hardMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester is conducting a…
A penetration tester is conducting a vulnerability scan of a web application that uses a custom API framework. The scanner reports several potential SQL injection vulnerabilities, but manual testing confirms they are false positives. The tester suspects the scanner is misinterpreting input validation. Which of the following is the most likely reason for these false positives?
⚠ Common exam trap
Test-takers frequently confuse 'reflected input' (which causes false positives) with 'stored input' or actual SQL error messages, assuming any reflection indicates a vulnerability, when in fact the scanner's heuristic is flawed for custom APIs that echo back sanitized input.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The application reflects the injected payload in error messages or response content, causing the scanner to think the injection succeeded
The scanner likely detected the injected payload reflected in the application's response (e.g., in an error message or echoed input), which it interpreted as successful SQL execution. In custom API frameworks, input validation may reject the payload but still reflect it back in the response, causing the scanner to flag a false positive. Manual testing confirms the injection fails, so the reflection is merely a side effect of the API's error handling, not a sign of database interaction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The scanner used a payload that was blocked by a Web Application Firewall (WAF) before reaching the application
Why it's wrong here
If a WAF blocks the payload, the scanner would typically get a different response (e.g., 403) and might not flag it as SQL injection; the assumption is the scanner got a response it interpreted as vulnerable.
- ✓
The application reflects the injected payload in error messages or response content, causing the scanner to think the injection succeeded
Why this is correct
Many scanners check if the payload appears in the response (e.g., error messages containing SQL syntax). If the application echoes back the input without executing it, the scanner may misinterpret this as a successful injection.
- ✗
The scanner used outdated signatures that do not match the custom API's input validation logic
Why it's wrong here
Outdated signatures are a poor explanation for a false positive in this context. A signature-based scanner with outdated rules is far more likely to produce false negatives, meaning it fails to recognize a genuine SQL injection because the specific attack pattern is not in its local database. False positives, by contrast, arise from how the scanner interprets the application's response, such as seeing a reflected payload and mistaking it for a successful injection. Since a custom API with tailored validation would likely reject a stale signature's payload outright, the scanner would receive an error response and not flag the parameter at all, further undermining this option as the cause.
- ✗
The application returns a generic 'Invalid input' message for all types of invalid input, confusing the scanner
Why it's wrong here
Generic error messages might reduce false positives because the scanner cannot distinguish between a blocked injection and a normal error; however, some scanners may still flag based on changes in response length or other heuristics.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
False positive
A false positive is an alert or result that indicates a security threat or vulnerability exists when in fact there is no real issue.
Key term
Payload
In IT and cybersecurity, a payload is the core data or malicious code delivered within a packet, file, or attack that performs the actual intended action.
About these practice questions
This PT0-003 question is part of Courseiva's 185-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.