Question 558 of 185
mediumMultiple ChoiceObjective-mapped
PT0-002 User-Agent header Practice Question
A penetration tester is analyzing a Python script that uses the requests library to automate web vulnerability scanning. The script sends POST requests with payloads but receives 403 Forbidden responses for many requests, even though manual testing with the same payloads works. Which is the most likely cause?
⚠ Common exam trap
CompTIA often tests the misconception that 403 errors are always due to rate limiting or authentication issues, but here the trap is that the script's default User-Agent header is the root cause, not request frequency or content type.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Missing User-Agent header
Many web servers and WAFs (Web Application Firewalls) block requests that lack a User-Agent header or use a default one like 'python-requests/2.x.x'. Manual testing typically uses a browser, which sends a legitimate User-Agent, while the script's default header triggers the 403 Forbidden response. Setting a realistic User-Agent header in the script mimics browser behavior and bypasses this common filter.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Missing User-Agent header
Why this is correct
Many WAFs block requests that lack a common browser User-Agent, flagging them as automated. Adding a realistic User-Agent often resolves 403 errors.
- ✗
Incorrect Content-Type header
Why it's wrong here
Incorrect Content-Type would likely cause a different error (e.g., 400 Bad Request) or the server might ignore the payload, not a 403 Forbidden.
- ✗
Script is sending too many requests too fast
Why it's wrong here
Rate limiting typically results in throttling or temporary blocks, but 403 Forbidden on individual requests suggests a per-request filter rather than a rate limit.
- ✗
Payloads are URL-encoded incorrectly
Why it's wrong here
Incorrect URL encoding would cause the server to misinterpret the payload, likely resulting in a 400 error or application-level error, not a 403.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 30, 2026
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.