts targeted information from the page structure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Web scraping to gather publicly available information.
Why this is correct
This combination of requests and BeautifulSoup is the canonical web-scraping stack: requests fetches the raw HTML over HTTP, and BeautifulSoup parses it into a navigable tree to extract elements like links, meta tags, or table rows. The mobile User-Agent mimics a smartphone browser, which helps bypass simple bot-detection rules and retrieve the exact responsive markup a normal visitor would see. Gathering publicly available information this way is a low-risk, passive OSINT technique, and the script's design shows no active attack payloads, making web scraping the only fitting purpose.
- ✗
Fuzzing for SQL injection.
Why it's wrong here
SQL injection fuzzing involves sending a high volume of crafted payloads with special characters, quotes, and comments, then analyzing database error messages, response timing, or length variations for vulnerability clues. While the requests library can transmit those payloads, BeautifulSoup is an HTML parser that cannot encode SQL metacharacters or interpret raw database output—a tester would instead use a tool like sqlmap or write regex/string checks for error signatures. The mobile User-Agent is also unnecessary for fuzzing, as that activity does not need to disguise its client from the target.
- ✗
Performing a brute-force attack on a login form.
Why it's wrong here
Brute-forcing a login form requires repeated POST attempts with different credential pairs, and the decisive logic is a simple pass/fail check based on HTTP status codes, redirects, or an error-message marker in the response body. BeautifulSoup is overkill for that boolean evaluation, and a mobile User-Agent is irrelevant since login endpoints generally treat mobile and desktop authentication identically. Furthermore, effective brute-force tools include concurrency, rate limiting, and wordlist management—none of which are suggested by the script's HTML-parsing focus.
- ✗
Testing for directory traversal vulnerabilities.
Why it's wrong here
Directory traversal testing manipulates file path parameters with sequences like ../../etc/passwd and inspects the raw response body for file contents or filesystem error messages. The requests library could send those requests, but BeautifulSoup would actually hinder analysis by trying to parse file content as HTML, so a tester would use plain string matching or regex to detect sensitive data instead. A mobile User-Agent serves no purpose in this attack either, because the traversal's success depends on server-side file handling regardless of the requesting client type.
Go deeper
Related to this question
About these practice questions
One of 185 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.