mediumMultiple Choice
PT0-002 User-Agent header Practice Question
A penetration tester is analyzing a Python script that uses the requests library to automate web vulnerability scanning. The script sends POST requests with payloads but receives 403 Forbidden responses for many requests, even though manual testing with the same payloads works. Which is the most likely cause?
⚠ Common exam trap
CompTIA often tests the misconception that 403 errors are always due to rate limiting or authentication issues, but here the trap is that the script's default User-Agent header is the root cause, not request frequency or content type.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Missing User-Agent header
Many web servers and WAFs (Web Application Firewalls) block requests that lack a User-Agent header or use a default one like 'python-requests/2.x.x'. Manual testing typically uses a browser, which sends a legitimate User-Agent, while the script's default header triggers the 403 Forbidden response. Setting a realistic User-Agent header in the script mimics browser behavior and bypasses this common filter.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Missing User-Agent header
Why this is correct
The requests library sends its default python-requests User-Agent, which many web application firewalls block with 403 responses. Manual testing from a browser succeeds because it presents a legitimate browser User-Agent, so the script must set a matching header.
- ✗
Incorrect Content-Type header
Why it's wrong here
The requests library defaults to application/x-www-form-urlencoded for POST data, so a mismatched Content-Type can cause the server to reject the body with 403. It is tempting because header handling is a genuine cause of automation failures, but manual testing with identical headers would then also fail.
- ✗
Script is sending too many requests too fast
Why it's wrong here
Rate limiting produces 429 Too Many Requests, not 403 Forbidden; a 403 indicates the request was rejected on authorisation or header grounds, not volume. It is tempting because scanners do trigger throttling, but that mechanism returns a distinct status code, so it does not match the observed response.
- ✗
Payloads are URL-encoded incorrectly
Why it's wrong here
Incorrect URL encoding typically yields malformed input, 400 errors, or altered payloads rather than consistent 403 responses. It is tempting because encoding bugs do break automated requests, but the requests library encodes form data automatically, and manual testing of the same payload would fail identically.
Go deeper
Related to this question
About these practice questions
One of 777 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.