PT0-002 Attacks and Exploits Practice Question
A penetration tester is performing a web application test and identifies a potential SQL injection vulnerability. Which TWO methods can the tester use to confirm the vulnerability and extract data?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Blind time-based SQL injection
UNION-based and blind time-based are classic SQL injection techniques. XSS and command injection are different attacks. XXE is also different.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
XXE injection
Why it's wrong here
XXE is XML entity injection.
- ✗
Command injection
Why it's wrong here
Command injection is OS command execution.
- ✓
Blind time-based SQL injection
Why this is correct
Uses time delays to infer data.
- ✗
XSS injection
Why it's wrong here
XSS is client-side script injection.
- ✓
UNION-based SQL injection
Why this is correct
Extracts data directly via UNION.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Command injection
Command injection is a security vulnerability where an attacker inserts malicious commands into a system through an input field, tricking the application into executing them on the underlying operating system.
Key term
XSS
Cross-Site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
About these practice questions
This PT0-003 question is part of Courseiva's 185-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.