mediumMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester is analyzing a Python script…
A penetration tester is analyzing a Python script used for web application testing. The script imports the 'socket' module and uses it to create a raw socket. Which of the following is the most likely purpose of the script?
⚠ Common exam trap
The trap here is that candidates may associate the 'socket' module only with standard TCP/UDP connections (like reverse shells) and overlook that raw sockets are specifically required for crafting custom packets in attacks like SYN floods, which operate at a lower network layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sending crafted TCP packets to perform a SYN flood
The 'socket' module in Python provides low-level networking interfaces, and creating a raw socket (using `socket.SOCK_RAW`) allows the script to craft and send custom packets at the IP layer. A SYN flood attack involves sending a high volume of TCP SYN packets with spoofed source IP addresses to exhaust a target's resources, which requires raw socket access to manipulate packet headers. Therefore, the most likely purpose of the script is sending crafted TCP packets to perform a SYN flood.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Creating a reverse shell payload
Why it's wrong here
A reverse shell payload typically only requires an outbound TCP connection to the attacker's listener, which standard high-level socket APIs (e.g., Python's socket.socket) handle without needing raw sockets. Raw sockets force the programmer to manually construct IP and TCP headers and demand elevated privileges, making them unnecessary and impractical for a simple connect-back shell. Unlike a SYN flood, a reverse shell does not need custom flags, spoofed source addresses, or control over header fields.
- ✓
Sending crafted TCP packets to perform a SYN flood
Why this is correct
Raw sockets expose the IP and TCP headers to the application, enabling the attacker to craft arbitrary TCP packets with custom flags such as SYN, spoof source IP addresses, and bypass the kernel's TCP state machine. In a SYN flood, the attacker repeatedly sends SYN packets but never completes the handshake, exhausting the target's SYN backlog queue and denying service to legitimate clients. This requires socket.socket(AF_INET, SOCK_RAW, IPPROTO_TCP) plus IP_HDRINCL, capabilities that normal stream sockets (SOCK_STREAM) cannot offer.
- ✗
Parsing HTTP responses for header injection
Why it's wrong here
Parsing HTTP responses for header injection is an application-layer task; libraries like requests or http.client automatically decode status lines, headers, and bodies, while raw sockets expose only IP/TCP data and would require manually implementing HTTP parsing from bytes. Raw sockets give no parsing shortcuts—you would have to reassemble TCP segments, handle retransmissions, and then parse the HTTP payload piece by piece. Header injection is about modifying HTTP headers, not about crafting low-level network packets, so raw sockets are the wrong abstraction layer.
- ✗
Automating user-agent rotation for web requests
Why it's wrong here
User-agent rotation is purely an HTTP header manipulation performed at the application layer, typically by cycling a string through the headers argument in the requests library or by setting the 'User-Agent' header on an HTTP client. Raw sockets operate well below this level: you would have to build the entire HTTP request from scratch inside a TCP payload and manage the socket's state machine, adding complexity and risk with no benefit. The kernel's TCP stack already handles connection, delivery, and ordering, so standard high-level HTTP APIs are the correct tool for automating user-agent changes.
Visual reference
Go deeper
Related to this question
About these practice questions
This PT0-003 question is part of Courseiva's 185-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.